diff --git a/.github/go_ios_cpu_features.patch b/.github/go_ios_cpu_features.patch
new file mode 100644
index 00000000..704d2d76
--- /dev/null
+++ b/.github/go_ios_cpu_features.patch
@@ -0,0 +1,28 @@
+--- a/src/internal/cpu/cpu_arm64_ios.go
++++ b/src/internal/cpu/cpu_arm64_ios.go
+@@ -0,0 +1,14 @@
++// Copyright 2020 The Go Authors. All rights reserved.
++// Use of this source code is governed by a BSD-style
++// license that can be found in the LICENSE file.
++
++//go:build arm64 && ios
++
++package cpu
++
++func osInit() {
++	ARM64.HasAES = true
++	ARM64.HasPMULL = true
++	ARM64.HasSHA1 = true
++	ARM64.HasSHA2 = true
++}
+--- a/src/internal/cpu/cpu_arm64_other.go
++++ b/src/internal/cpu/cpu_arm64_other.go
+@@ -2,7 +2,7 @@
+ // Use of this source code is governed by a BSD-style
+ // license that can be found in the LICENSE file.
+ 
+-//go:build arm64 && !linux && !freebsd && !android && (!darwin || ios) && !openbsd
++//go:build arm64 && !linux && !freebsd && !android && !darwin && !openbsd
+ 
+ package cpu
+ 
diff --git a/.github/patch_go_for_ios.sh b/.github/patch_go_for_ios.sh
new file mode 100755
index 00000000..6105dd50
--- /dev/null
+++ b/.github/patch_go_for_ios.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Go's internal/cpu never detects ARM64 features on GOOS=ios, so crypto/aes,
+# AES-GCM and crypto/sha256 use their generic implementations on iOS and tvOS.
+# See https://github.com/SagerNet/sing-box/issues/4486
+#
+# Only the ARMv8.0 cryptographic extensions are asserted; ARMv8.1 atomics and
+# SHA-512 are absent on the A8/A9 devices still supported by the deployment targets.
+#
+# Remove once the Go release used by the Apple library build includes the fix.
+
+export GOTOOLCHAIN=local
+
+GOROOT="$(go env GOROOT)"
+PATCH_FILE="$(cd "$(dirname "$0")" && pwd)/go_ios_cpu_features.patch"
+
+cd "$GOROOT"
+if [[ -f src/internal/cpu/cpu_arm64_ios.go ]]; then
+  echo "already patched"
+else
+  patch --verbose -p1 < "$PATCH_FILE"
+fi
+
+CPU_FILES="$(GOOS=ios GOARCH=arm64 CGO_ENABLED=0 go list -f '{{.GoFiles}}' internal/cpu)"
+echo "internal/cpu files for ios/arm64: $CPU_FILES"
+case "$CPU_FILES" in
+*cpu_arm64_ios.go*) ;;
+*)
+  echo "patch is not effective" >&2
+  exit 1
+  ;;
+esac
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b30ac60d..fe7c43a7 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1246,6 +1246,9 @@ jobs:
         with:
           go-version: 1.26.7
           cache: false
+      - name: Patch Go for iOS
+        if: matrix.build && (matrix.platform == 'ios/arm64' || matrix.platform == 'tvos/arm64')
+        run: .github/patch_go_for_ios.sh
       - name: Cache Go modules
         if: matrix.build
         uses: actions/cache@v4
@@ -1265,6 +1268,8 @@ jobs:
         run: git tag v${{ needs.calculate_version.outputs.version }} -f
       - name: Build library
         if: matrix.build
+        env:
+          GOTOOLCHAIN: local
         run: |-
           make lib_install
           export PATH="$PATH:$(go env GOPATH)/bin"