diff --git a/handshake/handshake.proto b/handshake/handshake.proto
index 42f1ed62..352aebd7 100644
--- a/handshake/handshake.proto
+++ b/handshake/handshake.proto
@@ -23,11 +23,13 @@ message NebulaHandshakeDetails {
   // hand-written parser silently skips it on read.
   uint64 Cookie = 4 [deprecated = true];
   uint64 Time = 5;
-  // Multiport lane negotiation. Absent on hosts without multiport enabled;
-  // vanilla nebula treats 6 and 7 as unknown fields and skips them.
-  LaneDetails InitiatorLanes = 6;
-  LaneDetails ResponderLanes = 7;
   uint32 CertVersion = 8;
+  // reserved for WIP multiport
+  reserved 6, 7;
+  // Multiport lane negotiation. Absent on hosts without multiport enabled;
+  // vanilla nebula treats 9 and 10 as unknown fields and skips them.
+  LaneDetails InitiatorLanes = 9;
+  LaneDetails ResponderLanes = 10;
 }
 
 // LaneDetails advertises a host's multiport lane capability. On a base
diff --git a/handshake/payload.go b/handshake/payload.go
index 0e8a6c37..8adec998 100644
--- a/handshake/payload.go
+++ b/handshake/payload.go
@@ -37,13 +37,13 @@ type LaneDetails struct {
 
 // Proto field numbers for NebulaHandshakeDetails
 const (
-	fieldCert           = 1 // bytes
-	fieldInitiatorIndex = 2 // uint32
-	fieldResponderIndex = 3 // uint32
-	fieldTime           = 5 // uint64
-	fieldInitiatorLanes = 6 // LaneDetails
-	fieldResponderLanes = 7 // LaneDetails
-	fieldCertVersion    = 8 // uint32
+	fieldCert           = 1  // bytes
+	fieldInitiatorIndex = 2  // uint32
+	fieldResponderIndex = 3  // uint32
+	fieldTime           = 5  // uint64
+	fieldCertVersion    = 8  // uint32
+	fieldInitiatorLanes = 9  // LaneDetails
+	fieldResponderLanes = 10 // LaneDetails
 )
 
 // Proto field numbers for LaneDetails
@@ -75,6 +75,12 @@ func MarshalPayload(out []byte, p Payload) []byte {
 		details = protowire.AppendTag(details, fieldTime, protowire.VarintType)
 		details = protowire.AppendVarint(details, p.Time)
 	}
+	if p.CertVersion != 0 {
+		details = protowire.AppendTag(details, fieldCertVersion, protowire.VarintType)
+		details = protowire.AppendVarint(details, uint64(p.CertVersion))
+	}
+	// Emitted last to keep the encoding in ascending field-number order, which
+	// is what protoc-gen-go would produce for the same message.
 	if p.InitiatorLanes != nil {
 		details = protowire.AppendTag(details, fieldInitiatorLanes, protowire.BytesType)
 		details = protowire.AppendBytes(details, p.InitiatorLanes.marshal(nil))
@@ -83,10 +89,6 @@ func MarshalPayload(out []byte, p Payload) []byte {
 		details = protowire.AppendTag(details, fieldResponderLanes, protowire.BytesType)
 		details = protowire.AppendBytes(details, p.ResponderLanes.marshal(nil))
 	}
-	if p.CertVersion != 0 {
-		details = protowire.AppendTag(details, fieldCertVersion, protowire.VarintType)
-		details = protowire.AppendVarint(details, uint64(p.CertVersion))
-	}
 
 	out = protowire.AppendTag(out, 1, protowire.BytesType)
 	out = protowire.AppendBytes(out, details)