diff --git a/masterkey/gcoredump_darwin.go b/masterkey/gcoredump_darwin.go
index 1ad21c2..d426446 100644
--- a/masterkey/gcoredump_darwin.go
+++ b/masterkey/gcoredump_darwin.go
@@ -1,4 +1,4 @@
-//go:build darwin
+//go:build darwin && keychain_gcore
 
 package masterkey
 
diff --git a/masterkey/gcoredump_stub_darwin.go b/masterkey/gcoredump_stub_darwin.go
new file mode 100644
index 0000000..def8d81
--- /dev/null
+++ b/masterkey/gcoredump_stub_darwin.go
@@ -0,0 +1,17 @@
+//go:build darwin && !keychain_gcore
+
+package masterkey
+
+import (
+	"errors"
+
+	"github.com/moond4rk/keychainbreaker"
+)
+
+// DecryptKeychainRecords returns an error in default builds so GcoredumpRetriever
+// falls through silently to the next tier. The CVE-2025-24204 securityd-dump
+// implementation (gcoredump_darwin.go) is only compiled with -tags keychain_gcore,
+// keeping the default `go build` free of the exploit code and its byte signatures.
+func DecryptKeychainRecords() ([]keychainbreaker.GenericPassword, error) {
+	return nil, errors.New("keychain gcore dump not built in (rebuild with -tags keychain_gcore)")
+}