diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
index dedb1ae26ad0dd..5c2accfcdc078e 100644
--- a/build/config/compiler/BUILD.gn
+++ b/build/config/compiler/BUILD.gn
@@ -249,6 +249,10 @@ config("strict_warnings") {
     ]
   }
 
+  if (current_os == "mac" || current_os == "ios") {
+    cflags += [ "-Wconversion" ]
+  }
+
   if (build_java_matter_controller) {
     cflags -= [ "-Wshadow" ]
   }
diff --git a/src/crypto/CHIPCryptoPALmbedTLS.cpp b/src/crypto/CHIPCryptoPALmbedTLS.cpp
index 00b63db9b45c44..ae887e755c2330 100644
--- a/src/crypto/CHIPCryptoPALmbedTLS.cpp
+++ b/src/crypto/CHIPCryptoPALmbedTLS.cpp
@@ -1445,8 +1445,9 @@ CHIP_ERROR VerifyAttestationCertificateFormat(const ByteSpan & cert, Attestation
             {
                 bool keyCertSignFlag = keyUsage & MBEDTLS_X509_KU_KEY_CERT_SIGN;
                 bool crlSignFlag     = keyUsage & MBEDTLS_X509_KU_CRL_SIGN;
-                bool otherFlags =
-                    keyUsage & ~(MBEDTLS_X509_KU_CRL_SIGN | MBEDTLS_X509_KU_KEY_CERT_SIGN | MBEDTLS_X509_KU_DIGITAL_SIGNATURE);
+                bool otherFlags      = keyUsage &
+                    ~static_cast<unsigned int>(MBEDTLS_X509_KU_CRL_SIGN | MBEDTLS_X509_KU_KEY_CERT_SIGN |
+                                               MBEDTLS_X509_KU_DIGITAL_SIGNATURE);
                 VerifyOrExit(keyCertSignFlag && crlSignFlag && !otherFlags, error = CHIP_ERROR_INTERNAL);
             }
         }
diff --git a/third_party/boringssl/repo/BUILD.gn b/third_party/boringssl/repo/BUILD.gn
index cb613d28454edd..634be1687232a8 100644
--- a/third_party/boringssl/repo/BUILD.gn
+++ b/third_party/boringssl/repo/BUILD.gn
@@ -20,7 +20,10 @@ import("BUILD.generated.gni")
 config("boringssl_config") {
   include_dirs = [ "src/include" ]
 
-  cflags = [ "-Wno-unused-variable" ]
+  cflags = [
+    "-Wno-unused-variable",
+    "-Wno-conversion",
+  ]
 
   if (is_clang) {
     cflags += [ "-Wno-shorten-64-to-32" ]
diff --git a/third_party/editline/BUILD.gn b/third_party/editline/BUILD.gn
index 900333b14d510e..ec2cdd4a2e3bb2 100644
--- a/third_party/editline/BUILD.gn
+++ b/third_party/editline/BUILD.gn
@@ -18,8 +18,10 @@ import("${build_root}/config/compiler/compiler.gni")
 config("editline_config") {
   include_dirs = [ "repo/include" ]
 
+  cflags = [ "-Wno-conversion" ]
+
   if (is_clang) {
-    cflags = [ "-Wno-shorten-64-to-32" ]
+    cflags += [ "-Wno-shorten-64-to-32" ]
   }
 }
 
diff --git a/third_party/mbedtls/mbedtls.gni b/third_party/mbedtls/mbedtls.gni
index 2c65b2491ecdc2..e865e9c6584ce9 100644
--- a/third_party/mbedtls/mbedtls.gni
+++ b/third_party/mbedtls/mbedtls.gni
@@ -28,6 +28,7 @@ template("mbedtls_target") {
       "-Wno-string-concatenation",
       "-Wno-unused-but-set-parameter",
       "-Wno-format-nonliteral",  # Because of mbedtls_debug_print_msg
+      "-Wno-conversion",  # Lots of -Wconversion warnings, sadly.
     ]
 
     if (is_clang) {
diff --git a/third_party/nlunit-test/BUILD.gn b/third_party/nlunit-test/BUILD.gn
index 48f81f0a395301..d6907714acd446 100644
--- a/third_party/nlunit-test/BUILD.gn
+++ b/third_party/nlunit-test/BUILD.gn
@@ -18,8 +18,10 @@ import("${build_root}/config/compiler/compiler.gni")
 config("nlunit-test_config") {
   include_dirs = [ "repo/src" ]
 
+  cflags = [ "-Wno-conversion" ]
+
   if (is_clang) {
-    cflags = [ "-Wno-shorten-64-to-32" ]
+    cflags += [ "-Wno-shorten-64-to-32" ]
   }
 }