diff --git a/.github/actions/build-nix/action.yml b/.github/actions/build-nix/action.yml
new file mode 100644
index 00000000..ef6968dd
--- /dev/null
+++ b/.github/actions/build-nix/action.yml
@@ -0,0 +1,24 @@
+name: build via Nix
+
+inputs:
+  package:
+    description: package specification to build
+    required: true
+  flake:
+    description: flake specification
+    default: .
+  install-path:
+    description: path within resulting output, from which to install (e.g. `/bin/foo`)
+
+
+runs:
+  using: composite
+  steps:
+  - run: nix build -L --show-trace --override-input 'nixify' '.' '${{ inputs.flake }}#${{ inputs.package }}'
+    shell: bash
+  - run: nix run -L --inputs-from . 'nixpkgs#coreutils' -- --coreutils-prog=ginstall -p "./result${{ inputs.install-path }}" '${{ inputs.package }}'
+    shell: bash
+  - uses: actions/upload-artifact@v3
+    with:
+      name: ${{ inputs.package }}
+      path: ${{ inputs.package }}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 17083fc3..0beacce6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -96,6 +96,11 @@ jobs:
           package: rust-hello
           test-bin: ./result/bin/rust-hello
 
+        - os: ubuntu-22.04
+          package: rust-hello-aarch64-apple-darwin
+          test-bin: file ./result/bin/rust-hello
+          test-oci: docker load < ./result
+
         - os: ubuntu-22.04
           package: rust-hello-aarch64-unknown-linux-musl
           test-bin: nix shell --inputs-from . 'nixpkgs#qemu' -c qemu-aarch64 ./result/bin/rust-hello
@@ -115,6 +120,11 @@ jobs:
           test-bin: nix run --inputs-from . 'nixpkgs#wasmtime' ./result/bin/rust-hello.wasm
           test-oci: docker load < ./result
 
+        - os: ubuntu-22.04
+          package: rust-hello-x86_64-apple-darwin
+          test-bin: file ./result/bin/rust-hello
+          test-oci: docker load < ./result
+
         - os: ubuntu-22.04
           package: rust-hello-x86_64-pc-windows-gnu
           test-bin: nix shell --inputs-from . 'nixpkgs#wine64' -c wine64 ./result/bin/rust-hello.exe
@@ -131,6 +141,11 @@ jobs:
           package: rust-hello-debug
           test-bin: ./result/bin/rust-hello
 
+        - os: ubuntu-22.04
+          package: rust-hello-debug-aarch64-apple-darwin
+          test-bin: file ./result/bin/rust-hello
+          test-oci: docker load < ./result
+
         - os: ubuntu-22.04
           package: rust-hello-debug-aarch64-unknown-linux-musl
           test-bin: nix shell --inputs-from . 'nixpkgs#qemu' -c qemu-aarch64 ./result/bin/rust-hello
@@ -146,6 +161,11 @@ jobs:
           test-bin: nix run --inputs-from . 'nixpkgs#wasmtime' ./result/bin/rust-hello.wasm
           test-oci: docker load < ./result
 
