diff --git a/doc/block-reference.md b/doc/block-reference.md
new file mode 100644
index 000000000000..871da1877e2d
--- /dev/null
+++ b/doc/block-reference.md
@@ -0,0 +1,125 @@
+# Witness v2 Taproot with block references
+
+This document specifies the consensus rules for witness version 2 outputs
+with a 32-byte program, as implemented in this prototype. Activation
+parameters are out of scope; on regtest the rules are always active.
+
+## Motivation
+
+A transaction that is valid on both sides of a chain split can be replayed.
+Holders who want to spend on one side only currently need a coin whose
+history already differs between the two chains, such as a coinbase
+descendant. A block reference lets any spender opt in to validity on one
+chain, at the cost of a few witness bytes, with no coordination with anyone
+else.
+
+## Rules
+
+A witness v2 output with a 32-byte program is spent under the
+[BIP341](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki) and
+[BIP342](https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki)
+rules, with one addition.
+
+### Block reference annex
+
+If the spend carries an annex and the first byte after the `0x50` annex
+marker is `0x01`, the annex is a *block reference*:
+
+    0x50 || 0x01 || height (4 bytes, little endian) || further bytes (ignored)
+
+An annex shorter than 6 bytes whose second byte is `0x01` makes the spend
+invalid. Bytes after the height have no consensus meaning, exactly like the
+rest of the annex today. Annexes whose second byte is not `0x01` keep their
+BIP341 treatment: no meaning, always valid.
+
+The type byte `0x01` means "this input references the block at `height`".
+This document attaches two effects to the reference; future rules may attach
+more.
+
+### Maturity and activation
+
+A block containing the transaction at height `H` is invalid unless
+`height + 100 <= H` for every block reference in the transaction. The
+constant is `COINBASE_MATURITY`. As a consequence the referenced block is at
+least 100 deep, and a transaction with a block reference is exactly as safe
+against reorganisation as a spend of a matured coinbase output.
+
+A reference to a block below the activation height of these rules is
+invalid. Before activation, witness v2 spends are anyone-can-spend and an
+annex has no meaning, exactly as for any other undefined witness version;
+neither rule in this document applies to blocks before activation. (The
+mempool applies the witness v2 rules as policy regardless.)
+
+### Signature message
+
+Every signature checked for an input with a block reference, on the key
+path or in tapscript, is over the BIP341 message with `ext_flag` bit 1 set
+(so `spend_type` gains the value 4) and the 32-byte hash of the block at
+`height` in the active chain appended after the message, after the BIP342
+extension if present.
+
+Since the hash of the referenced block is part of the message and not of
+the transaction, a signature made for one chain does not verify on any chain
+whose block at that height differs, nor on a chain that computes the plain
+BIP341 message. An input without a block reference is signed exactly as a
+witness v1 input and is valid on every chain.
+
+## Non-consensus considerations
+
+- The annex is committed to by every signature on the input, so a third
+  party cannot add, remove, or alter a block reference on a signed input.
+  A script-path spend that checks no signature can carry a reference, but
+  it then only imposes the maturity rule.
+- A transaction with a block reference never expires. It becomes invalid
+  only if a reorganisation removes the referenced block, which requires a
+  reorganisation of at least 100 blocks.
+- Wallets that want a spend to be specific to the current chain should
+  reference the most recent eligible block, that is the block at
+  `tip - 99`.
+- Policy: a block reference annex of exactly 6 bytes is standard for v2
+  spends. All other annexes remain non-standard. A transaction whose
+  reference is not yet mature is rejected from the mempool with a
+  retryable, non-punishable error, like a premature coinbase spend.
+
+## Wallet
+
+- `tr2(KEY, TREE)` is `tr()` with a witness v2 output. Addresses are
+  bech32m with witness version 2 (`bc1z...`).
+- `send`, `sendall` and `walletcreatefundedpsbt` accept a
+  `block_reference` option. When set, every witness v2 input references
+  the block at `tip - 99`.
+- A PSBT input carries the reference in field type `0x7f` (prototype,
+  not assigned by any BIP) as a 4-byte little endian height followed by
+  the 32-byte block hash. Signers use it to build the annex and the
+  message; it is kept after finalization so the final witness can be
+  verified. `decodepsbt` shows it as `block_reference`.
+- For a nonzero height-based locktime between the reference height and the
+  wallet's tip, the wallet also includes headers from the referenced block
+  through the locktime height, inclusive. No headers are included for zero
+  or timestamp-based locktimes, or when the locktime height is before the
+  referenced block or beyond the tip. The chosen locktime is not changed.
+  Headers are shared by all inputs in global PSBT records of type `0x7f`
+  (prototype, not assigned by any BIP).
+  Each key is the type byte followed by a 4-byte little endian height;
+  its value is the serialized 80-byte header. `decodepsbt` exposes these
+  as `block_headers`, an object mapping heights to hex-encoded headers.
+  Combining and joining PSBTs reject conflicting headers at the same height.
+  A chain-aware combiner can resolve such conflicts before combining.
+  Combining, joining and finalizing PSBTs preserve these records. They are
+  not part of the final transaction.
+- These optional headers let an offline signer inspect the chain extending
+  a referenced block and its proof of work. A verifier can derive each block
+  hash from its header and check continuity using the next header's previous
+  block hash. Their presence does not establish the claimed height, the
+  intended side of a fork, or that this is the most-work chain. Signers must
+  apply their own verification and trust policy;
+  this prototype continues to sign PSBTs without headers. An external signer
+  can use the transaction's height locktime as the endpoint without knowing
+  the wallet's tip. Reference maturity is still checked against the containing
+  block's height, not the locktime; this metadata does not change consensus.
+- `signrawtransactionwithwallet` and `signrawtransactionwithkey` sign v2
+  inputs without a reference.
+- When a reorg replaces a block that an unconfirmed wallet transaction
+  references, the wallet abandons that transaction: its signatures can never
+  verify again, and its inputs become spendable. A reorg that puts the same
+  block back leaves the transaction alone.
diff --git a/src/addresstype.cpp b/src/addresstype.cpp
index 410879b40d60..e714852e5095 100644
--- a/src/addresstype.cpp
+++ b/src/addresstype.cpp
@@ -91,6 +91,10 @@ bool ExtractDestination(const CScript& scriptPubKey, CTxDestination& addressRet)
         addressRet = PayToAnchor();
         return true;
     }
+    case TxoutType::WITNESS_V2_TAPROOT: {
+        addressRet = WitnessUnknown{2, vSolutions[0]};
+        return true;
+    }
     case TxoutType::WITNESS_UNKNOWN: {
         addressRet = WitnessUnknown{vSolutions[0][0], vSolutions[1]};
         return true;
diff --git a/src/bench/verify_script.cpp b/src/bench/verify_script.cpp
index b6d73b8679ac..99b10bb088fd 100644
--- a/src/bench/verify_script.cpp
+++ b/src/bench/verify_script.cpp
@@ -23,13 +23,16 @@
 
