diff --git a/lld/MachO/Config.h b/lld/MachO/Config.h
index 41bcd58acc27f..88b25c201c853 100644
--- a/lld/MachO/Config.h
+++ b/lld/MachO/Config.h
@@ -203,6 +203,7 @@ struct Configuration {
   std::vector<llvm::StringRef> frameworkSearchPaths;
   bool warnDuplicateRpath = true;
   llvm::SmallVector<llvm::StringRef, 0> runtimePaths;
+  llvm::SmallVector<llvm::StringRef, 0> allowableClients;
   std::vector<std::string> astPaths;
   std::vector<Symbol *> explicitUndefineds;
   llvm::StringSet<> explicitDynamicLookups;
diff --git a/lld/MachO/Driver.cpp b/lld/MachO/Driver.cpp
index 53b4372435ab5..3fe2e4f19901b 100644
--- a/lld/MachO/Driver.cpp
+++ b/lld/MachO/Driver.cpp
@@ -1528,6 +1528,17 @@ static SmallVector<StringRef, 0> getRuntimePaths(opt::InputArgList &args) {
   return vals;
 }
 
+static SmallVector<StringRef, 0> getAllowableClients(opt::InputArgList &args) {
+  SmallVector<StringRef, 0> vals;
+  DenseSet<StringRef> seen;
+  for (const Arg *arg : args.filtered(OPT_allowable_client)) {
+    StringRef val = arg->getValue();
+    if (seen.insert(val).second)
+      vals.push_back(val);
+  }
+  return vals;
+}
+
 namespace lld {
 namespace macho {
 bool link(ArrayRef<const char *> argsArr, llvm::raw_ostream &stdoutOS,
@@ -1771,6 +1782,7 @@ bool link(ArrayRef<const char *> argsArr, llvm::raw_ostream &stdoutOS,
   config->warnDuplicateRpath =
       args.hasFlag(OPT_warn_duplicate_rpath, OPT_no_warn_duplicate_rpath, true);
   config->runtimePaths = getRuntimePaths(args);
+  config->allowableClients = getAllowableClients(args);
   config->allLoad = args.hasFlag(OPT_all_load, OPT_noall_load, false);
   config->archMultiple = args.hasArg(OPT_arch_multiple);
   config->applicationExtension = args.hasFlag(
diff --git a/lld/MachO/Options.td b/lld/MachO/Options.td
index 739d1da15d466..1a3208be7c881 100644
--- a/lld/MachO/Options.td
+++ b/lld/MachO/Options.td
@@ -870,8 +870,7 @@ def sub_umbrella : Separate<["-"], "sub_umbrella">,
     Group<grp_rare>;
 def allowable_client : Separate<["-"], "allowable_client">,
     MetaVarName<"<name>">,
-    HelpText<"Specify <name> of a dylib or framework that is allowed to link to this dylib">,
-    Flags<[HelpHidden]>,
+    HelpText<"Specify <name> of a dylib, framework, or executable that is allowed to link to this dylib">,
     Group<grp_rare>;
 def client_name : Separate<["-"], "client_name">,
     MetaVarName<"<name>">,
diff --git a/lld/MachO/Writer.cpp b/lld/MachO/Writer.cpp
index 0eb809282af28..6a1dd0ae7ecaf 100644
--- a/lld/MachO/Writer.cpp
+++ b/lld/MachO/Writer.cpp
@@ -409,6 +409,31 @@ class LCRPath final : public LoadCommand {
   StringRef path;
 };
 
