diff --git a/tools/cpp/CROSSTOOL b/tools/cpp/CROSSTOOL
index 74a8d4e..5a23b58 100644
--- a/tools/cpp/CROSSTOOL
+++ b/tools/cpp/CROSSTOOL
@@ -217,6 +217,7 @@
   linker_flag: "-lstdc++"
   linker_flag: "-undefined"
   linker_flag: "dynamic_lookup"
+  linker_flag: "-headerpad_max_install_names"
   # TODO(ulfjack): This is wrong on so many levels. Figure out a way to auto-detect the proper
   # setting from the local compiler, and also how to make incremental builds correct.
   cxx_builtin_include_directory: "/"
diff --git a/tools/cpp/cc_configure.bzl b/tools/cpp/cc_configure.bzl
index 226f10f..364305e 100644
--- a/tools/cpp/cc_configure.bzl
+++ b/tools/cpp/cc_configure.bzl
@@ -182,7 +182,11 @@
           # Anticipated future default.
       ] + _add_option_if_supported(repository_ctx, cc, "-no-canonical-prefixes") +
       _add_option_if_supported(repository_ctx, cc, "-Wl,-no-as-needed") + (
-          ["-undefined", "dynamic_lookup"] if darwin else [
+          [
+              "-undefined",
+              "dynamic_lookup",
+              "-headerpad_max_install_names",
+          ] if darwin else [
               "-B" + str(repository_ctx.path(cc).dirname),
               # Always have -B/usr/bin, see https://github.com/bazelbuild/bazel/issues/760.
               "-B/usr/bin",