diff --git a/src/objective-c/GRPCClient/private/GRPCSecureChannel.h b/src/objective-c/GRPCClient/private/GRPCSecureChannel.h
index 8b259c8dada..ca8780ee8be 100644
--- a/src/objective-c/GRPCClient/private/GRPCSecureChannel.h
+++ b/src/objective-c/GRPCClient/private/GRPCSecureChannel.h
@@ -31,13 +31,16 @@
  *
  */
 
-#import <grpc/grpc_security.h>
+struct grpc_credentials;
+struct grpc_channel_args;
 
 #import "GRPCChannel.h"
 
 @interface GRPCSecureChannel : GRPCChannel
 - (instancetype)initWithHost:(NSString *)host;
 
+// Only in tests shouldn't pathToCertificates or hostNameOverride be nil. Passing nil for
+// pathToCertificates results in using the default root certificates distributed with the library.
 - (instancetype)initWithHost:(NSString *)host
           pathToCertificates:(NSString *)path
             hostNameOverride:(NSString *)hostNameOverride;
diff --git a/src/objective-c/GRPCClient/private/GRPCSecureChannel.m b/src/objective-c/GRPCClient/private/GRPCSecureChannel.m
index eb3cfc40eb0..92421df9c54 100644
--- a/src/objective-c/GRPCClient/private/GRPCSecureChannel.m
+++ b/src/objective-c/GRPCClient/private/GRPCSecureChannel.m
@@ -33,6 +33,8 @@
 
 #import "GRPCSecureChannel.h"
 
+#import <grpc/grpc_security.h>
+
 static grpc_credentials *CertificatesAtPath(NSString *path) {
   NSData *certsData = [NSData dataWithContentsOfFile:path];
   NSCAssert(certsData.length, @"No data read from %@", path);