         var trustedAppSelf: SecTrustedApplication?
         var trustedAppSystemUIServer: SecTrustedApplication?
 
+        let kSecReturnWorkingReference: CFString
+        let kSecValueWorkingReference: CFString
+        if #available(macOS 10.15, *) {
+            // macOS Catalina requires a persistent ref to pass this test.
+            kSecReturnWorkingReference = kSecReturnPersistentRef
+            kSecValueWorkingReference = kSecValuePersistentRef
+        } else {
+            kSecReturnWorkingReference = kSecReturnRef
+            kSecValueWorkingReference = kSecValueRef
+        }
+
         XCTAssertEqual(SecTrustedApplicationCreateFromPath(nil, &trustedAppSelf), errSecSuccess)
         XCTAssertEqual(SecTrustedApplicationCreateFromPath("/System/Library/CoreServices/SystemUIServer.app", &trustedAppSystemUIServer), errSecSuccess);
         let trustedList = [trustedAppSelf!, trustedAppSystemUIServer!] as NSArray?

            XCTFail()
            return
        }
        guard let vulnerableValueRef = vulnerableKeychainEntry[kSecValuePersistentRef as String] else {
            XCTFail()
            return
        }

        let queryWithVulnerableReference = [
            kSecValuePersistentRef as String: vulnerableValueRef
            ] as CFDictionary
        // Demonstrate that the item is accessible with the reference.
        XCTAssertEqual(SecItemCopyMatching(queryWithVulnerableReference, nil), errSecSuccess)


        // We should no longer be able to access the keychain item via the ref.
        let queryWithVulnerableReferenceAndAttributes = [
            kSecValueWorkingReference as String: vulnerableValueRef,
            kSecReturnAttributes as String: true
            ] as CFDictionary
        XCTAssertEqual(SecItemCopyMatching(queryWithVulnerableReferenceAndAttributes, nil), errSecItemNotFound)