+        - os: ubuntu-22.04
+          package: rust-hello-debug-x86_64-apple-darwin
+          test-bin: file ./result/bin/rust-hello
+          test-oci: docker load < ./result
+
         - os: ubuntu-22.04
           package: rust-hello-debug-x86_64-pc-windows-gnu
           test-bin: nix shell --inputs-from . 'nixpkgs#wine64' -c wine64 ./result/bin/rust-hello.exe
@@ -167,6 +187,7 @@ jobs:
           accept-flake-config = true
     - uses: DeterminateSystems/magic-nix-cache-action@v2
     - uses: cachix/cachix-action@v12
+      continue-on-error: true
       with:
         name: rvolosatovs
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -177,3 +198,193 @@ jobs:
     - run: nix build -L --show-trace --override-input 'nixify' '.' './examples/rust-hello#${{ matrix.config.package }}-oci'
       if: ${{ matrix.config.package != 'default' && matrix.config.package != 'rust-hello' && matrix.config.package != 'rust-hello-debug' }}
     - run: ${{ matrix.config.test-oci }}
+
+  rust-complex:
+    strategy:
+      matrix:
+        config:
+        # Darwin
+        - os: macos-12
+          package: default
+          test-bin: ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex
+          test-bin: ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex-aarch64-apple-darwin
+          test-bin: file ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex-aarch64-unknown-linux-musl
+          test-bin: file ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex-armv7-unknown-linux-musleabihf
+          test-bin: file ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex-x86_64-apple-darwin
+          test-bin: ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex-x86_64-pc-windows-gnu
+          test-bin: file ./result/bin/foo.exe
+          suffix: .exe
+
+        - os: macos-12
+          package: rust-complex-x86_64-unknown-linux-musl
+          test-bin: file ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex-debug
+          test-bin: ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex-debug-aarch64-apple-darwin
+          test-bin: file ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex-debug-aarch64-unknown-linux-musl
+          test-bin: file ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex-debug-armv7-unknown-linux-musleabihf
+          test-bin: file ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex-debug-x86_64-apple-darwin
+          test-bin: ./result/bin/foo
+
+        - os: macos-12
+          package: rust-complex-debug-x86_64-pc-windows-gnu
+          test-bin: file ./result/bin/foo.exe
+          suffix: .exe
+
+        - os: macos-12
+          package: rust-complex-debug-x86_64-unknown-linux-musl
+          test-bin: file ./result/bin/foo
+
+        # Linux
+        - os: ubuntu-22.04
+          package: default
+          test-bin: ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex
+          test-bin: ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex-aarch64-apple-darwin
+          test-bin: file ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex-aarch64-unknown-linux-musl
+          test-bin: nix shell --inputs-from . 'nixpkgs#qemu' -c qemu-aarch64 ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex-armv7-unknown-linux-musleabihf
+          test-bin: nix shell --inputs-from . 'nixpkgs#qemu' -c qemu-arm ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex-x86_64-apple-darwin
+          test-bin: file ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex-x86_64-pc-windows-gnu
+          test-bin: nix shell --inputs-from . 'nixpkgs#wine64' -c wine64 ./result/bin/foo.exe
+          suffix: .exe
+
+        - os: ubuntu-22.04
+          package: rust-complex-x86_64-unknown-linux-musl
+          test-bin: ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex-debug
+          test-bin: ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex-debug-aarch64-apple-darwin
+          test-bin: file ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex-debug-aarch64-unknown-linux-musl
+          test-bin: nix shell --inputs-from . 'nixpkgs#qemu' -c qemu-aarch64 ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex-debug-armv7-unknown-linux-musleabihf
+          test-bin: nix shell --inputs-from . 'nixpkgs#qemu' -c qemu-arm ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex-debug-x86_64-apple-darwin
+          test-bin: file ./result/bin/foo
+
+        - os: ubuntu-22.04
+          package: rust-complex-debug-x86_64-pc-windows-gnu