 #include <cstddef>
 #include <map>
+#include <optional>
 #include <span>
+#include <utility>
 #include <vector>
 
 enum class ScriptType {
     P2WPKH, // segwitv0, witness-pubkey-hash (ECDSA signature)
     P2TR_KeyPath, // segwitv1, taproot key-path spend (Schnorr signature)
     P2TR_ScriptPath, // segwitv1, taproot script-path spend (Tapscript leaf with a single OP_CHECKSIG)
+    P2TR2_KeyPath_BlockRef, // segwitv2, taproot key-path spend with a block reference (annex, message extension)
 };
 
 static size_t ExpectedWitnessStackSize(ScriptType script_type)
@@ -38,6 +41,7 @@ static size_t ExpectedWitnessStackSize(ScriptType script_type)
     case ScriptType::P2WPKH: return 2; // [pubkey, signature]
     case ScriptType::P2TR_KeyPath: return 1; // [signature]
     case ScriptType::P2TR_ScriptPath: return 3; // [signature, tapscript, control block]
+    case ScriptType::P2TR2_KeyPath_BlockRef: return 2; // [signature, annex]
     } // no default case, so the compiler can warn about missing cases
     assert(false);
 }
@@ -63,6 +67,7 @@ static void VerifyScriptBench(benchmark::Bench& bench, ScriptType script_type)
         switch (script_type) {
         case ScriptType::P2WPKH: return WitnessV0KeyHash(pubkey);
         case ScriptType::P2TR_KeyPath: return WitnessV1Taproot(xonly_pubkey);
+        case ScriptType::P2TR2_KeyPath_BlockRef: return WitnessUnknown{2, ToByteVector(xonly_pubkey)};
         case ScriptType::P2TR_ScriptPath:
             TaprootBuilder builder;
             builder.Add(0, CScript() << ToByteVector(xonly_pubkey) << OP_CHECKSIG, TAPROOT_LEAF_TAPSCRIPT);
@@ -83,11 +88,15 @@ static void VerifyScriptBench(benchmark::Bench& bench, ScriptType script_type)
             {txSpend.vin[0].prevout, Coin(txCredit.vout[0], /*nHeightIn=*/100, /*fCoinBaseIn=*/false)}
         };
         std::map<int, bilingual_str> input_errors;
-        bool complete = SignTransaction(txSpend, &keystore, coins, {.sighash_type = SIGHASH_ALL}, input_errors);
+        const std::pair<int, uint256> block_ref{100, uint256::ONE};
+        SignOptions options{.sighash_type = SIGHASH_ALL};
+        if (script_type == ScriptType::P2TR2_KeyPath_BlockRef) options.block_reference = block_ref;
+        bool complete = SignTransaction(txSpend, &keystore, coins, options, input_errors);
         assert(complete);
         // Weak sanity check on witness data to ensure we produced the intended spending type
         assert(txSpend.vin[0].scriptWitness.stack.size() == ExpectedWitnessStackSize(script_type));
         txdata.Init(txSpend, /*spent_outputs=*/{txCredit.vout[0]});
+        if (options.block_reference) txdata.m_block_hashes.push_back(block_ref);
     }
 
     // Benchmark.
@@ -108,6 +117,7 @@ static void VerifyScriptBench(benchmark::Bench& bench, ScriptType script_type)
 static void VerifyScriptP2WPKH(benchmark::Bench& bench) { VerifyScriptBench(bench, ScriptType::P2WPKH); }
 static void VerifyScriptP2TR_KeyPath(benchmark::Bench& bench) { VerifyScriptBench(bench, ScriptType::P2TR_KeyPath); }
 static void VerifyScriptP2TR_ScriptPath(benchmark::Bench& bench) { VerifyScriptBench(bench, ScriptType::P2TR_ScriptPath); }
+static void VerifyScriptP2TR2_KeyPath_BlockRef(benchmark::Bench& bench) { VerifyScriptBench(bench, ScriptType::P2TR2_KeyPath_BlockRef); }
 
 static void VerifyNestedIfScript(benchmark::Bench& bench)
 {
@@ -134,4 +144,5 @@ static void VerifyNestedIfScript(benchmark::Bench& bench)
 BENCHMARK(VerifyScriptP2WPKH);
 BENCHMARK(VerifyScriptP2TR_KeyPath);
 BENCHMARK(VerifyScriptP2TR_ScriptPath);
+BENCHMARK(VerifyScriptP2TR2_KeyPath_BlockRef);
 BENCHMARK(VerifyNestedIfScript);
diff --git a/src/chainparamsbase.cpp b/src/chainparamsbase.cpp
index f62e455fac45..526614443d90 100644
--- a/src/chainparamsbase.cpp
+++ b/src/chainparamsbase.cpp
@@ -16,7 +16,7 @@ void SetupChainParamsBaseOptions(ArgsManager& argsman)
     argsman.AddArg("-chain=<chain>", "Use the chain <chain> (default: main). Allowed values: " LIST_CHAIN_NAMES, ArgsManager::ALLOW_ANY, OptionsCategory::CHAINPARAMS);
     argsman.AddArg("-regtest", "Enter regression test mode, which uses a special chain in which blocks can be solved instantly. "
                  "This is intended for regression testing tools and app development. Equivalent to -chain=regtest.", ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::CHAINPARAMS);
-    argsman.AddArg("-testactivationheight=name@height.", "Set the activation height of 'name' (segwit, bip34, dersig, cltv, csv). (test-only)", ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::DEBUG_TEST);
+    argsman.AddArg("-testactivationheight=name@height.", "Set the activation height of 'name' (segwit, bip34, dersig, cltv, csv, taproot_v2). (test-only)", ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::DEBUG_TEST);
     argsman.AddArg("-testnet", "Use the testnet3 chain. Equivalent to -chain=test. Support for testnet3 is deprecated and will be removed in an upcoming release. Consider moving to testnet4 now by using -testnet4.", ArgsManager::ALLOW_ANY, OptionsCategory::CHAINPARAMS);
     argsman.AddArg("-testnet4", "Use the testnet4 chain. Equivalent to -chain=testnet4.", ArgsManager::ALLOW_ANY, OptionsCategory::CHAINPARAMS);
     argsman.AddArg("-vbparams=deployment:start:end[:min_activation_height]", "Use given start/end times and min_activation_height for specified version bits deployment (test-only)", ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::CHAINPARAMS);
diff --git a/src/consensus/params.h b/src/consensus/params.h
index 99096e06d9a8..9f98e9276bf4 100644
--- a/src/consensus/params.h
+++ b/src/consensus/params.h
@@ -32,8 +32,9 @@ enum BuriedDeployment : int16_t {
     // SCRIPT_VERIFY_WITNESS is enforced from genesis, but the check for downloading
     // missing witness data is not. BIP 147 also relies on hardcoded activation height.
     DEPLOYMENT_SEGWIT,
+    DEPLOYMENT_TAPROOT_V2,
 };
-constexpr bool ValidDeployment(BuriedDeployment dep) { return dep <= DEPLOYMENT_SEGWIT; }
+constexpr bool ValidDeployment(BuriedDeployment dep) { return dep <= DEPLOYMENT_TAPROOT_V2; }
 
