diff --git a/.gn b/.gn
index 2fe06103dfc..7591ffbb898 100644
--- a/.gn
+++ b/.gn
@@ -25,7 +25,8 @@ check_targets = [ "//webrtc/*" ]
 # These are the list of GN files that run exec_script. This whitelist exists
 # to force additional review for new uses of exec_script, which is strongly
 # discouraged except for gypi_to_gn calls.
-exec_script_whitelist = build_dotfile_settings.exec_script_whitelist
+exec_script_whitelist = build_dotfile_settings.exec_script_whitelist +
+                        [ "//build_overrides/build.gni" ]
 
 default_args = {
   # Webrtc does not support component builds because we are not using the
diff --git a/build_overrides/build.gni b/build_overrides/build.gni
index 3f5940a6741..81cb3e73ae2 100644
--- a/build_overrides/build.gni
+++ b/build_overrides/build.gni
@@ -35,5 +35,14 @@ lint_suppressions_file = "//tools_webrtc/android/suppressions.xml"
 # so we just ignore that assert. See https://crbug.com/648948 for more info.
 ignore_elf32_limitations = true
 
-# Use bundled hermetic Xcode installation maintainted by Chromium.
-use_system_xcode = false
+# Use bundled hermetic Xcode installation maintainted by Chromium,
+# except for local iOS builds where it's unsupported.
+if (host_os == "mac") {
+  _result = exec_script("//build/mac/should_use_hermetic_xcode.py",
+                        [ target_os ],
+                        "value")
+  assert(_result != 2,
+         "Do not allow building targets with the default" +
+             "hermetic toolchain if the minimum OS version is not met.")
+  use_system_xcode = _result == 0
+}