+          test-bin: nix shell --inputs-from . 'nixpkgs#wine64' -c wine64 ./result/bin/foo.exe
+          suffix: .exe
+
+        - os: ubuntu-22.04
+          package: rust-complex-debug-x86_64-unknown-linux-musl
+          test-bin: ./result/bin/foo
+
+    runs-on: ${{ matrix.config.os }}
+    steps:
+    - uses: actions/checkout@v3
+    - uses: DeterminateSystems/nix-installer-action@v4
+      with:
+        extra-conf: |
+          accept-flake-config = true
+    - uses: DeterminateSystems/magic-nix-cache-action@v2
+    - uses: cachix/cachix-action@v12
+      continue-on-error: true
+      with:
+        name: rvolosatovs
+        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+    - uses: ./.github/actions/build-nix
+      with:
+        package: ${{ matrix.config.package }}
+        flake: ./examples/rust-complex
+        install-path: /bin/foo${{ matrix.config.suffix }}
+    - run: ${{ matrix.config.test-bin }}
+
+  test-linux:
+    needs: rust-complex
+    runs-on: macos-12
+    steps:
+    - uses: actions/download-artifact@v3
+      with:
+        name: rust-complex-x86_64-unknown-linux-musl
+    - run: chmod +x ./rust-complex-x86_64-unknown-linux-musl
+    - run: ./rust-complex-x86_64-unknown-linux-musl
+
+  test-macos:
+    needs: rust-complex
+    runs-on: macos-12
+    steps:
+    - uses: actions/download-artifact@v3
+      with:
+        name: rust-complex-aarch64-apple-darwin
+    - uses: actions/download-artifact@v3
+      with:
+        name: rust-complex-x86_64-apple-darwin
+    - run: chmod +x ./rust-complex-x86_64-apple-darwin
+    - run: ./rust-complex-x86_64-apple-darwin
+    - run: lipo -create ./rust-complex-aarch64-apple-darwin ./rust-complex-x86_64-apple-darwin -output ./rust-complex-universal-darwin
+    - run: chmod +x ./rust-complex-universal-darwin
+    - run: ./rust-complex-universal-darwin
+    - uses: actions/upload-artifact@v3
+      with:
+        name: rust-complex-universal-darwin
+        path: rust-complex-universal-darwin
+
+  test-windows:
+    needs: rust-complex
+    runs-on: windows-2022
+    steps:
+    - uses: actions/download-artifact@v3
+      with:
+        name: rust-complex-x86_64-pc-windows-gnu
+    - run: .\rust-complex-x86_64-pc-windows-gnu
diff --git a/flake.lock b/flake.lock
index f433ec26..e473ec10 100644
--- a/flake.lock
+++ b/flake.lock
@@ -184,6 +184,22 @@
         "type": "github"
       }
     },
+    "macos-sdk": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1656095854,
+        "narHash": "sha256-Bksziu35r3/t7qNl6P/LXc/UZDF1zbXCMMvEarPFGUs=",
+        "owner": "hexops-graveyard",
+        "repo": "sdk-macos-12.0",
+        "rev": "14613b4917c7059dad8f3789f55bb13a2548f83d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hexops-graveyard",
+        "repo": "sdk-macos-12.0",
+        "type": "github"
+      }
+    },
     "nix-filter": {
       "locked": {
         "lastModified": 1687178632,
@@ -372,6 +388,7 @@
         "crane": "crane",
         "fenix": "fenix",
         "flake-utils": "flake-utils",
+        "macos-sdk": "macos-sdk",
         "nix-filter": "nix-filter",
         "nix-log": "nix-log",
         "nixlib": "nixlib_3",
diff --git a/flake.nix b/flake.nix
index 21906091..a27635c1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,6 +18,8 @@
   inputs.fenix.inputs.nixpkgs.follows = "nixpkgs";
   inputs.fenix.url = github:nix-community/fenix;
   inputs.flake-utils.url = github:numtide/flake-utils;
+  inputs.macos-sdk.url = github:hexops-graveyard/sdk-macos-12.0;
+  inputs.macos-sdk.flake = false;
   inputs.nix-filter.url = github:numtide/nix-filter;
   inputs.nix-log.url = github:rvolosatovs/nix-log;
   inputs.nixlib.url = github:nix-community/nixpkgs.lib;
@@ -39,6 +41,7 @@
           extendDerivations {
             buildInputs = with pkgs; [
               wasmtime
+              zig
             ];
           }
           devShells;
diff --git a/lib/rust/mkAttrs.nix b/lib/rust/mkAttrs.nix
index 4d8d9f69..f9c99ad2 100644
--- a/lib/rust/mkAttrs.nix
+++ b/lib/rust/mkAttrs.nix
@@ -2,8 +2,9 @@
   self,
   crane,
   flake-utils,
-  nixlib,
+  macos-sdk,
   nix-log,
+  nixlib,
   ...
 }:
 with flake-utils.lib.system;
@@ -286,14 +287,8 @@ with self.lib.rust.targets;
           useRosetta = final.stdenv.buildPlatform.isDarwin && final.stdenv.buildPlatform.isAarch64 && pkgsCross.stdenv.hostPlatform.isDarwin && pkgsCross.stdenv.hostPlatform.isx86_64;
           useEmu = final.stdenv.buildPlatform.system != pkgsCross.stdenv.hostPlatform.system && !useRosetta && pkgsCross.stdenv.hostPlatform.system != aarch64-darwin;
 