 enum DeploymentPos : uint16_t {
     DEPLOYMENT_TESTDUMMY,
@@ -108,6 +109,8 @@ struct Params {
      * Note that segwit v0 script rules are enforced on all blocks except the
      * BIP 16 exception blocks. */
     int SegwitHeight;
+    /** Block height at which witness v2 Taproot (with block references) becomes active */
+    int TaprootV2Height;
     /** Don't warn about unknown BIP 9 activations below this height.
      * This prevents us from warning about the CSV, segwit and taproot activations. */
     int MinBIP9WarningHeight;
@@ -153,6 +156,8 @@ struct Params {
             return CSVHeight;
         case DEPLOYMENT_SEGWIT:
             return SegwitHeight;
+        case DEPLOYMENT_TAPROOT_V2:
+            return TaprootV2Height;
         } // no default case, so the compiler can warn about missing cases
         return std::numeric_limits<int>::max();
     }
diff --git a/src/consensus/tx_verify.cpp b/src/consensus/tx_verify.cpp
index e580a9d2947b..7841c8d33641 100644
--- a/src/consensus/tx_verify.cpp
+++ b/src/consensus/tx_verify.cpp
@@ -18,6 +18,8 @@
 
 #include <algorithm>
 #include <cstddef>
+#include <optional>
+#include <span>
 #include <string>
 
 bool IsFinalTx(const CTransaction &tx, int nBlockHeight, int64_t nBlockTime)
@@ -167,6 +169,24 @@ int64_t GetTransactionSigOpCost(const CTransaction& tx, const CCoinsViewCache& i
     return nSigOps;
 }
 
+std::vector<int> Consensus::GetBlockReferences(const CTransaction& tx, const CCoinsViewCache& inputs)
+{
+    std::vector<int> heights;
+    for (const CTxIn& txin : tx.vin) {
+        const auto& stack{txin.scriptWitness.stack};
+        if (stack.size() < 2 || stack.back().size() < BLOCK_REF_ANNEX_SIZE || stack.back()[0] != ANNEX_TAG) continue;
+        int witnessversion;
+        std::vector<unsigned char> witnessprogram;
+        const CScript& spk{inputs.AccessCoin(txin.prevout).out.scriptPubKey};
+        if (!spk.IsWitnessProgram(witnessversion, witnessprogram) || witnessversion != 2 || witnessprogram.size() != WITNESS_V2_TAPROOT_SIZE) continue;
+        std::optional<int> height;
+        if (ParseBlockReference(stack.back(), height) && height) heights.push_back(*height);
+    }
+    std::ranges::sort(heights);
+    heights.erase(std::ranges::unique(heights).begin(), heights.end());
+    return heights;
+}
+
 bool Consensus::CheckTxInputs(const CTransaction& tx, TxValidationState& state, const CCoinsViewCache& inputs, int nSpendHeight, CAmount& txfee)
 {
     // are the actual inputs available?
diff --git a/src/consensus/tx_verify.h b/src/consensus/tx_verify.h
index 76faeaeaea8e..505a196e0dc3 100644
--- a/src/consensus/tx_verify.h
+++ b/src/consensus/tx_verify.h
@@ -27,6 +27,14 @@ namespace Consensus {
  * Preconditions: tx.IsCoinBase() is false.
  */
 [[nodiscard]] bool CheckTxInputs(const CTransaction& tx, TxValidationState& state, const CCoinsViewCache& inputs, int nSpendHeight, CAmount& txfee);
+
+/**
+ * Heights of the blocks referenced by the inputs of a transaction (block reference annexes of
+ * witness v2 spends, see doc/block-reference.md), sorted and without duplicates. Malformed
+ * references are skipped; script validation rejects them.
+ * Preconditions: all inputs are available in `inputs`.
+ */
+std::vector<int> GetBlockReferences(const CTransaction& tx, const CCoinsViewCache& inputs);
 } // namespace Consensus
 
 /** Auxiliary functions for transaction validation (ideally should not be exposed) */
diff --git a/src/deploymentinfo.cpp b/src/deploymentinfo.cpp
index 551982b23ae7..8f88b9961b4a 100644
--- a/src/deploymentinfo.cpp
+++ b/src/deploymentinfo.cpp
@@ -29,6 +29,8 @@ std::string DeploymentName(Consensus::BuriedDeployment dep)
         return "csv";
     case Consensus::DEPLOYMENT_SEGWIT:
         return "segwit";
+    case Consensus::DEPLOYMENT_TAPROOT_V2:
+        return "taproot_v2";
     } // no default case, so the compiler can warn about missing cases
     return "";
 }
@@ -45,6 +47,8 @@ std::optional<Consensus::BuriedDeployment> GetBuriedDeployment(const std::string
         return Consensus::BuriedDeployment::DEPLOYMENT_CLTV;
     } else if (name == "csv") {
         return Consensus::BuriedDeployment::DEPLOYMENT_CSV;
+    } else if (name == "taproot_v2") {
+        return Consensus::BuriedDeployment::DEPLOYMENT_TAPROOT_V2;
     }
     return std::nullopt;
 }
diff --git a/src/interfaces/chain.h b/src/interfaces/chain.h
index 1ee433a02a67..2b3571c6dd36 100644
--- a/src/interfaces/chain.h
+++ b/src/interfaces/chain.h
@@ -25,6 +25,7 @@
 #include <vector>
 
 class CBlock;
+class CBlockHeader;
 class CFeeRate;
 class CRPCCommand;
 class CScheduler;
@@ -52,6 +53,8 @@ class FoundBlock
 {
 public:
     FoundBlock& hash(uint256& hash) { m_hash = &hash; return *this; }
+    //! Return the header from the block index, including for pruned blocks.
+    FoundBlock& header(CBlockHeader& header) { m_header = &header; return *this; }
     FoundBlock& height(int& height) { m_height = &height; return *this; }
     FoundBlock& time(int64_t& time) { m_time = &time; return *this; }
     FoundBlock& maxTime(int64_t& max_time) { m_max_time = &max_time; return *this; }
@@ -67,6 +70,7 @@ class FoundBlock
     FoundBlock& data(CBlock& data) { m_data = &data; return *this; }
 
