diff --git a/.travis.yml b/.travis.yml
index 6fcf3cb..7e36a41 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -21,6 +21,7 @@ script:
   - ./build.bash
   - ./gocryptfs -speed
   - ./test.bash
+  - ./crossbuild.bash
 
 # fuse on travis
 sudo: required
diff --git a/crossbuild.bash b/crossbuild.bash
new file mode 100755
index 0000000..a33cb05
--- /dev/null
+++ b/crossbuild.bash
@@ -0,0 +1,12 @@
+#!/bin/bash -eux
+
+cd "$(dirname "$0")"
+
+B="go build -tags without_openssl"
+
+GOOS=linux  GOARCH=arm   $B
+GOOS=linux  GOARCH=arm64 $B
+GOOS=darwin GOARCH=amd64 $B
+
+# The cross-built binary is not useful on the compile host.
+rm gocryptfs
diff --git a/internal/syscallcompat/sys_darwin.go b/internal/syscallcompat/sys_darwin.go
index e635034..e77cd98 100644
--- a/internal/syscallcompat/sys_darwin.go
+++ b/internal/syscallcompat/sys_darwin.go
@@ -1,6 +1,7 @@
 package syscallcompat
 
 import (
+	"log"
 	"os"
 	"path/filepath"
 	"sync"
@@ -122,3 +123,11 @@ func dirfdAbs(dirfd int, path string) (string, error) {
 	}
 	return filepath.Join(wd, path), nil
 }
+
+// Dup3 is not available on Darwin, so we use Dup2 instead.
+func Dup3(oldfd int, newfd int, flags int) (err error) {
+	if flags != 0 {
+		log.Panic("darwin does not support dup3 flags")
+	}
+	return syscall.Dup2(oldfd, newfd)
+}
diff --git a/internal/syscallcompat/sys_linux.go b/internal/syscallcompat/sys_linux.go
index 93516f3..441f904 100644
--- a/internal/syscallcompat/sys_linux.go
+++ b/internal/syscallcompat/sys_linux.go
@@ -62,3 +62,9 @@ func Unlinkat(dirfd int, path string) error {
 func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
 	return syscall.Mknodat(dirfd, path, mode, dev)
 }
+
+// Dup3 wraps the Dup3 syscall. We want to use Dup3 rather than Dup2 because Dup2
+// is not implemented on arm64.
+func Dup3(oldfd int, newfd int, flags int) (err error) {
+	return syscall.Dup3(oldfd, newfd, flags)
+}
diff --git a/mount.go b/mount.go
index de87d53..e19f2c8 100644
--- a/mount.go
+++ b/mount.go
@@ -25,6 +25,7 @@ import (
 	"github.com/rfjakob/gocryptfs/internal/fusefrontend"
 	"github.com/rfjakob/gocryptfs/internal/fusefrontend_reverse"
 	"github.com/rfjakob/gocryptfs/internal/readpassword"
+	"github.com/rfjakob/gocryptfs/internal/syscallcompat"
 	"github.com/rfjakob/gocryptfs/internal/tlog"
 )
 
@@ -162,11 +163,11 @@ func redirectStdFds() {
 		tlog.Warn.Printf("redirectStdFds: could not start logger: %v\n", err)
 	}
 	pr.Close()
-	err = syscall.Dup2(int(pw.Fd()), 1)
+	err = syscallcompat.Dup3(int(pw.Fd()), 1, 0)
 	if err != nil {
 		tlog.Warn.Printf("redirectStdFds: stdout dup error: %v\n", err)
 	}
-	syscall.Dup2(int(pw.Fd()), 2)
+	syscallcompat.Dup3(int(pw.Fd()), 2, 0)
 	if err != nil {
 		tlog.Warn.Printf("redirectStdFds: stderr dup error: %v\n", err)
 	}
@@ -178,7 +179,7 @@ func redirectStdFds() {
 		tlog.Warn.Printf("redirectStdFds: could not open /dev/null: %v\n", err)
 		return
 	}
-	err = syscall.Dup2(int(nullFd.Fd()), 0)
+	err = syscallcompat.Dup3(int(nullFd.Fd()), 0, 0)
 	if err != nil {
 		tlog.Warn.Printf("redirectStdFds: stdin dup error: %v\n", err)
 	}