diff --git a/gtests/ssl_gtest/tls_subcerts_unittest.cc b/gtests/ssl_gtest/tls_subcerts_unittest.cc
--- a/gtests/ssl_gtest/tls_subcerts_unittest.cc
+++ b/gtests/ssl_gtest/tls_subcerts_unittest.cc
@@ -8,23 +8,32 @@
 
 #include "prtime.h"
 #include "secerr.h"
 #include "ssl.h"
 
 #include "gtest_utils.h"
 #include "tls_agent.h"
 #include "tls_connect.h"
+#define LTO
 
 namespace nss_test {
 
+#ifndef LTO
+// sigh this construction breaks LTO
 const std::string kEcdsaDelegatorId = TlsAgent::kDelegatorEcdsa256;
 const std::string kRsaeDelegatorId = TlsAgent::kDelegatorRsae2048;
 const std::string kPssDelegatorId = TlsAgent::kDelegatorRsaPss2048;
 const std::string kDCId = TlsAgent::kServerEcdsa256;
+#else
+#define kEcdsaDelegatorId TlsAgent::kDelegatorEcdsa256
+#define kRsaeDelegatorId TlsAgent::kDelegatorRsae2048
+#define kPssDelegatorId TlsAgent::kDelegatorRsaPss2048
+#define kDCId  TlsAgent::kServerEcdsa256
+#endif
 const SSLSignatureScheme kDCScheme = ssl_sig_ecdsa_secp256r1_sha256;
 const PRUint32 kDCValidFor = 60 * 60 * 24 * 7 /* 1 week (seconds) */;
 
 static void CheckPreliminaryPeerDelegCred(
     const std::shared_ptr<TlsAgent>& client, bool expected,
     PRUint32 key_bits = 0, SSLSignatureScheme sig_scheme = ssl_sig_none) {
   EXPECT_NE(0U, (client->pre_info().valuesSet & ssl_preinfo_peer_auth));
   EXPECT_EQ(expected, client->pre_info().peerDelegCred);