diff --git a/config/hafnium-base.yaml b/config/hafnium-base.yaml
index 0c750fa4893069e7619ff667c4f476bb45f7f89a..3b22edac5531107901227923ba8cf31878cd5bd1 100644
--- a/config/hafnium-base.yaml
+++ b/config/hafnium-base.yaml
@@ -12,8 +12,6 @@ build:
       remote: https://git.trustedfirmware.org/hafnium/hafnium.git
       revision: v2.8
 
-    toolchain: aarch64-none-elf-
-
     params:
       PROJECT: reference
 
@@ -21,8 +19,7 @@ build:
       # Hafnium doesn't provide a mechanism to forward number of jobs to ninja,
       # so it will always parallelize across all cpus. Ideally we would specify
       # max jobs with ${param:jobs}.
-      - PATH=${param:sourcedir}/prebuilts/linux-x64/clang/bin:${param:sourcedir}/prebuilts/linux-x64/dtc:$$PATH
-        make OUT_DIR=${param:builddir} ${param:join_equal}
+      - make OUT_DIR=${param:builddir} ${param:join_equal}
 
     artifacts:
       HAFNIUM: ${param:builddir}/secure_aem_v8a_fvp_clang/hafnium.bin
diff --git a/docker/Dockerfile.full b/docker/Dockerfile.full
index 1a220ea815b647021122ead6e524d41ac3a92c57..8b45c1e81a429795b731554d6a75f1ce86003558 100644
--- a/docker/Dockerfile.full
+++ b/docker/Dockerfile.full
@@ -30,6 +30,22 @@ RUN cd /tools \
 ENV TCH_PATH_AARCH32="/tools/${TCH_PATH_AARCH32}"
 ENV PATH="${TCH_PATH_AARCH32}:${PATH}"
 
+# Install aarch64 llvm toolchain and dependencies.
+RUN apt-get install --assume-yes --no-install-recommends --option=debug::pkgProblemResolver=yes \
+		libncurses5
+
+ARG TCH_LLVM_PKG_NAME
+ARG TCH_LLVM_PATH
+COPY ${TCH_LLVM_PKG_NAME} /tools/.
+RUN cd /tools \
+       && if [ "${TCH_LLVM_PKG_NAME}" != "none" ]; then \
+           tar xf ${TCH_LLVM_PKG_NAME}; \
+       fi \
+       && rm ${TCH_LLVM_PKG_NAME} \
+       && cd -
+ENV TCH_LLVM_PATH="/tools/${TCH_LLVM_PATH}"
+ENV PATH="${TCH_LLVM_PATH}:${PATH}"
+
 # Install packages required to compile Linux kselftests. We install the target
 # versions for cross-compiling, and the native versions for good measure.
 RUN dpkg --add-architecture arm64 \
diff --git a/docker/build.sh b/docker/build.sh
index 5148cee2658292e6d3096a355c5613609a0b0007..72c89cfc84fbe147d36b20a160a25b18f240dacf 100755
--- a/docker/build.sh
+++ b/docker/build.sh
@@ -34,6 +34,9 @@ if [ "${ARCH}" == "x86_64" ]; then
 	TCH_PKG_URL_AARCH64=https://developer.arm.com/-/media/Files/downloads/gnu/11.3.rel1/binrel
 	TCH_PKG_NAME_AARCH64=arm-gnu-toolchain-11.3.rel1-x86_64-aarch64-none-elf.tar.xz
 	TCH_PATH_AARCH64=arm-gnu-toolchain-11.3.rel1-x86_64-aarch64-none-elf/bin
+	TCH_LLVM_PKG_URL=https://github.com/llvm/llvm-project/releases/download/llvmorg-12.0.0
+	TCH_LLVM_PKG_NAME=clang+llvm-12.0.0-x86_64-linux-gnu-ubuntu-20.04.tar.xz
+	TCH_LLVM_PATH=clang+llvm-12.0.0-x86_64-linux-gnu-ubuntu-20.04/bin
 	TCH_PKG_URL_AARCH32=https://developer.arm.com/-/media/Files/downloads/gnu/11.3.rel1/binrel
 	TCH_PKG_NAME_AARCH32=arm-gnu-toolchain-11.3.rel1-x86_64-arm-none-eabi.tar.xz
 	TCH_PATH_AARCH32=arm-gnu-toolchain-11.3.rel1-x86_64-arm-none-eabi/bin
@@ -41,10 +44,14 @@ if [ "${ARCH}" == "x86_64" ]; then
 	FVP_PKG_NAME=FVP_Base_RevC-2xAEMvA_11.20_15_Linux64.tgz
 	FVP_MODEL_DIR=Base_RevC_AEMvA_pkg/models/Linux64_GCC-9.3
 	FVP_PLUGIN_DIR=Base_RevC_AEMvA_pkg/plugins/Linux64_GCC-9.3
-elif [ "${ARCH}" == "aarch64" ]; then
+# ARCH is "aarch64" on Ubuntu, or "arm" on Mac OS
+elif [ "${ARCH}" == "aarch64" ] || [ "${ARCH}" == "arm" ]; then
 	TCH_PKG_URL_AARCH64=https://developer.arm.com/-/media/Files/downloads/gnu/11.3.rel1/binrel
 	TCH_PKG_NAME_AARCH64=arm-gnu-toolchain-11.3.rel1-aarch64-aarch64-none-elf.tar.xz
 	TCH_PATH_AARCH64=arm-gnu-toolchain-11.3.rel1-aarch64-aarch64-none-elf/bin
+	TCH_LLVM_PKG_URL=https://github.com/llvm/llvm-project/releases/download/llvmorg-12.0.0
+	TCH_LLVM_PKG_NAME=clang+llvm-12.0.0-aarch64-linux-gnu.tar.xz
+	TCH_LLVM_PATH=clang+llvm-12.0.0-aarch64-linux-gnu/bin
 	TCH_PKG_URL_AARCH32=https://developer.arm.com/-/media/Files/downloads/gnu/11.3.rel1/binrel
 	TCH_PKG_NAME_AARCH32=arm-gnu-toolchain-11.3.rel1-aarch64-arm-none-eabi.tar.xz
 	TCH_PATH_AARCH32=arm-gnu-toolchain-11.3.rel1-aarch64-arm-none-eabi/bin
@@ -61,6 +68,7 @@ echo "Building for version ${VERSION} for ${ARCH}..."
 