     uint256* m_hash = nullptr;
+    CBlockHeader* m_header = nullptr;
     int* m_height = nullptr;
     int64_t* m_time = nullptr;
     int64_t* m_max_time = nullptr;
diff --git a/src/kernel/chainparams.cpp b/src/kernel/chainparams.cpp
index 9764ba95c807..82b504c4d619 100644
--- a/src/kernel/chainparams.cpp
+++ b/src/kernel/chainparams.cpp
@@ -28,6 +28,7 @@
 #include <cstdint>
 #include <cstring>
 #include <iterator>
+#include <limits>
 #include <map>
 #include <span>
 #include <utility>
@@ -92,6 +93,9 @@ void CChainParams::ApplyDeploymentOptions(const DeploymentOptions& opts)
         case Consensus::BuriedDeployment::DEPLOYMENT_CSV:
             consensus.CSVHeight = int{height};
             break;
+        case Consensus::BuriedDeployment::DEPLOYMENT_TAPROOT_V2:
+            consensus.TaprootV2Height = int{height};
+            break;
         }
     }
 
@@ -122,6 +126,7 @@ class CMainParams : public CChainParams {
         consensus.BIP66Height = 363725; // 00000000000000000379eaa19dce8c9b722d46ae6a57c2f1a988119488b50931
         consensus.CSVHeight = 419328; // 000000000000000004a1b34462cb8aeebd5799177f7a29cf28f2d1961716b5b5
         consensus.SegwitHeight = 481824; // 0000000000000000001c8018d9cb3b742ef25114f27563e3fc4a1902167f9893
+        consensus.TaprootV2Height = std::numeric_limits<int>::max(); // Not deployed
         consensus.MinBIP9WarningHeight = 711648; // taproot activation height + miner confirmation window
         consensus.powLimit = uint256{"00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff"};
         consensus.nPowTargetTimespan = 14 * 24 * 60 * 60; // two weeks
@@ -246,6 +251,7 @@ class CTestNetParams : public CChainParams {
         consensus.BIP66Height = 330776; // 000000002104c8c45e99a8853285a3b592602a3ccde2b832481da85e9e4ba182
         consensus.CSVHeight = 770112; // 00000000025e930139bac5c6c31a403776da130831ab85be56578f3fa75369bb
         consensus.SegwitHeight = 834624; // 00000000002b980fcd729daaa248fd9316a5200e9b367f4ff2c42453e84201ca
+        consensus.TaprootV2Height = std::numeric_limits<int>::max(); // Not deployed
         consensus.MinBIP9WarningHeight = 2013984; // taproot activation height + miner confirmation window
         consensus.powLimit = uint256{"00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff"};
         consensus.nPowTargetTimespan = 14 * 24 * 60 * 60; // two weeks
@@ -346,6 +352,7 @@ class CTestNet4Params : public CChainParams {
         consensus.BIP66Height = 1;
         consensus.CSVHeight = 1;
         consensus.SegwitHeight = 1;
+        consensus.TaprootV2Height = std::numeric_limits<int>::max(); // Not deployed
         consensus.MinBIP9WarningHeight = 0;
         consensus.powLimit = uint256{"00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff"};
         consensus.nPowTargetTimespan = 14 * 24 * 60 * 60; // two weeks
@@ -492,6 +499,7 @@ class SigNetParams : public CChainParams {
         consensus.BIP66Height = 1;
         consensus.CSVHeight = 1;
         consensus.SegwitHeight = 1;
+        consensus.TaprootV2Height = std::numeric_limits<int>::max(); // Not deployed
         consensus.nPowTargetTimespan = 14 * 24 * 60 * 60; // two weeks
         consensus.nPowTargetSpacing = 10 * 60;
         consensus.fPowAllowMinDifficultyBlocks = false;
@@ -575,6 +583,7 @@ class CRegTestParams : public CChainParams
         consensus.BIP66Height = 1;  // Always active unless overridden
         consensus.CSVHeight = 1;    // Always active unless overridden
         consensus.SegwitHeight = 0; // Always active unless overridden
+        consensus.TaprootV2Height = 0; // Always active unless overridden
         consensus.MinBIP9WarningHeight = 0;
         consensus.powLimit = uint256{"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"};
         consensus.nPowTargetTimespan = 24 * 60 * 60; // one day
diff --git a/src/kernel/mempool_entry.h b/src/kernel/mempool_entry.h
index 29ca1fd0e280..be254cb4ec33 100644
--- a/src/kernel/mempool_entry.h
+++ b/src/kernel/mempool_entry.h
@@ -81,13 +81,17 @@ class CTxMemPoolEntry : public TxGraph::Ref
     const int64_t sigOpCost;        //!< Total sigop cost
     mutable CAmount m_modified_fee; //!< Used for determining the priority of the transaction for mining in a block
     mutable LockPoints lockPoints;  //!< Track the height and time at which tx was final
+    /** Blocks referenced by the inputs (see doc/block-reference.md), as resolved at acceptance. The tx is only
+     *  valid while these are in the active chain and mature; a reorg that changes that must evict it. */
+    const std::vector<const CBlockIndex*> m_block_refs;
 
 public:
     virtual ~CTxMemPoolEntry() = default;
     CTxMemPoolEntry(const CTransactionRef& tx, CAmount fee,
                     int64_t time, unsigned int entry_height, uint64_t entry_sequence,
                     bool spends_coinbase,
-                    int64_t sigops_cost, LockPoints lp)
+                    int64_t sigops_cost, LockPoints lp,
+                    std::vector<const CBlockIndex*> block_refs = {})
         : tx{tx},
           nFee{fee},
           nTxWeight{GetTransactionWeight(*tx)},
@@ -98,7 +102,8 @@ class CTxMemPoolEntry : public TxGraph::Ref
           spendsCoinbase{spends_coinbase},
           sigOpCost{sigops_cost},
           m_modified_fee{nFee},
-          lockPoints{lp} {}
+          lockPoints{lp},
+          m_block_refs{std::move(block_refs)} {}
 
