diff --git a/src/pal/pal_consts.h b/src/pal/pal_consts.h
index 0cb9e81..8497e33 100644
--- a/src/pal/pal_consts.h
+++ b/src/pal/pal_consts.h
@@ -14,8 +14,13 @@ namespace snmalloc
    *  - using_readonly
    *  - not_using
    * model.
+   *
+   * TODO: There is a known bug in CheriBSD that means round-tripping through
+   * PROT_NONE sheds capability load and store permissions (while restoring data
+   * read/write, for added excitement).  For the moment, just force this down on
+   * CHERI.
    */
-#ifdef SNMALLOC_CHECK_CLIENT
+#if defined(SNMALLOC_CHECK_CLIENT) && !defined(__CHERI_PURE_CAPABILITY__)
   static constexpr bool PalEnforceAccess = true;
 #else
   static constexpr bool PalEnforceAccess = false;
diff --git a/src/pal/pal_posix.h b/src/pal/pal_posix.h
index 55d96a5..3f3d163 100644
--- a/src/pal/pal_posix.h
+++ b/src/pal/pal_posix.h
@@ -146,7 +146,10 @@ namespace snmalloc
 
     static void print_stack_trace()
     {
-#ifdef SNMALLOC_BACKTRACE_HEADER
+      // TODO: the backtrace mechanism does not yet work on CHERI, and causes
+      // tests which expect to be able to hook abort() to fail.  Skip it until
+      // https://github.com/CTSRD-CHERI/cheribsd/issues/962 is fixed.
+#if defined(SNMALLOC_BACKTRACE_HEADER) && !defined(__CHERI_PURE_CAPABILITY__)
       constexpr int SIZE = 1024;
       void* buffer[SIZE];
       auto nptrs = backtrace(buffer, SIZE);