diff --git a/client/internal/peer/conn.go b/client/internal/peer/conn.go
index 41ccd60d0..74ebff54c 100644
--- a/client/internal/peer/conn.go
+++ b/client/internal/peer/conn.go
@@ -90,9 +90,9 @@ type PQHandshaker interface {
 	// PSK returns the peer's latest derived post-quantum PSK to program at WG
 	// peer-config time (the pull path). ok is false until one has been derived.
 	PSK(remoteKey string) (wgtypes.Key, bool)
-	// SetRemotePort registers the peer's data-path endpoint from signalling: the peer's
-	// WG overlay IP combined with its advertised pq UDP port.
-	SetRemotePort(remoteKey string, overlayIP netip.Addr, port int)
+	// SetRemoteAddr registers the peer's data-path endpoint learned from signalling:
+	// its WG overlay IP with the advertised pq UDP port.
+	SetRemoteAddr(remoteKey string, addr netip.AddrPort)
 	// OnDataPathRekeyed signals a fresh WireGuard handshake for the peer; it clocks the
 	// next chained PSK rotation pushed over the data path.
 	OnDataPathRekeyed(remoteKey string)
diff --git a/client/internal/peer/handshaker.go b/client/internal/peer/handshaker.go
index 767688375..8301ea4ae 100644
--- a/client/internal/peer/handshaker.go
+++ b/client/internal/peer/handshaker.go
@@ -177,10 +177,11 @@ func (h *Handshaker) Listen(ctx context.Context) {
 // pqRegisterEndpoint feeds the post-quantum handshaker the peer's data-path endpoint
 // (its WG overlay IP plus the advertised pq UDP port) learned from a remote offer/answer.
 func (h *Handshaker) pqRegisterEndpoint(remotePort int) {
-	if h.config.PQ == nil || remotePort <= 0 || len(h.config.WgConfig.AllowedIps) == 0 {
+	if h.config.PQ == nil || remotePort <= 0 || remotePort > 65535 || len(h.config.WgConfig.AllowedIps) == 0 {
 		return
 	}
-	h.config.PQ.SetRemotePort(h.config.Key, h.config.WgConfig.AllowedIps[0].Addr(), remotePort)
+	addr := netip.AddrPortFrom(h.config.WgConfig.AllowedIps[0].Addr(), uint16(remotePort))
+	h.config.PQ.SetRemoteAddr(h.config.Key, addr)
 }
 
 func (h *Handshaker) SendOffer() error {
diff --git a/client/internal/pqkem_adapter.go b/client/internal/pqkem_adapter.go
index 17d810d49..94ce8ccf2 100644
--- a/client/internal/pqkem_adapter.go
+++ b/client/internal/pqkem_adapter.go
@@ -81,14 +81,14 @@ func (p pqHandshaker) PSK(remoteKey string) (wgtypes.Key, bool) {
 	return wgtypes.Key(psk), true
 }
 
-// SetRemotePort registers the peer's data-path endpoint (overlay IP + pq UDP port)
+// SetRemoteAddr registers the peer's data-path endpoint (overlay IP + pq UDP port)
 // learned from signalling. Sends only ever fire once the tunnel is up (clocked by
 // OnDataPathRekeyed), so registering here is safe even before connection-up.
-func (p pqHandshaker) SetRemotePort(remoteKey string, overlayIP netip.Addr, port int) {
-	if port <= 0 || port > 65535 || !overlayIP.IsValid() {
+func (p pqHandshaker) SetRemoteAddr(remoteKey string, addr netip.AddrPort) {
+	if !addr.IsValid() || addr.Port() == 0 {
 		return
 	}
-	p.mgr.AddPeer(pqkem.RemoteID(remoteKey), netip.AddrPortFrom(overlayIP, uint16(port)))
+	p.mgr.AddPeer(pqkem.RemoteID(remoteKey), addr)
 }
 
 // OnDataPathRekeyed clocks the next chained PSK rotation on a fresh WG handshake.