diff --git a/internal/mcp/stepup_touchid_darwin.go b/internal/mcp/stepup_touchid_darwin.go
index a304e9a..2934dc5 100644
--- a/internal/mcp/stepup_touchid_darwin.go
+++ b/internal/mcp/stepup_touchid_darwin.go
@@ -1,4 +1,4 @@
-//go:build darwin
+//go:build darwin && cgo
 
 package mcp
 
diff --git a/internal/mcp/stepup_touchid_darwin_test.go b/internal/mcp/stepup_touchid_darwin_test.go
index 64a6f86..4519f87 100644
--- a/internal/mcp/stepup_touchid_darwin_test.go
+++ b/internal/mcp/stepup_touchid_darwin_test.go
@@ -1,4 +1,4 @@
-//go:build darwin
+//go:build darwin && cgo
 
 package mcp
 
diff --git a/internal/mcp/stepup_touchid_other.go b/internal/mcp/stepup_touchid_other.go
index 73d9b4a..d692868 100644
--- a/internal/mcp/stepup_touchid_other.go
+++ b/internal/mcp/stepup_touchid_other.go
@@ -1,9 +1,12 @@
-//go:build !darwin
+//go:build !darwin || !cgo
 
 package mcp
 
 // touchIDAvailable is the platform stub matching the darwin probe. Non-
-// darwin builds have no biometric stack to consult, so it's always false.
+// darwin builds have no biometric stack to consult; darwin builds
+// without cgo (cross-compiled binaries shipped from a non-darwin CI
+// runner) can't link against LocalAuthentication.framework either. Both
+// paths fall through to TTY, so the stub returns false.
 func touchIDAvailable() bool {
 	return false
 }
diff --git a/internal/mcp/stepup_touchid_other_test.go b/internal/mcp/stepup_touchid_other_test.go
index 6c69fef..eaa3c8f 100644
--- a/internal/mcp/stepup_touchid_other_test.go
+++ b/internal/mcp/stepup_touchid_other_test.go
@@ -1,4 +1,4 @@
-//go:build !darwin
+//go:build !darwin || !cgo
 
 package mcp