     CTxMemPoolEntry& operator=(const CTxMemPoolEntry&) = delete;
     CTxMemPoolEntry(CTxMemPoolEntry&&) = default;
@@ -120,6 +125,7 @@ class CTxMemPoolEntry : public TxGraph::Ref
     CAmount GetModifiedFee() const { return m_modified_fee; }
     size_t DynamicMemoryUsage() const { return nUsageSize; }
     const LockPoints& GetLockPoints() const { return lockPoints; }
+    const std::vector<const CBlockIndex*>& GetBlockReferences() const { return m_block_refs; }
 
     // Updates the modified fees with descendants/ancestors.
     void UpdateModifiedFee(CAmount fee_diff) const
diff --git a/src/node/interfaces.cpp b/src/node/interfaces.cpp
index c1dd8e7a4dd7..3f708401a911 100644
--- a/src/node/interfaces.cpp
+++ b/src/node/interfaces.cpp
@@ -450,6 +450,7 @@ bool FillBlock(const CBlockIndex* index, const FoundBlock& block, UniqueLock<Rec
 {
     if (!index) return false;
     if (block.m_hash) *block.m_hash = index->GetBlockHash();
+    if (block.m_header) *block.m_header = index->GetBlockHeader();
     if (block.m_height) *block.m_height = index->nHeight;
     if (block.m_time) *block.m_time = index->GetBlockTime();
     if (block.m_max_time) *block.m_max_time = index->GetBlockTimeMax();
diff --git a/src/node/psbt.cpp b/src/node/psbt.cpp
index b0988d868282..d561e98fccfd 100644
--- a/src/node/psbt.cpp
+++ b/src/node/psbt.cpp
@@ -31,8 +31,14 @@ PSBTAnalysis AnalyzePSBT(PartiallySignedTransaction psbtx)
 
     result.inputs.resize(psbtx.inputs.size());
 
-    // PrecomputePSBTData calls GetUnsignedTx() which we checked already works
-    const PrecomputedTransactionData txdata = *PrecomputePSBTData(psbtx);
+    // PrecomputePSBTData calls GetUnsignedTx() which we checked already works, but it can still
+    // reject conflicting block references.
+    const std::optional<PrecomputedTransactionData> txdata_opt{PrecomputePSBTData(psbtx)};
+    if (!txdata_opt) {
+        result.SetInvalid("PSBT inputs reference conflicting block hashes for the same height");
+        return result;
+    }
+    const PrecomputedTransactionData& txdata{*txdata_opt};
 
     for (unsigned int i = 0; i < psbtx.inputs.size(); ++i) {
         PSBTInput& input = psbtx.inputs[i];
diff --git a/src/policy/policy.cpp b/src/policy/policy.cpp
index 83ceb63cbcd7..18c257106ac7 100644
--- a/src/policy/policy.cpp
+++ b/src/policy/policy.cpp
@@ -320,13 +320,15 @@ bool IsWitnessStandard(const CTransaction& tx, const CCoinsViewCache& mapInputs)
 
         // Check policy limits for Taproot spends:
         // - MAX_STANDARD_TAPSCRIPT_STACK_ITEM_SIZE limit for stack item size
-        // - No annexes
-        if (witnessversion == 1 && witnessprogram.size() == WITNESS_V1_TAPROOT_SIZE && !p2sh) {
-            // Taproot spend (non-P2SH-wrapped, version 1, witness program size 32; see BIP 341)
+        // - No annexes, except a witness v2 block reference
+        if ((witnessversion == 1 || witnessversion == 2) && witnessprogram.size() == WITNESS_V1_TAPROOT_SIZE && !p2sh) {
+            // Taproot spend (non-P2SH-wrapped, version 1 or 2, witness program size 32; see BIP 341)
             std::span stack{tx.vin[i].scriptWitness.stack};
             if (stack.size() >= 2 && !stack.back().empty() && stack.back()[0] == ANNEX_TAG) {
-                // Annexes are nonstandard as long as no semantics are defined for them.
-                return false;
+                // Annexes are nonstandard as long as no semantics are defined for them. The exception is a
+                // witness v2 block reference of exactly the defined size (see doc/block-reference.md).
+                if (witnessversion != 2 || stack.back().size() != BLOCK_REF_ANNEX_SIZE || stack.back()[1] != BLOCK_REF_ANNEX_TYPE) return false;
+                SpanPopBack(stack);
             }
             if (stack.size() >= 2) {
                 // Script path spend (2 or more stack elements after removing optional annex)
diff --git a/src/policy/policy.h b/src/policy/policy.h
index ea66fa4b84e9..ca15916efef0 100644
--- a/src/policy/policy.h
+++ b/src/policy/policy.h
@@ -107,7 +107,8 @@ inline constexpr script_verify_flags MANDATORY_SCRIPT_VERIFY_FLAGS{SCRIPT_VERIFY
                                                              SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY |
                                                              SCRIPT_VERIFY_CHECKSEQUENCEVERIFY |
                                                              SCRIPT_VERIFY_WITNESS |
-                                                             SCRIPT_VERIFY_TAPROOT};
+                                                             SCRIPT_VERIFY_TAPROOT |
+                                                             SCRIPT_VERIFY_TAPROOT_V2};
 
 /**
  * Standard script verification flags that standard transactions will comply
diff --git a/src/psbt.cpp b/src/psbt.cpp
index 51fb19591a56..1d64c3831072 100644
--- a/src/psbt.cpp
+++ b/src/psbt.cpp
@@ -45,6 +45,7 @@ bool PartiallySignedTransaction::Merge(const PartiallySignedTransaction& psbt)
     if (GetVersion() != psbt.GetVersion()) {
         return false;
     }
+    if (!MergeBlockHeaders(psbt)) return false;
 
     for (unsigned int i = 0; i < inputs.size(); ++i) {
         inputs[i].Merge(psbt.inputs[i]);
@@ -83,6 +84,16 @@ void PartiallySignedTransaction::MergeGlobalXPubs(const PartiallySignedTransacti
     }
 }
 
