diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9354329..0879c07 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -72,6 +72,7 @@ jobs:
 
   build_macos:
     runs-on: macos-latest
+    # runs-on: macos-11.0
     strategy:
       matrix:
         version: ['macos-amd64', 'macos-arm64']
@@ -113,7 +114,10 @@ jobs:
       env:
         GOOS: ${{ matrix.GOOS }}
         GOARCH: ${{ matrix.GOARCH }}
-      run: make dist
+        CGO_ENABLED: 1
+      run: |
+        SDKROOT=$(xcrun --sdk macosx --show-sdk-path) \
+        make dist
     -
       name: Prepare build artifact for stashing
       run: |
@@ -163,6 +167,7 @@ jobs:
 
   test_macos:
     runs-on: macos-latest
+    # runs-on: macos-11.0
     steps:
     -
       name: Set up Go 1.16
diff --git a/Makefile b/Makefile
index 21e967b..b30e10a 100644
--- a/Makefile
+++ b/Makefile
@@ -35,7 +35,17 @@ dist:
 	go build -v -ldflags="-w -s -X github.com/dh1tw/remoteRotator/cmd.commitHash=${COMMIT} \
 		-X github.com/dh1tw/remoteRotator/cmd.version=${VERSION}"
 	# compress binary
-	if [ "${GOOS}" == "windows" ]; then upx remoteRotator.exe; else upx remoteRotator; fi
+	# there is a know issue that upx currently doesn't work with darwin/arm64.
+	# See https://github.com/upx/upx/issues/424
+	# until it's resolved, we ship darwin/arm64 uncompressed.
+	if [ "${GOOS}" == "windows" ]; \
+		then upx remoteRotator.exe; \
+		else \
+		if [ "${GOOS}" == "darwin" ] && [ "${GOARCH}" == "arm64" ]; \
+			then true; \
+		else upx remoteRotator; \
+		fi \
+	fi
 
 # test:
 # 	@go test -short ${PKG_LIST}