+class LCSubClient final : public LoadCommand {
+public:
+  explicit LCSubClient(StringRef client) : client(client) {}
+
+  uint32_t getSize() const override {
+    return alignToPowerOf2(sizeof(sub_client_command) + client.size() + 1,
+                           target->wordSize);
+  }
+
+  void writeTo(uint8_t *buf) const override {
+    auto *c = reinterpret_cast<sub_client_command *>(buf);
+    buf += sizeof(sub_client_command);
+
+    c->cmd = LC_SUB_CLIENT;
+    c->cmdsize = getSize();
+    c->client = sizeof(sub_client_command);
+
+    memcpy(buf, client.data(), client.size());
+    buf[client.size()] = '\0';
+  }
+
+private:
+  StringRef client;
+};
+
 class LCDyldEnv final : public LoadCommand {
 public:
   explicit LCDyldEnv(StringRef name) : name(name) {}
@@ -822,6 +847,8 @@ template <class LP> void Writer::createLoadCommands() {
     in.header->addLoadCommand(make<LCDylib>(LC_ID_DYLIB, config->installName,
                                             config->dylibCompatibilityVersion,
                                             config->dylibCurrentVersion));
+    for (StringRef client : config->allowableClients)
+      in.header->addLoadCommand(make<LCSubClient>(client));
     break;
   case MH_BUNDLE:
     break;
diff --git a/lld/test/MachO/Inputs/liballowable_client.dylib b/lld/test/MachO/Inputs/liballowable_client.dylib
deleted file mode 100755
index 7c174a8a72a4c..0000000000000
Binary files a/lld/test/MachO/Inputs/liballowable_client.dylib and /dev/null differ
diff --git a/lld/test/MachO/allowable-client.s b/lld/test/MachO/allowable-client.s
index 3341dc59c1d81..e87e3fabb262c 100644
--- a/lld/test/MachO/allowable-client.s
+++ b/lld/test/MachO/allowable-client.s
@@ -1,16 +1,28 @@
 # REQUIRES: x86
 # RUN: rm -rf %t; split-file %s %t
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/test.s -o %t/test.o
+# RUN: touch %t/empty.s; llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/empty.s -o %t/empty.o
 
-# Check linking against a .dylib
-# RUN: not %lld -o %t/test %t/test.o -L%S/Inputs -lallowable_client 2>&1 | FileCheck %s --check-prefix=NOTALLOWED-IMPLICIT
-# RUN: not %lld -o %t/libtest_debug.exe %t/test.o -L%S/Inputs -lallowable_client 2>&1 | FileCheck %s --check-prefix=NOTALLOWED-IMPLICIT
-# RUN: not %lld -o %t/test %t/test.o -L%S/Inputs -lallowable_client -client_name notallowed 2>&1 | FileCheck %s --check-prefix=NOTALLOWED-EXPLICIT
-# RUN: %lld -o %t/test %t/test.o -L%S/Inputs -lallowable_client -client_name allowed
-# RUN: %lld -o %t/test %t/test.o -L%S/Inputs -lallowable_client -client_name all
-# RUN: %lld -o %t/all %t/test.o -L%S/Inputs -lallowable_client
-# RUN: %lld -o %t/allowed %t/test.o -L%S/Inputs -lallowable_client
-# RUN: %lld -o %t/liballowed_debug.exe %t/test.o -L%S/Inputs -lallowable_client
+# Check that `-allowable_client` generates LC_SUB_CLIENT.
+# We create our .dylib in a `lib` subdirectory to make sure we test linking against the `.dylib` instead of the `.tbd` below.
+# RUN: mkdir -p %t/lib; %lld -dylib -o %t/lib/liballowable_client.dylib %t/empty.o -allowable_client allowed -allowable_client also_allowed
+# RUN: llvm-objdump --macho --all-headers %t/lib/liballowable_client.dylib | FileCheck %s
+# CHECK:      LC_SUB_CLIENT
+# CHECK-NEXT: cmdsize 24
+# CHECK-NEXT: client allowed
+# CHECK:      LC_SUB_CLIENT
+# CHECK-NEXT: cmdsize 32
+# CHECK-NEXT: client also_allowed
+
+# Check linking against the .dylib we created above
+# RUN: not %lld -o %t/test %t/test.o -L%t/lib -lallowable_client 2>&1 | FileCheck %s --check-prefix=NOTALLOWED-IMPLICIT
+# RUN: not %lld -o %t/libtest_debug.exe %t/test.o -L%t/lib -lallowable_client 2>&1 | FileCheck %s --check-prefix=NOTALLOWED-IMPLICIT
+# RUN: not %lld -o %t/test %t/test.o -L%t/lib -lallowable_client -client_name notallowed 2>&1 | FileCheck %s --check-prefix=NOTALLOWED-EXPLICIT
+# RUN: %lld -o %t/test %t/test.o -L%t/lib -lallowable_client -client_name allowed
+# RUN: %lld -o %t/test %t/test.o -L%t/lib -lallowable_client -client_name all
+# RUN: %lld -o %t/all %t/test.o -L%t/lib -lallowable_client
+# RUN: %lld -o %t/allowed %t/test.o -L%t/lib -lallowable_client
+# RUN: %lld -o %t/liballowed_debug.exe %t/test.o -L%t/lib -lallowable_client
 
 # Check linking against a .tbd
 # RUN: not %lld -o %t/test %t/test.o -L%t -lallowable_client 2>&1 | FileCheck %s --check-prefix=NOTALLOWED-IMPLICIT