diff --git a/.gn b/.gn
index 0ee19e906b..2fe06103df 100644
--- a/.gn
+++ b/.gn
@@ -37,7 +37,7 @@ default_args = {
   # component builds.
   is_component_build = false
 
-  mac_sdk_min = "10.11"
+  mac_sdk_min = "10.12"
 
   # WebRTC does not want to switch to C++14 yet.
   use_cxx11 = true
diff --git a/DEPS b/DEPS
index 1db7232884..b9f0cb537e 100644
--- a/DEPS
+++ b/DEPS
@@ -177,6 +177,12 @@ hooks = [
     'pattern': '.',
     'action': ['python', 'src/build/vs_toolchain.py', 'update'],
   },
+  {
+    # Update the Mac toolchain if necessary.
+    'name': 'mac_toolchain',
+    'pattern': '.',
+    'action': ['python', 'src/build/mac_toolchain.py'],
+  },
   # Pull binutils for linux, enabled debug fission for faster linking /
   # debugging when used with clang on Ubuntu Precise.
   # https://code.google.com/p/chromium/issues/detail?id=352046
diff --git a/build_overrides/build.gni b/build_overrides/build.gni
index 6defefd898..3f5940a674 100644
--- a/build_overrides/build.gni
+++ b/build_overrides/build.gni
@@ -35,6 +35,5 @@ lint_suppressions_file = "//tools_webrtc/android/suppressions.xml"
 # so we just ignore that assert. See https://crbug.com/648948 for more info.
 ignore_elf32_limitations = true
 
-# Use system Xcode installation instead of the Chromium bundled Mac toolchain,
-# since it contains only SDK 10.11, not 10.12 which WebRTC needs.
-use_system_xcode = true
+# Use bundled hermetic Xcode installation maintainted by Chromium.
+use_system_xcode = false