diff --git a/client/internal/ipcauth/consoleuser_darwin.go b/client/internal/ipcauth/consoleuser_darwin.go
index 53ed9c704..354518c0f 100644
--- a/client/internal/ipcauth/consoleuser_darwin.go
+++ b/client/internal/ipcauth/consoleuser_darwin.go
@@ -1,3 +1,5 @@
+//go:build darwin && !ios
+
 package ipcauth
 
 import (
diff --git a/client/internal/ipcauth/consoleuser_ios.go b/client/internal/ipcauth/consoleuser_ios.go
new file mode 100644
index 000000000..c729662b3
--- /dev/null
+++ b/client/internal/ipcauth/consoleuser_ios.go
@@ -0,0 +1,10 @@
+package ipcauth
+
+// isConsoleUser has no meaning on iOS, which has no console session to sit at.
+//
+// iOS satisfies the darwin constraint, so this keeps it off the macOS lookup.
+// That one reaches SystemConfiguration through purego, which refuses to build
+// for iOS without cgo.
+func isConsoleUser(Identity) bool {
+	return false
+}
diff --git a/client/internal/ipcauth/consoleuser_other.go b/client/internal/ipcauth/consoleuser_other.go
index 68e3f076a..d03a2d312 100644
--- a/client/internal/ipcauth/consoleuser_other.go
+++ b/client/internal/ipcauth/consoleuser_other.go
@@ -5,9 +5,8 @@ package ipcauth
 // isConsoleUser has no meaning on a platform that exposes no console-user
 // lookup, where nobody is ever at a console.
 //
-// Mobile is not built from here: ios satisfies darwin and android satisfies
-// linux, so both take those lookups, which are present but never find a GUI
-// session or a seat.
+// Android is not built from here: it satisfies linux and takes that lookup,
+// which is present but never finds a seat.
 func isConsoleUser(Identity) bool {
 	return false
 }