+bool PartiallySignedTransaction::MergeBlockHeaders(const PartiallySignedTransaction& psbt)
+{
+    for (const auto& [height, header] : psbt.m_block_headers) {
+        const auto it{m_block_headers.find(height)};
+        if (it != m_block_headers.end() && it->second.GetHash() != header.GetHash()) return false;
+    }
+    m_block_headers.insert(psbt.m_block_headers.begin(), psbt.m_block_headers.end());
+    return true;
+}
+
 std::optional<uint32_t> PartiallySignedTransaction::ComputeTimeLock() const
 {
     if (GetVersion() >= 2) {
@@ -461,6 +472,7 @@ void PSBTInput::Merge(const PSBTInput& input)
         m_musig2_partial_sigs[agg_key_lh].insert(psigs.begin(), psigs.end());
     }
     if (sighash_type == std::nullopt && input.sighash_type != std::nullopt) sighash_type = input.sighash_type;
+    if (m_block_reference == std::nullopt && input.m_block_reference != std::nullopt) m_block_reference = input.m_block_reference;
     if (sequence == std::nullopt && input.sequence != std::nullopt) sequence = input.sequence;
     if (time_locktime == std::nullopt && input.time_locktime != std::nullopt) time_locktime = input.time_locktime;
     if (height_locktime == std::nullopt && input.height_locktime != std::nullopt) height_locktime = input.height_locktime;
@@ -637,6 +649,14 @@ std::optional<PrecomputedTransactionData> PrecomputePSBTData(const PartiallySign
     } else {
         txdata.Init(tx, {}, true);
     }
+    // Block references: one hash per height; inputs claiming different hashes for one height conflict.
+    std::map<int, uint256> block_hashes;
+    for (const PSBTInput& input : psbt.inputs) {
+        if (!input.m_block_reference) continue;
+        const auto [it, inserted] = block_hashes.insert(*input.m_block_reference);
+        if (!inserted && it->second != input.m_block_reference->second) return std::nullopt;
+    }
+    txdata.m_block_hashes.assign(block_hashes.begin(), block_hashes.end());
     return txdata;
 }
 
@@ -726,7 +746,7 @@ util::Expected<void, PSBTError> SignPSBTInput(const SigningProvider& provider, P
     if (txdata == nullptr) {
         sig_complete = ProduceSignature(provider, DUMMY_SIGNATURE_CREATOR, utxo.scriptPubKey, sigdata);
     } else {
-        MutableTransactionSignatureCreator creator(tx, index, utxo.nValue, txdata, {.sighash_type = sighash});
+        MutableTransactionSignatureCreator creator(tx, index, utxo.nValue, txdata, {.sighash_type = sighash, .block_reference = input.m_block_reference});
         sig_complete = ProduceSignature(provider, creator, utxo.scriptPubKey, sigdata);
     }
     // Verify that a witness signature was produced in case one was required.
diff --git a/src/psbt.h b/src/psbt.h
index 467dffb0ca93..b27411295f53 100644
--- a/src/psbt.h
+++ b/src/psbt.h
@@ -9,6 +9,7 @@
 #include <musig.h>
 #include <node/transaction.h>
 #include <policy/feerate.h>
+#include <primitives/block.h>
 #include <primitives/transaction.h>
 #include <pubkey.h>
 #include <script/keyorigin.h>
@@ -40,6 +41,8 @@ inline constexpr uint8_t PSBT_GLOBAL_FALLBACK_LOCKTIME = 0x03;
 inline constexpr uint8_t PSBT_GLOBAL_INPUT_COUNT = 0x04;
 inline constexpr uint8_t PSBT_GLOBAL_OUTPUT_COUNT = 0x05;
 inline constexpr uint8_t PSBT_GLOBAL_TX_MODIFIABLE = 0x06;
+//! Block header keyed by height (see doc/block-reference.md). Prototype; not assigned by any BIP.
+inline constexpr uint8_t PSBT_GLOBAL_BLOCK_HEADER = 0x7f;
 inline constexpr uint8_t PSBT_GLOBAL_VERSION = 0xFB;
 inline constexpr uint8_t PSBT_GLOBAL_PROPRIETARY = 0xFC;
 
@@ -71,6 +74,8 @@ inline constexpr uint8_t PSBT_IN_TAP_MERKLE_ROOT = 0x18;
 inline constexpr uint8_t PSBT_IN_MUSIG2_PARTICIPANT_PUBKEYS = 0x1a;
 inline constexpr uint8_t PSBT_IN_MUSIG2_PUB_NONCE = 0x1b;
 inline constexpr uint8_t PSBT_IN_MUSIG2_PARTIAL_SIG = 0x1c;
+//! Block referenced by a witness v2 input (see doc/block-reference.md). Prototype; the type number is not assigned by any BIP.
+inline constexpr uint8_t PSBT_IN_BLOCK_REFERENCE = 0x7f;
 inline constexpr uint8_t PSBT_IN_PROPRIETARY = 0xFC;
 
 // Output types
@@ -321,6 +326,8 @@ class PSBTInput
     std::map<std::vector<unsigned char>, std::vector<unsigned char>> unknown;
     std::set<PSBTProprietary> m_proprietary;
     std::optional<int> sighash_type;
+    //! Height and hash of the block a witness v2 input references (annex and signature commitment).
+    std::optional<std::pair<int, uint256>> m_block_reference;
 
     void FillSignatureData(SignatureData& sigdata) const;
     void FromSignatureData(const SignatureData& sigdata);
@@ -516,6 +523,12 @@ class PSBTInput
             SerializeToVector(s, final_script_witness.stack);
         }
 
+        // Write block reference (kept after finalization: verifying the final witness needs it)
+        if (m_block_reference) {
+            SerializeToVector(s, CompactSizeWriter(PSBT_IN_BLOCK_REFERENCE));
+            SerializeToVector(s, uint32_t(m_block_reference->first), m_block_reference->second);
+        }
+
         // Write PSBTv2 fields
         if (m_psbt_version >= 2) {
             // Write prev txid, vout, sequence, and lock times
@@ -858,6 +871,15 @@ class PSBTInput
                     UnserializeFromVector(s, m_tap_merkle_root);
                     break;
                 }
+                case PSBT_IN_BLOCK_REFERENCE:
+                {
+                    ExpectedKeySize("Input Block Reference", key, 1);
+                    uint32_t height;
+                    uint256 block_hash;
+                    UnserializeFromVector(s, height, block_hash);
+                    m_block_reference = {int(height), block_hash};
+                    break;
+                }
                 case PSBT_IN_MUSIG2_PARTICIPANT_PUBKEYS:
                 {
                     ExpectedKeySize("Input MuSig2 Participants Pubkeys", key, CPubKey::COMPRESSED_SIZE + 1);
@@ -1244,6 +1266,8 @@ class PartiallySignedTransaction
     // We use a vector of CExtPubKey in the event that there happens to be the same KeyOriginInfos for different CExtPubKeys
     // Note that this map swaps the key and values from the serialization
     std::map<KeyOriginInfo, std::set<CExtPubKey>> m_xpubs;
+    //! Optional headers for checking block references, shared by all inputs.
+    std::map<uint32_t, CBlockHeader> m_block_headers;
     std::optional<std::bitset<8>> m_tx_modifiable;
     std::vector<PSBTInput> inputs;
     std::vector<PSBTOutput> outputs;
@@ -1261,6 +1285,8 @@ class PartiallySignedTransaction
     /** Merge the global xpubs of psbt into this, keeping the existing origin for an xpub
       * seen again with a different one, as the serialized records are keyed by xpub. */
     void MergeGlobalXPubs(const PartiallySignedTransaction& psbt);
+    /** Merge global headers, returning false without modifying them if a height has conflicting headers. */
+    [[nodiscard]] bool MergeBlockHeaders(const PartiallySignedTransaction& psbt);
     bool AddInput(const PSBTInput& psbtin);
     bool AddOutput(const PSBTOutput& psbtout);
     std::optional<uint32_t> ComputeTimeLock() const;
@@ -1314,6 +1340,12 @@ class PartiallySignedTransaction
             }
         }
 
