diff --git a/.github/workflows/CICD.yml b/.github/workflows/CICD.yml
index 3181ff53f4b..e5d905a4a46 100644
--- a/.github/workflows/CICD.yml
+++ b/.github/workflows/CICD.yml
@@ -635,18 +635,27 @@ jobs:
         ${{ steps.dep_vars.outputs.CARGO_UTILITY_LIST_OPTIONS }} -p coreutils
       env:
         RUST_BACKTRACE: "1"
+    - name: Decide whether to train PGO
+      shell: bash
+      run: |
+        ## PGO needs to run the instrumented binary, so it is limited to the
+        ## natively-built, published targets. x86_64-apple-darwin is excluded:
+        ## it is cross-compiled on an arm64 runner, which cannot execute it.
+        PGO=0
+        if [ '${{ matrix.job.skip-publish }}' != 'true' ] && \
+           [ '${{ matrix.job.check-only }}' != 'true' ] && \
+           [ '${{ matrix.job.use-cross }}' != 'use-cross' ]; then
+          case '${{ matrix.job.target }}' in
+            x86_64-unknown-linux-gnu|aarch64-unknown-linux-gnu|aarch64-apple-darwin) PGO=1 ;;
+          esac
+        fi
+        echo "PGO=${PGO}" >> "$GITHUB_ENV"
     - name: Install llvm-tools (PGO)
-      if: |
-        matrix.job.skip-publish != true && matrix.job.check-only != true &&
-        matrix.job.use-cross != 'use-cross' &&
-        (matrix.job.target == 'x86_64-unknown-linux-gnu' || matrix.job.target == 'aarch64-unknown-linux-gnu')
+      if: env.PGO == '1'
       shell: bash
       run: rustup component add llvm-tools
     - name: Train PGO profiles
-      if: |
-        matrix.job.skip-publish != true && matrix.job.check-only != true &&
-        matrix.job.use-cross != 'use-cross' &&
-        (matrix.job.target == 'x86_64-unknown-linux-gnu' || matrix.job.target == 'aarch64-unknown-linux-gnu')
+      if: env.PGO == '1'
       shell: bash
       run: |
         ./util/build-pgo.sh \
@@ -655,10 +664,7 @@ jobs:
           --train-only
         echo "RUSTFLAGS=${RUSTFLAGS:+${RUSTFLAGS} }-Cprofile-use=${{ github.workspace }}/target/coreutils-pgo/coreutils.profdata" >> "$GITHUB_ENV"
     - name: Verify PGO is applied to the published build
-      if: |
-        matrix.job.skip-publish != true && matrix.job.check-only != true &&
-        matrix.job.use-cross != 'use-cross' &&
-        (matrix.job.target == 'x86_64-unknown-linux-gnu' || matrix.job.target == 'aarch64-unknown-linux-gnu')
+      if: env.PGO == '1'
       shell: bash
       run: |
         ## The release artifact must be the PGO build: if RUSTFLAGS did not
diff --git a/util/build-pgo.sh b/util/build-pgo.sh
index b7a6292180d..c174a4ee928 100755
--- a/util/build-pgo.sh
+++ b/util/build-pgo.sh
@@ -65,15 +65,17 @@ echo "llvm-profdata: ${LLVM_PROFDATA}"
 cargo_build() {
     # $1: target dir, $2: extra rustflags
     local feature_args=()
-    [ -n "$FEATURES" ] && feature_args=(--features="$FEATURES")
+    if [ -n "$FEATURES" ]; then feature_args=(--features="$FEATURES"); fi
     (
         cd "$REPO_ROOT"
         export CARGO_TARGET_DIR="$1"
         export CARGO_INCREMENTAL=0
         export RUSTFLAGS="${RUSTFLAGS:+${RUSTFLAGS} }$2"
-        echo "Running: cargo build --release ${feature_args[*]}"
+        # bash 3.2 (macOS) errors on an empty array expansion under `set -u`,
+        # hence the `[@]+` guard on both expansions below.
+        echo "Running: cargo build --release ${feature_args[@]+${feature_args[*]}}"
         echo "  RUSTFLAGS=${RUSTFLAGS}"
-        cargo build --release "${feature_args[@]}"
+        cargo build --release ${feature_args[@]+"${feature_args[@]}"}
     )
 }
 
@@ -119,7 +121,7 @@ awk 'BEGIN { for (i = 0; i < 2000; i++) printf "user%d:x:%d:%d:User %d:/home/use
 end_step
 
 begin_step "Step 3: training workloads"
-WORK="$(mktemp -d)"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/coreutils-pgo.XXXXXX")"
 trap 'rm -rf "$WORK"' EXIT
 
 # Individual workloads are allowed to fail (a util may be absent from the