diff --git a/hscontrol/app.go b/hscontrol/app.go
index d2c9eee8..417bd4e8 100644
--- a/hscontrol/app.go
+++ b/hscontrol/app.go
@@ -876,7 +876,7 @@ func (h *Headscale) Serve() error {
 		log.Info().Msg("metrics server disabled (metrics_listen_addr is empty)")
 	}
 
-	var tailsqlContext context.Context
+	var tailsqlCancel context.CancelFunc
 
 	if tailsqlEnabled {
 		if h.cfg.Database.Type != types.DatabaseSqlite {
@@ -891,9 +891,12 @@ func (h *Headscale) Serve() error {
 			log.Fatal().Msg("tailsql requires TS_AUTHKEY to be set")
 		}
 
-		tailsqlContext = context.Background()
+		var tailsqlCtx context.Context
+		tailsqlCtx, tailsqlCancel = context.WithCancel(ctx)
 
-		go runTailSQLService(ctx, util.TSLogfWrapper(), tailsqlStateDir, h.cfg.Database.Sqlite.Path) //nolint:errcheck
+		errorGroup.Go(func() error {
+			return runTailSQLService(tailsqlCtx, util.TSLogfWrapper(), tailsqlStateDir, h.cfg.Database.Sqlite.Path)
+		})
 	}
 
 	// Handle common process-killing signals so we can gracefully shut down:
@@ -975,9 +978,9 @@ func (h *Headscale) Serve() error {
 					grpcListener.Close()
 				}
 
-				if tailsqlContext != nil {
+				if tailsqlCancel != nil {
 					info("shutting down tailsql")
-					tailsqlContext.Done()
+					tailsqlCancel()
 				}
 
 				// Close network listeners