+        // Write block headers (also kept after finalization).
+        for (const auto& [height, header] : m_block_headers) {
+            SerializeToVector(s, CompactSizeWriter(PSBT_GLOBAL_BLOCK_HEADER), height);
+            SerializeToVector(s, header);
+        }
+
         // PSBT version
         if (GetVersion() > 0) {
             SerializeToVector(s, CompactSizeWriter(PSBT_GLOBAL_VERSION));
@@ -1475,6 +1507,16 @@ class PartiallySignedTransaction
                     }
                     break;
                 }
+                case PSBT_GLOBAL_BLOCK_HEADER:
+                {
+                    ExpectedKeySize("Global Block Header", key, 5);
+                    uint32_t height;
+                    skey >> height;
+                    CBlockHeader header;
+                    UnserializeFromVector(s, header);
+                    m_block_headers.emplace(height, header);
+                    break;
+                }
                 case PSBT_GLOBAL_VERSION:
                 {
                     ExpectedKeySize("Global PSBT Version", key, 1);
diff --git a/src/rpc/blockchain.cpp b/src/rpc/blockchain.cpp
index 6677cdeaf3ba..070f65e35b03 100644
--- a/src/rpc/blockchain.cpp
+++ b/src/rpc/blockchain.cpp
@@ -1507,6 +1507,7 @@ UniValue DeploymentInfo(const CBlockIndex* blockindex, const ChainstateManager&
     SoftForkDescPushBack(blockindex, softforks, chainman, Consensus::DEPLOYMENT_CLTV);
     SoftForkDescPushBack(blockindex, softforks, chainman, Consensus::DEPLOYMENT_CSV);
     SoftForkDescPushBack(blockindex, softforks, chainman, Consensus::DEPLOYMENT_SEGWIT);
+    SoftForkDescPushBack(blockindex, softforks, chainman, Consensus::DEPLOYMENT_TAPROOT_V2);
     SoftForkDescPushBack(blockindex, softforks, chainman, Consensus::DEPLOYMENT_TESTDUMMY);
     return softforks;
 }
diff --git a/src/rpc/client.cpp b/src/rpc/client.cpp
index 21ed8795304f..98dee8e16c06 100644
--- a/src/rpc/client.cpp
+++ b/src/rpc/client.cpp
@@ -194,6 +194,7 @@ static const CRPCConvertParam vRPCConvertParams[] =
     { "walletcreatefundedpsbt", 3, "options" },
     { "walletcreatefundedpsbt", 3, "add_inputs"},
     { "walletcreatefundedpsbt", 3, "include_unsafe"},
+    { "walletcreatefundedpsbt", 3, "block_reference"},
     { "walletcreatefundedpsbt", 3, "minconf"},
     { "walletcreatefundedpsbt", 3, "maxconf"},
     { "walletcreatefundedpsbt", 3, "changePosition"},
@@ -251,6 +252,7 @@ static const CRPCConvertParam vRPCConvertParams[] =
     { "send", 4, "options" },
     { "send", 4, "add_inputs"},
     { "send", 4, "include_unsafe"},
+    { "send", 4, "block_reference"},
     { "send", 4, "minconf"},
     { "send", 4, "maxconf"},
     { "send", 4, "add_to_wallet"},
@@ -272,6 +274,7 @@ static const CRPCConvertParam vRPCConvertParams[] =
     { "sendall", 3, "fee_rate"},
     { "sendall", 4, "options" },
     { "sendall", 4, "add_to_wallet"},
+    { "sendall", 4, "block_reference"},
     { "sendall", 4, "fee_rate"},
     { "sendall", 4, "include_watching"},
     { "sendall", 4, "inputs"},
diff --git a/src/rpc/rawtransaction.cpp b/src/rpc/rawtransaction.cpp
index e451305a3613..c99cf1ed1e9d 100644
--- a/src/rpc/rawtransaction.cpp
+++ b/src/rpc/rawtransaction.cpp
@@ -508,6 +508,7 @@ static RPCMethod decodescript()
         case TxoutType::SCRIPTHASH:
         case TxoutType::WITNESS_UNKNOWN:
         case TxoutType::WITNESS_V1_TAPROOT:
+        case TxoutType::WITNESS_V2_TAPROOT:
         case TxoutType::ANCHOR:
             // Should not be wrapped
             return false;
@@ -551,6 +552,7 @@ static RPCMethod decodescript()
             case TxoutType::WITNESS_V0_KEYHASH:
             case TxoutType::WITNESS_V0_SCRIPTHASH:
             case TxoutType::WITNESS_V1_TAPROOT:
+            case TxoutType::WITNESS_V2_TAPROOT:
             case TxoutType::ANCHOR:
                 // Should not be wrapped
                 return false;
@@ -819,6 +821,11 @@ const RPCResult& DecodePSBTInputs()
                     {RPCResult::Type::STR, "pubkey", "The public key and signature that corresponds to it."},
                 }},
                 {RPCResult::Type::STR, "sighash", /*optional=*/true, "The sighash type to be used"},
+                {RPCResult::Type::OBJ, "block_reference", /*optional=*/true, "The block a witness v2 input references (see doc/block-reference.md)",
+                {
+                    {RPCResult::Type::NUM, "height", "The height of the referenced block"},
+                    {RPCResult::Type::STR_HEX, "hash", "The hash of the referenced block"},
+                }},
                 {RPCResult::Type::OBJ, "redeem_script", /*optional=*/true, "",
                 {
                     {RPCResult::Type::STR, "asm", "Disassembly of the redeem script"},
@@ -1067,6 +1074,10 @@ static RPCMethod decodepsbt()
                                 {RPCResult::Type::STR, "path", "The path"},
                             }},
                         }},
+                        {RPCResult::Type::OBJ_DYN, "block_headers", /*optional=*/true, "Optional block headers for checking block references (see doc/block-reference.md)",
+                        {
+                            {RPCResult::Type::STR_HEX, "height", "The serialized 80-byte block header, keyed by its claimed height"},
+                        }},
                         {RPCResult::Type::NUM, "tx_version", /* optional */ true, "The version number of the unsigned transaction. Not to be confused with PSBT version"},
                         {RPCResult::Type::NUM, "fallback_locktime", /* optional */ true, "The locktime to fallback to if no inputs specify a required locktime."},
                         {RPCResult::Type::NUM, "input_count", /* optional */ true, "The number of inputs in this psbt"},
@@ -1115,6 +1126,16 @@ static RPCMethod decodepsbt()
         result.pushKV("tx", std::move(tx_univ));
     }
 
