diff --git a/.github/workflows/aws-lc-rs.yml b/.github/workflows/aws-lc-rs.yml
index c14132707a5..7572e98e589 100644
--- a/.github/workflows/aws-lc-rs.yml
+++ b/.github/workflows/aws-lc-rs.yml
@@ -147,6 +147,35 @@ jobs:
           cargo test -p aws-lc-sys
           cargo test -p aws-lc-rs
 
+  # iOS cross-compilation build test (aarch64-apple-ios)
+  aws-lc-rs-ios-aarch64:
+    if: github.repository_owner == 'aws'
+    name: aws-lc-rs iOS aarch64 cross-compilation
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          repository: aws/aws-lc-rs
+          path: ./aws-lc-rs
+          submodules: 'recursive'
+      - name: Remove aws-lc submodule from crate directory
+        working-directory: ./aws-lc-rs/aws-lc-sys
+        shell: bash
+        run: rm -rf aws-lc
+      - uses: actions/checkout@v4
+        with:
+          path: ./aws-lc-rs/aws-lc-sys/aws-lc
+      - run: brew install llvm
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          target: aarch64-apple-ios
+      - name: Build for aarch64-apple-ios
+        working-directory: ./aws-lc-rs
+        env:
+          CC: /opt/homebrew/opt/llvm/bin/clang
+          CXX: /opt/homebrew/opt/llvm/bin/clang++
+        run: cargo build -p aws-lc-rs --target aarch64-apple-ios --features bindgen
+
   # Full bindings pre-generation test on Windows (x86_64-pc-windows-msvc)
   aws-lc-rs-windows:
     if: github.repository_owner == 'aws'
diff --git a/crypto/rand_extra/internal.h b/crypto/rand_extra/internal.h
index b79627d9df8..55ae272d438 100644
--- a/crypto/rand_extra/internal.h
+++ b/crypto/rand_extra/internal.h
@@ -15,7 +15,9 @@
     defined(OPENSSL_SOLARIS) || defined(OPENSSL_WASM) || \
     (defined(OPENSSL_LINUX) && !defined(HAVE_LINUX_RANDOM_H))
 #define OPENSSL_RAND_GETENTROPY
-#elif defined(OPENSSL_IOS)
+// OPENSSL_APPLE is always defined when OPENSSL_MACOS is defined, so this
+// branch must come after the OPENSSL_MACOS branch above.
+#elif defined(OPENSSL_APPLE)
 #define OPENSSL_RAND_CCRANDOMGENERATEBYTES
 #else
 #define OPENSSL_RAND_URANDOM