diff --git a/Cargo.toml b/Cargo.toml
index 908badb65..1b8d3d5da 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -60,8 +60,10 @@ large_enum_variant = "allow"
 # wgpu-hal 30.0.1 with gfx-rs/wgpu#10124: wgpu 30 creates a Vulkan descriptor
 # pool with no pool sizes while it creates the device, which Vulkan allows only
 # since 1.3.215, and Intel's Windows driver for 6th-10th gen iGPUs (HD 520/530,
-# UHD 620/630) crashes on it with an access violation (#746). Drop this and the
-# folder once a wgpu release has the fix.
+# UHD 620/630) crashes on it with an access violation (#746). It also fixes the
+# Metal backend's lookup of the CoreGraphics HDR colour space names, which handed
+# CoreGraphics a symbol's address as the string and crashed HDR output on macOS.
+# Drop this and the folder once a wgpu release has both fixes.
 [patch.crates-io]
 wgpu-hal = { path = "third_party/wgpu-hal" }
 
diff --git a/third_party/wgpu-hal/src/metal/surface.rs b/third_party/wgpu-hal/src/metal/surface.rs
index f8028a4f3..5dc81e1c5 100644
--- a/third_party/wgpu-hal/src/metal/surface.rs
+++ b/third_party/wgpu-hal/src/metal/surface.rs
@@ -228,9 +228,12 @@ static COLOR_SPACES: LazyLock<Result<ColorSpaces, crate::SurfaceError>> = LazyLo
         lib: &libloading::Library,
         name: &[u8],
     ) -> Result<&'static CFString, crate::SurfaceError> {
-        let sym = unsafe { lib.get(name) }
+        // The symbols are `CFStringRef` globals, so `dlsym` returns the address of the
+        // global and the symbol's type is a pointer to the reference. Typing it as
+        // the reference itself would hand CoreGraphics that address as the string.
+        let sym = unsafe { lib.get::<*const &'static CFString>(name) }
             .map_err(|_| crate::SurfaceError::Other("error resolving symbol in CoreGraphics"))?;
-        Ok(*sym)
+        Ok(unsafe { **sym })
     }
     let extended_display_p3 = lookup(&lib, b"kCGColorSpaceExtendedDisplayP3\0")?;
     let itur_bt2100_pq = lookup(&lib, b"kCGColorSpaceITUR_2100_PQ\0")?;