diff --git a/src/media/media_options.gni b/src/media/media_options.gni
index fd3fe3a5..2141c793 100644
--- a/src/media/media_options.gni
+++ b/src/media/media_options.gni
@@ -230,8 +230,8 @@ declare_args() {
   alternate_cdm_storage_id_key = ""
 }
 
-# assert(!enable_cdm_host_verification || is_mac || is_win,
-#       "CDM host verification is only supported on Mac and Windows.")
+assert(!enable_cdm_host_verification || is_mac || target_os == "win",
+       "CDM host verification is only supported on Mac and Windows.")
 
 # Default |mojo_media_services| and |mojo_media_host| on various platforms. See
 # comments below for valid values. Can be overridden by gn build arguments from
diff --git a/src/third_party/widevine/cdm/widevine.gni b/src/third_party/widevine/cdm/widevine.gni
index 5f5d7ec6..2bf91cb0 100644
--- a/src/third_party/widevine/cdm/widevine.gni
+++ b/src/third_party/widevine/cdm/widevine.gni
@@ -63,7 +63,7 @@ declare_args() {
 declare_args() {
   # Enable Widevine CDM host verification, which will sign additional binaries
   # with Widevine certs and copy signature files as needed.
-  enable_widevine_cdm_host_verification = false
+  enable_widevine_cdm_host_verification = enable_library_widevine_cdm && enable_cdm_host_verification
 
   # If set, and Widevine CDM host verification signing failed due to no signing
   # cert, the failure will be ignored. Otherwise the build process will fail.