diff --git a/changes/bug20865 b/changes/bug20865
new file mode 100644
index 000000000..575d886a3
--- /dev/null
+++ b/changes/bug20865
@@ -0,0 +1,7 @@
+  o Minor bugfixes (portability):
+    - Avoid compilation errors when building on OSX Sierra. Sierra began
+      to support the getentropy() API, but created a few problems in
+      doing so. Tor 0.2.9 has a more thorough set of workarounds; in
+      0.2.8, we are just using the /dev/urandom interface. Fixes
+      bug 20865. Bugfix on 0.2.8.1-alpha.
+
diff --git a/src/common/crypto.c b/src/common/crypto.c
index c5d07dfb6..f7bb8ff1f 100644
--- a/src/common/crypto.c
+++ b/src/common/crypto.c
@@ -88,6 +88,15 @@
 
 #include "keccak-tiny/keccak-tiny.h"
 
+#ifdef __APPLE__
+/* Apple messed up their getentropy definitions in Sierra.  It's not insecure
+ * or anything (as far as I know) but it makes compatible builds hard.  0.2.9
+ * contains the necessary tricks to do it right: in 0.2.8, we're just using
+ * this blunt instrument.
+ */
+#undef HAVE_GETENTROPY
+#endif
+
 #ifdef ANDROID
 /* Android's OpenSSL seems to have removed all of its Engine support. */
 #define DISABLE_ENGINES