diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8f7b30b0df..684b17e2b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -164,8 +164,11 @@ jobs:
           - # Default
 
         target:
-          - aarch64-apple-ios
           - aarch64-apple-darwin
+          - aarch64-apple-ios
+          # - aarch64-apple-tvos      Tier 3; handled below
+          # - aarch64-apple-visionos  Tier 3; handled below
+          # - aarch64-apple-watchos   Tier 3; handled below
           - aarch64-linux-android
           - aarch64-pc-windows-msvc
           - aarch64-unknown-linux-gnu
@@ -205,6 +208,29 @@ jobs:
             # TODO: Run in the emulator.
             cargo_options: --no-run
 
+          - target: aarch64-apple-tvos
+            host_os: macos-14
+            rust_channel: nightly
+            mode: --release
+            # TODO: Run in the emulator.
+            cargo_options: --no-run -Z build-std
+
+          - target: aarch64-apple-visionos
+            host_os: macos-14
+            rust_channel: nightly
+            mode: --release
+            xcode_version: 15.2
+            # TODO: Run in the emulator.
+            cargo_options: --no-run -Z build-std
+
+          - target: aarch64-apple-watchos
+            host_os: macos-14
+            rust_channel: nightly
+            mode: --release
+            xcode_version: 15.2
+            # TODO: Run in the emulator.
+            cargo_options: --no-run -Z build-std
+
           - target: aarch64-linux-android
             host_os: ubuntu-22.04
             # TODO: https://github.com/briansmith/ring/issues/486
@@ -316,6 +342,9 @@ jobs:
           echo "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Tools\Llvm\x64\bin" >> $GITHUB_PATH
         shell: bash
 
+      - if: ${{ matrix.xcode_version != '' }}
+        run: sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode_version }}.app/Contents/Developer
+
       - if: ${{ !contains(matrix.host_os, 'windows') }}
         run: |
           mk/cargo.sh +${{ matrix.rust_channel }} test -vv --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}
diff --git a/Cargo.toml b/Cargo.toml
index 0898ddd1af..a86503923e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -176,6 +176,11 @@ libc = { version = "0.2.148", default-features = false }
 [build-dependencies]
 cc = { version = "1.0.83", default-features = false }
 
+# At least 1.0.93 is requried for visionOS, but some versions around that point
+# have bugs that seem to have been fixed in 1.0.97 or so.
+[target.'cfg(all(target_vendor = "apple", target_os = "visionos"))'.build-dependencies]
+cc = { version = "1.0.97", default-features = false }
+
 [features]
 # These features are documented in the top-level module's documentation.
 default = ["alloc", "dev_urandom_fallback"]
diff --git a/mk/cargo.sh b/mk/cargo.sh
index 13906aee88..0bd5e530a0 100755
--- a/mk/cargo.sh
+++ b/mk/cargo.sh
@@ -64,6 +64,14 @@ llvm_version=18
 
 use_clang=
 case $target in
+   aarch64-apple-visionos)
+     export XROS_DEPLOYMENT_TARGET=1.0
+     export CARGO_TARGET_AARCH64_APPLE_VISIONOS_RUSTFLAGS="-Clink-args=--target=arm64-apple-visionos${XROS_DEPLOYMENT_TARGET}"
+     ;;
+   aarch64-apple-watchos)
+     export WATCHOS_DEPLOYMENT_TARGET=5.0
+     export CARGO_TARGET_AARCH64_APPLE_WATCHOS_RUSTFLAGS="-Clink-args=--target=arm64-apple-watchos${WATCHOS_DEPLOYMENT_TARGET}"
+     ;;
    aarch64-linux-android)
     export CC_aarch64_linux_android=$android_tools/aarch64-linux-android21-clang
     export AR_aarch64_linux_android=$android_tools/llvm-ar
diff --git a/mk/install-build-tools.sh b/mk/install-build-tools.sh
index 81fd9ed1ba..ca7129c7b0 100755
--- a/mk/install-build-tools.sh
+++ b/mk/install-build-tools.sh
@@ -68,6 +68,11 @@ case ${target-} in
 esac
 
 case ${target-} in
+aarch64-apple-tvos | aarch64-apple-tvos-sim | \
+aarch64-apple-visionos | aarch64-apple-visionos-sim | \
+aarch64-apple-watchos | aarch64-apple-watchos-sim)
+  build_std=1
+  ;;
 aarch64-unknown-linux-gnu)
   # Clang is needed for code coverage.
   use_clang=1
@@ -214,8 +219,12 @@ esac
 
 rustup toolchain install --no-self-update --profile=minimal ${toolchain}
 if [ -n "${target-}" ]; then
-  rustup target add --toolchain=${toolchain} ${target}
+  if [ -n "${build_std-}" ]; then
+    rustup +${toolchain} component add rust-src
+  else
+    rustup +${toolchain} target add ${target}
+  fi
 fi
 if [ -n "${RING_COVERAGE-}" ]; then
-  rustup toolchain install --profile=minimal ${toolchain} --component llvm-tools-preview
+  rustup +${toolchain} component add llvm-tools-preview
 fi
diff --git a/src/polyfill/cstr.rs b/src/polyfill/cstr.rs
index 74c0176fdb..3fa1cac8a8 100644
--- a/src/polyfill/cstr.rs
+++ b/src/polyfill/cstr.rs
@@ -12,6 +12,11 @@
 // OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
 // CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
+#![cfg(all(
+    target_vendor = "apple",
+    any(target_os = "ios", target_os = "macos", target_os = "tvos")
+))]
+
 //! Work around lack of `core::ffi::CStr` prior to Rust 1.64, and the lack of
 //! `const fn` support for `CStr` in later versions.
 
diff --git a/src/rand.rs b/src/rand.rs
index 0d55635a00..71ba60288b 100644
--- a/src/rand.rs
+++ b/src/rand.rs
@@ -132,16 +132,23 @@ impl crate::sealed::Sealed for SystemRandom {}
     target_os = "hermit",
     target_os = "hurd",
     target_os = "illumos",
-    target_os = "ios",
     target_os = "linux",
-    target_os = "macos",
     target_os = "netbsd",
     target_os = "openbsd",
     target_os = "redox",
     target_os = "solaris",
-    target_os = "tvos",
     target_os = "vita",
     target_os = "windows",
+    all(
+        target_vendor = "apple",
+        any(
+            target_os = "ios",
+            target_os = "macos",
+            target_os = "tvos",
+            target_os = "visionos",
+            target_os = "watchos",
+        )
+    ),
     all(
         target_arch = "wasm32",
         any(