diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 537aa696..2da511f8 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -133,7 +133,7 @@ jobs:
     - name: Install Rust (rustup)
       run: rustup update
     - run: cargo install cargo-audit
-    - run: cargo audit
+    - run: cargo audit --ignore RUSTSEC-2020-0159
 
   docs:
     name: Build docs
diff --git a/Makefile b/Makefile
index aea94165..399ebce2 100644
--- a/Makefile
+++ b/Makefile
@@ -87,7 +87,7 @@ bench:
 
 .PHONY: audit
 audit:
-	cargo audit
+	cargo audit --ignore RUSTSEC-2020-0159
 
 .PHONY: clean
 clean:
diff --git a/benchmarks/lucet-benchmarks/src/lib.rs b/benchmarks/lucet-benchmarks/src/lib.rs
index 989b582a..0f00e5a6 100644
--- a/benchmarks/lucet-benchmarks/src/lib.rs
+++ b/benchmarks/lucet-benchmarks/src/lib.rs
@@ -1,3 +1,9 @@
+// This crate uses several Criterion APIs which are deprecated. However, the
+// Lucet project is in maintence mode and we no longer really care about
+// maintaining and updating these interfaces, so we will ignore these
+// warnings:
+#![allow(deprecated)]
+
 mod compile;
 mod context;
 mod modules;
diff --git a/lucetc/src/lib.rs b/lucetc/src/lib.rs
index 2ec54de7..b8e39d3b 100644
--- a/lucetc/src/lib.rs
+++ b/lucetc/src/lib.rs
@@ -472,9 +472,15 @@ fn ldflags_default(target: &Triple, target_version: &TargetVersion) -> String {
         | OperatingSystem::Freebsd
         | OperatingSystem::Dragonfly
         | OperatingSystem::Netbsd
-        | OperatingSystem::Openbsd => "-shared",
+        | OperatingSystem::Openbsd => "-shared".to_string(),
         OperatingSystem::Darwin | OperatingSystem::MacOSX { .. } => {
-            "-dylib -dead_strip -export_dynamic -undefined dynamic_lookup"
+           let sdk_path = std::process::Command::new("xcrun")
+                .args(&["-sdk", "macosx", "--show-sdk-path"])
+                .output()
+                .expect("xcrun failed")
+                .stdout;
+                let sdk_path = std::str::from_utf8(&sdk_path).expect("invalid sdk_path").trim();
+                format!("-dylib -dead_strip -export_dynamic -undefined dynamic_lookup -L {}/usr/lib -lSystem", sdk_path)
         }
         _ => panic!(
             "Cannot determine default flags for {}.