diff --git a/experimental/libbox/native_shell_session.go b/experimental/libbox/native_shell_session.go
index f470e42c4..82fec5f3a 100644
--- a/experimental/libbox/native_shell_session.go
+++ b/experimental/libbox/native_shell_session.go
@@ -1,4 +1,4 @@
-//go:build linux || android || (darwin && !ios)
+//go:build linux || android || darwin || ios
 
 package libbox
 
diff --git a/experimental/libbox/native_shell_session_stub.go b/experimental/libbox/native_shell_session_stub.go
index 647a27acd..8544efabb 100644
--- a/experimental/libbox/native_shell_session_stub.go
+++ b/experimental/libbox/native_shell_session_stub.go
@@ -1,4 +1,4 @@
-//go:build !linux && !android && (!darwin || ios)
+//go:build !linux && !android && !darwin && !ios
 
 package libbox
 
diff --git a/protocol/tailscale/tailssh/session_ios.go b/protocol/tailscale/tailssh/session_ios.go
index 837eea378..522ad2bb1 100644
--- a/protocol/tailscale/tailssh/session_ios.go
+++ b/protocol/tailscale/tailssh/session_ios.go
@@ -31,6 +31,9 @@ func (iosShellBackend) Close() error {
 	return nil
 }
 
-func lookupSFTPServer(_ adapter.PlatformInterface) (string, error) {
-	return "", E.New("sftp is not supported on iOS and tvOS")
+func lookupSFTPServer(platformInterface adapter.PlatformInterface) (string, error) {
+	if platformInterface == nil {
+		return "", E.New("sftp is not supported on iOS and tvOS")
+	}
+	return platformInterface.LookupSFTPServer()
 }
diff --git a/protocol/tailscale/tailssh/shell_unix.go b/protocol/tailscale/tailssh/shell_unix.go
index 5591e352c..254786f9f 100644
--- a/protocol/tailscale/tailssh/shell_unix.go
+++ b/protocol/tailscale/tailssh/shell_unix.go
@@ -1,4 +1,4 @@
-//go:build unix && !ios
+//go:build unix
 
 package tailssh
 
diff --git a/protocol/tailscale/tailssh/subprocess_unix.go b/protocol/tailscale/tailssh/subprocess_unix.go
index f40c57c1d..09e6b6bd8 100644
--- a/protocol/tailscale/tailssh/subprocess_unix.go
+++ b/protocol/tailscale/tailssh/subprocess_unix.go
@@ -1,13 +1,13 @@
-//go:build unix && !ios
+//go:build unix
 
 package tailssh
 
 import (
 	"os"
 	"os/exec"
-	"runtime"
 	"syscall"
 
+	C "github.com/sagernet/sing-box/constant"
 	E "github.com/sagernet/sing/common/exceptions"
 
 	"github.com/creack/pty"
@@ -75,9 +75,9 @@ func setCredential(attr *syscall.SysProcAttr, uid, gid int, groups []int) {
 	if uid == os.Getuid() && gid == os.Getgid() {
 		return
 	}
-	// macOS rejects setgroups with more than 16 groups (EINVAL), which fails the
-	// exec; cap to the first 16.
-	if runtime.GOOS == "darwin" && len(groups) > 16 {
+	// macOS and iOS reject setgroups with more than 16 groups (EINVAL), which
+	// fails the exec; cap to the first 16.
+	if C.IsDarwin && len(groups) > 16 {
 		groups = groups[:16]
 	}
 	cred := &syscall.Credential{