diff --git a/src/objective-c/GRPCClient/private/GRPCSecureChannel.h b/src/objective-c/GRPCClient/private/GRPCSecureChannel.h
index 8b259c8dadaf3a5d0bfaf1bf736a6515d15ff14e..ca8780ee8bea1354fc96f6a8b4027a7dbce4cd09 100644
--- a/src/objective-c/GRPCClient/private/GRPCSecureChannel.h
+++ b/src/objective-c/GRPCClient/private/GRPCSecureChannel.h
@@ -31,13 +31,16 @@
  *
  */
 
-#import <grpc/grpc_security.h>
+struct grpc_credentials;
+struct grpc_channel_args;
 
 #import "GRPCChannel.h"
 
 @interface GRPCSecureChannel : GRPCChannel
 - (instancetype)initWithHost:(NSString *)host;
 
+// Only in tests shouldn't pathToCertificates or hostNameOverride be nil. Passing nil for
+// pathToCertificates results in using the default root certificates distributed with the library.
 - (instancetype)initWithHost:(NSString *)host
           pathToCertificates:(NSString *)path
             hostNameOverride:(NSString *)hostNameOverride;
diff --git a/src/objective-c/GRPCClient/private/GRPCSecureChannel.m b/src/objective-c/GRPCClient/private/GRPCSecureChannel.m
index eb3cfc40eb0e818128ac436ec3f40bf6b666f0b9..92421df9c54e2facc6272a4cd0b92c86c0305167 100644
--- a/src/objective-c/GRPCClient/private/GRPCSecureChannel.m
+++ b/src/objective-c/GRPCClient/private/GRPCSecureChannel.m
@@ -33,6 +33,8 @@
 
 #import "GRPCSecureChannel.h"
 
+#import <grpc/grpc_security.h>
+
 static grpc_credentials *CertificatesAtPath(NSString *path) {
   NSData *certsData = [NSData dataWithContentsOfFile:path];
   NSCAssert(certsData.length, @"No data read from %@", path);