 # Build the image.
 wget -q -O ${TCH_PKG_NAME_AARCH64} ${TCH_PKG_URL_AARCH64}/${TCH_PKG_NAME_AARCH64}
+wget -q -O ${TCH_LLVM_PKG_NAME} ${TCH_LLVM_PKG_URL}/${TCH_LLVM_PKG_NAME}
 wget -q -O ${TCH_PKG_NAME_AARCH32} ${TCH_PKG_URL_AARCH32}/${TCH_PKG_NAME_AARCH32}
 wget -q -O ${FVP_PKG_NAME} ${FVP_PKG_URL}/${FVP_PKG_NAME}
 docker build \
@@ -82,6 +90,8 @@ docker build \
 	--build-arg=BASE=${REGISTRY}/base-slim-nofvp:${VERSION}-${ARCH} \
 	--build-arg=TCH_PKG_NAME_AARCH32=${TCH_PKG_NAME_AARCH32} \
 	--build-arg=TCH_PATH_AARCH32=${TCH_PATH_AARCH32} \
+	--build-arg=TCH_LLVM_PKG_NAME=${TCH_LLVM_PKG_NAME} \
+	--build-arg=TCH_LLVM_PATH=${TCH_LLVM_PATH} \
 	--file=Dockerfile.full \
 	--tag=${REGISTRY}/base-full-nofvp:${VERSION}-${ARCH} \
 	.
@@ -94,6 +104,7 @@ docker build \
 	--tag=${REGISTRY}/base-full:${VERSION}-${ARCH} \
 	.
 rm -rf ${TCH_PKG_NAME_AARCH64} > /dev/null 2>&1 || true
+rm -rf ${TCH_LLVM_PKG_NAME} > /dev/null 2>&1 || true
 rm -rf ${TCH_PKG_NAME_AARCH32} > /dev/null 2>&1 || true
 rm -rf ${FVP_PKG_NAME} > /dev/null 2>&1 || true