-          depsBuildBuild = optional pkgsCross.stdenv.hostPlatform.isDarwin pkgsCross.darwin.apple_sdk.frameworks.Security;
-
           targetArgs =
             {
-              inherit
-                depsBuildBuild
-                ;
-
               CARGO_BUILD_TARGET = target;
             }
             // optionalAttrs pkgsCross.stdenv.hostPlatform.isLinux {
@@ -307,13 +302,33 @@ with self.lib.rust.targets;
               {
                 strictDeps = true;
 
-                depsBuildBuild =
-                  depsBuildBuild
-                  ++ [
-                    pkgsCross.stdenv.cc
-                  ]
+                depsBuildBuild = let
+                  crossZigCC = let
+                    target' =
+                      if target == aarch64-apple-darwin
+                      then "aarch64-macos-none"
+                      else if target == x86_64-apple-darwin
+                      then "x86_64-macos-none"
+                      else throw "unsupported target ${target}";
+                  in
+                    # NOTE: Prior art:
+                    # https://actually.fyi/posts/zig-makes-rust-cross-compilation-just-work
+                    # https://github.com/rust-cross/cargo-zigbuild
+                    final.writeShellScriptBin "${target}-zigcc" ''
+                      ${final.zig}/bin/zig cc -target ${target'} ${optionalString pkgsCross.stdenv.buildPlatform.isDarwin ''--sysroot="$SDKROOT" -I"$SDKROOT/usr/include" -L"$SDKROOT/usr/lib" -F"$SDKROOT/System/Library/Frameworks"''} $@
+                    '';
+
+                  cc =
+                    if pkgsCross.stdenv.hostPlatform.isDarwin
+                    then crossZigCC
+                    else pkgsCross.stdenv.cc;
+                in
+                  [cc]
                   ++ optional pkgsCross.stdenv.hostPlatform.isWindows pkgsCross.windows.pthreads;
 
+                HOST_AR = "${final.stdenv.cc.targetPrefix}ar";
+                HOST_CC = "${final.stdenv.cc.targetPrefix}cc";
+
                 nativeCheckInputs = optional useEmu (
                   if pkgsCross.stdenv.hostPlatform.isWasm
                   then final.wasmtime
@@ -321,19 +336,33 @@ with self.lib.rust.targets;
                   then final.wine64
                   else final.qemu
                 );
-
-                HOST_AR = "${final.stdenv.cc.targetPrefix}ar";
-                HOST_CC = "${final.stdenv.cc.targetPrefix}cc";
-
+              }
+              // optionalAttrs (!pkgsCross.stdenv.hostPlatform.isDarwin) {
                 "AR_${target}" = "${pkgsCross.stdenv.cc.targetPrefix}ar";
                 "CC_${target}" = "${pkgsCross.stdenv.cc.targetPrefix}cc";
               }
               // optionalAttrs (!pkgsCross.stdenv.hostPlatform.isWasi) {
                 "CARGO_TARGET_${toUpper (kebab2snake target)}_LINKER" = "${pkgsCross.stdenv.cc.targetPrefix}cc";
               }
+              // optionalAttrs pkgsCross.stdenv.hostPlatform.isDarwin {
+                "CC_${target}" = "${target}-zigcc";
+
+                preBuild = ''
+                  export HOME=$(mktemp -d)
+                  export SDKROOT="${macos-sdk}/root"
+                '';
+
+                "CARGO_TARGET_${toUpper (kebab2snake target)}_LINKER" = "rust-lld";
+              }
+              // optionalAttrs (pkgsCross.stdenv.hostPlatform.isDarwin && pkgsCross.stdenv.hostPlatform.isAarch64) {
+                doNotRemoveReferencesToVendorDir = true;
+              }
               // optionalAttrs (doCheck && target == aarch64-apple-darwin) {
                 doCheck = warn "testing not currently supported when cross-compiling for `${target}`" false;
               }
+              // optionalAttrs (doCheck && pkgsCross.stdenv.hostPlatform.isDarwin && !final.stdenv.hostPlatform.isDarwin) {
+                doCheck = warn "testing not currently supported when cross-compiling for `${target}` from non-Darwin platform" false;
+              }
               // optionalAttrs (doCheck && useEmu) (
                 if target == armv7-unknown-linux-musleabihf
                 then
@@ -423,13 +452,13 @@ with self.lib.rust.targets;
           };
 
         targets' = let
-          default.${aarch64-apple-darwin} = prev.stdenv.buildPlatform.isDarwin;
+          default.${aarch64-apple-darwin} = true;
           default.${aarch64-unknown-linux-gnu} = true;
           default.${aarch64-unknown-linux-musl} = true;
           default.${armv7-unknown-linux-musleabihf} = true;
           default.${wasm32-unknown-unknown} = true;
           default.${wasm32-wasi} = true;
-          default.${x86_64-apple-darwin} = prev.stdenv.buildPlatform.isDarwin && prev.stdenv.buildPlatform.isx86_64;
+          default.${x86_64-apple-darwin} = true;
           default.${x86_64-pc-windows-gnu} = true;
           default.${x86_64-unknown-linux-gnu} = true;
           default.${x86_64-unknown-linux-musl} = true;