diff --git a/.cirrus.yml b/.cirrus.yml
index 55c992e3d7..7e4eb2a898 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -18,6 +18,7 @@ spicy_ssl_config: &SPICY_SSL_CONFIG --build-type=release --disable-broker-tests
 asan_sanitizer_config: &ASAN_SANITIZER_CONFIG --build-type=debug --disable-broker-tests --sanitizers=address --enable-fuzzers --enable-coverage --ccache --enable-werror
 ubsan_sanitizer_config: &UBSAN_SANITIZER_CONFIG --build-type=debug --disable-broker-tests --sanitizers=undefined --enable-fuzzers --ccache --enable-werror
 tsan_sanitizer_config: &TSAN_SANITIZER_CONFIG --build-type=debug --disable-broker-tests --sanitizers=thread --enable-fuzzers --ccache --enable-werror
+macos_config: &MACOS_CONFIG --build-type=release --disable-broker-tests --prefix=$CIRRUS_WORKING_DIR/install --ccache --enable-werror --with-krb5=/opt/homebrew/opt/krb5
 
 resources_template: &RESOURCES_TEMPLATE
   cpu: *CPUS
@@ -33,6 +34,7 @@ macos_environment: &MACOS_ENVIRONMENT
     ZEEK_CI_BTEST_JOBS: 12
     # No permission to write to default location of /zeek
     CIRRUS_WORKING_DIR: /tmp/zeek
+    ZEEK_CI_CONFIGURE_FLAGS: *MACOS_CONFIG
 
 freebsd_resources_template: &FREEBSD_RESOURCES_TEMPLATE
   cpu: 8
diff --git a/CHANGES b/CHANGES
index 19e3ef2e76..4d5f42ebb1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+8.0.0-dev.94 | 2025-05-13 10:03:46 -0700
+
+  * Allow macOS to search for libkrb5, but disallow system version of library (Tim Wojtulewicz, Corelight)
+
 8.0.0-dev.92 | 2025-05-13 18:26:22 +0200
 
   * btest/cluster/websocket: Update tests for new event signature (Arne Welzel, Corelight)
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 3e5274b6e9..231db26c61 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1087,13 +1087,11 @@ if (LIBMMDB_FOUND)
 endif ()
 
 set(USE_KRB5 false)
-if (NOT ${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
-    find_package(LibKrb5)
-    if (LIBKRB5_FOUND)
-        set(USE_KRB5 true)
-        include_directories(BEFORE ${LibKrb5_INCLUDE_DIR})
-        list(APPEND OPTLIBS ${LibKrb5_LIBRARY})
-    endif ()
+find_package(LibKrb5)
+if (LIBKRB5_FOUND)
+    set(USE_KRB5 true)
+    include_directories(BEFORE ${LibKrb5_INCLUDE_DIR})
+    list(APPEND OPTLIBS ${LibKrb5_LIBRARY})
 endif ()
 
 set(HAVE_PERFTOOLS false)
diff --git a/NEWS b/NEWS
index da616f6329..0260ddbe59 100644
--- a/NEWS
+++ b/NEWS
@@ -38,6 +38,10 @@ Changed Functionality
   published vectors with holes. A reporter error is produced at runtime when
   serialization of vectors with holes is attempted.
 
+- Using libkrb5 for Kerberos support is now allowed on macOS. Due to very old age and
+  brokenness, the system version of the library is unsupported and will fail to
+  configure. Use the version from Homebrew or another newer installation.
+
 Removed Functionality
 ---------------------
 
diff --git a/VERSION b/VERSION
index 755695e221..d09a908dcc 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-8.0.0-dev.92
+8.0.0-dev.94
diff --git a/ci/macos/prepare.sh b/ci/macos/prepare.sh
index 4494fdbc9a..06696959d1 100755
--- a/ci/macos/prepare.sh
+++ b/ci/macos/prepare.sh
@@ -7,7 +7,7 @@ set -x
 
 brew update
 brew upgrade cmake
-brew install cppzmq openssl@3 python@3 swig bison flex ccache libmaxminddb dnsmasq
+brew install cppzmq openssl@3 python@3 swig bison flex ccache libmaxminddb dnsmasq krb5
 
 which python3
 python3 --version
diff --git a/cmake b/cmake
index fd0696f907..c63efd65e8 160000
--- a/cmake
+++ b/cmake
@@ -1 +1 @@
-Subproject commit fd0696f9077933660f7da5f81978e86b3e967647
+Subproject commit c63efd65e874d689bb28aab390456b2d96941e15