diff --git a/lib/protocol/deviceid.go b/lib/protocol/deviceid.go
index 3af587d57..bb36edc98 100644
--- a/lib/protocol/deviceid.go
+++ b/lib/protocol/deviceid.go
@@ -21,7 +21,10 @@ const DeviceIDLength = 32
 type DeviceID [DeviceIDLength]byte
 type ShortID uint64
 
-var LocalDeviceID = DeviceID{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}
+var (
+	LocalDeviceID = DeviceID{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}
+	EmptyDeviceID = DeviceID{ /* all zeroes */ }
+)
 
 // NewDeviceID generates a new device ID from the raw bytes of a certificate
 func NewDeviceID(rawCert []byte) DeviceID {
@@ -49,6 +52,9 @@ func DeviceIDFromBytes(bs []byte) DeviceID {
 
 // String returns the canonical string representation of the device ID
 func (n DeviceID) String() string {
+	if n == EmptyDeviceID {
+		return ""
+	}
 	id := base32.StdEncoding.EncodeToString(n[:])
 	id = strings.Trim(id, "=")
 	id, err := luhnify(id)
@@ -96,6 +102,9 @@ func (n *DeviceID) UnmarshalText(bs []byte) error {
 
 	var err error
 	switch len(id) {
+	case 0:
+		*n = EmptyDeviceID
+		return nil
 	case 56:
 		// New style, with check digits
 		id, err = unluhnify(id)
diff --git a/lib/protocol/deviceid_test.go b/lib/protocol/deviceid_test.go
index 79a1c64da..ff9e35cf2 100644
--- a/lib/protocol/deviceid_test.go
+++ b/lib/protocol/deviceid_test.go
@@ -37,7 +37,8 @@ var validateCases = []struct {
 	s  string
 	ok bool
 }{
-	{"", false},
+	{"", true}, // Empty device ID, all zeroes
+	{"a", false},
 	{"P56IOI7-MZJNU2Y-IQGDREY-DM2MGTI-MGL3BXN-PQ6W5BM-TBBZ4TJ-XZWICQ2", true},
 	{"P56IOI7-MZJNU2-IQGDREY-DM2MGT-MGL3BXN-PQ6W5B-TBBZ4TJ-XZWICQ", true},
 	{"P56IOI7 MZJNU2I QGDREYD M2MGTMGL 3BXNPQ6W 5BTB BZ4T JXZWICQ", true},