diff --git a/.bazelrc b/.bazelrc
index 549cecdd316..c82b228c649 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -14,7 +14,7 @@ build:remote --remote_timeout=7200
 # ========================================
 
 # Enable libc++ and C++20 by default.
-build --config=libc++20
+build:linux --config=libc++20
 
 # Need for CI image to pickup docker-credential-gcloud, PATH is fixed in rbe-toolchain-* configs.
 build:remote-ci --action_env=PATH=/usr/local/google-cloud-sdk/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/llvm/bin
@@ -25,7 +25,8 @@ build --define path_normalization_by_default=true
 
 # Heap profiler is supported only with gperf tcmalloc, not google tcmalloc.
 # See: https://github.com/istio/istio/issues/28233
-build --define tcmalloc=gperftools
+build:linux --define tcmalloc=gperftools
+build:macos --define tcmalloc=disabled
 
 # Build with embedded V8-based WebAssembly runtime.
 build --define wasm=v8
@@ -67,3 +68,9 @@ build:clang-asan-ci --linkopt=-l:libclang_rt.ubsan_standalone_cxx.a
 build:clang-tsan-ci --config=clang-tsan
 build:clang-tsan-ci --linkopt=-L/opt/libcxx_tsan/lib
 build:clang-tsan-ci --linkopt=-Wl,-rpath,/opt/libcxx_tsan/lib
+
+# get from https://github.com/Homebrew/homebrew-core/blob/master/Formula/e/envoy.rb
+build:macos --cxxopt=-Wno-range-loop-analysis
+build:macos --host_cxxopt=-Wno-range-loop-analysis
+build:macos --cxxopt=-Wno-deprecated-declarations
+build:macos --host_cxxopt=-Wno-deprecated-declarations