+    if (!psbtx.m_block_headers.empty()) {
+        UniValue headers(UniValue::VOBJ);
+        for (const auto& [height, header] : psbtx.m_block_headers) {
+            DataStream ss;
+            ss << header;
+            headers.pushKV(strprintf("%u", height), HexStr(ss));
+        }
+        result.pushKV("block_headers", std::move(headers));
+    }
+
     // Add the global xpubs
     UniValue global_xpubs(UniValue::VARR);
     for (std::pair<KeyOriginInfo, std::set<CExtPubKey>> xpub_pair : psbtx.m_xpubs) {
@@ -1227,6 +1248,14 @@ static RPCMethod decodepsbt()
             in.pushKV("sighash", SighashToStr(*input.sighash_type));
         }
 
+        // Block reference
+        if (input.m_block_reference) {
+            UniValue ref(UniValue::VOBJ);
+            ref.pushKV("height", input.m_block_reference->first);
+            ref.pushKV("hash", input.m_block_reference->second.GetHex());
+            in.pushKV("block_reference", std::move(ref));
+        }
+
         // Redeem script and witness script
         if (!input.redeem_script.empty()) {
             UniValue r(UniValue::VOBJ);
@@ -1630,7 +1659,7 @@ static RPCMethod combinepsbt()
 
     std::optional<PartiallySignedTransaction> merged_psbt = CombinePSBTs(psbtxs);
     if (!merged_psbt) {
-        throw JSONRPCError(RPC_INVALID_PARAMETER, "PSBTs not compatible (different transactions)");
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "PSBTs not compatible (different transactions, versions, or conflicting block headers)");
     }
 
     DataStream ssTx{};
@@ -1928,6 +1957,9 @@ static RPCMethod joinpsbts()
             merged_psbt.AddOutput(output);
         }
         merged_psbt.MergeGlobalXPubs(psbt);
+        if (!merged_psbt.MergeBlockHeaders(psbt)) {
+            throw JSONRPCError(RPC_INVALID_PARAMETER, "PSBTs contain conflicting block headers at the same height");
+        }
         merged_psbt.m_proprietary.insert(psbt.m_proprietary.begin(), psbt.m_proprietary.end());
         merged_psbt.unknown.insert(psbt.unknown.begin(), psbt.unknown.end());
     }
@@ -2115,7 +2147,8 @@ RPCMethod descriptorprocesspsbt()
     // Check whether or not all of the inputs are now correctly signed
     bool complete = true;
     const std::optional<PrecomputedTransactionData> txdata_opt{PrecomputePSBTData(psbtx)};
-    const PrecomputedTransactionData txdata{*CHECK_NONFATAL(txdata_opt)};
+    if (!txdata_opt) throw JSONRPCPSBTError(common::PSBTError::INVALID_TX);
+    const PrecomputedTransactionData& txdata{*txdata_opt};
     for (unsigned int i = 0; i < psbtx.inputs.size(); ++i) {
         complete = complete && PSBTInputSignedAndVerified(psbtx, i, &txdata);
     }
diff --git a/src/script/descriptor.cpp b/src/script/descriptor.cpp
index e4c25377c37b..571199089f83 100644
--- a/src/script/descriptor.cpp
+++ b/src/script/descriptor.cpp
@@ -1515,6 +1515,8 @@ class WSHDescriptor final : public DescriptorImpl
 class TRDescriptor final : public DescriptorImpl
 {
     std::vector<int> m_depths;
+    //! Witness version of the output: 1 for tr(), 2 for tr2() (Taproot with block references)
+    const int m_witver;
 protected:
     std::vector<CScript> MakeScripts(const std::vector<CPubKey>& keys, std::span<const CScript> scripts, FlatSigningProvider& out) const override
     {
@@ -1530,7 +1532,7 @@ class TRDescriptor final : public DescriptorImpl
         builder.Finalize(xpk);
         WitnessV1Taproot output = builder.GetOutput();
         out.tr_trees[output] = builder;
-        return Vector(GetScriptForDestination(output));
+        return Vector(CScript() << CScript::EncodeOP_N(m_witver) << ToByteVector(output));
     }
     bool ToStringSubScriptHelper(const SigningProvider* arg, std::string& ret, const StringType type, const DescriptorCache* cache = nullptr) const override
     {
@@ -1568,9 +1570,10 @@ class TRDescriptor final : public DescriptorImpl
         return any_success;
     }
 public:
-    TRDescriptor(std::unique_ptr<PubkeyProvider> internal_key, std::vector<std::unique_ptr<DescriptorImpl>> descs, std::vector<int> depths) :
-        DescriptorImpl(Vector(std::move(internal_key)), std::move(descs), "tr"), m_depths(std::move(depths))
+    TRDescriptor(std::unique_ptr<PubkeyProvider> internal_key, std::vector<std::unique_ptr<DescriptorImpl>> descs, std::vector<int> depths, int witver = 1) :
+        DescriptorImpl(Vector(std::move(internal_key)), std::move(descs), witver == 2 ? "tr2" : "tr"), m_depths(std::move(depths)), m_witver(witver)
     {
+        assert(witver == 1 || witver == 2);
         assert(m_subdescriptor_args.size() == m_depths.size());
     }
     std::optional<OutputType> GetOutputType() const override { return OutputType::BECH32M; }
@@ -1580,12 +1583,13 @@ class TRDescriptor final : public DescriptorImpl
 
     std::optional<int64_t> MaxSatisfactionWeight(bool) const override {
         // FIXME: We assume keypath spend, which can lead to very large underestimations.
-        return 1 + 65;
+        // A witness v2 spend may carry a block reference annex.
+        return 1 + 65 + (m_witver == 2 ? 1 + BLOCK_REF_ANNEX_SIZE : 0);
     }
 
     std::optional<int64_t> MaxSatisfactionElems() const override {
         // FIXME: See above, we assume keypath spend.
-        return 1;
+        return m_witver == 2 ? 2 : 1;
     }
 
     std::unique_ptr<DescriptorImpl> Clone() const override
@@ -1593,7 +1597,7 @@ class TRDescriptor final : public DescriptorImpl
         std::vector<std::unique_ptr<DescriptorImpl>> subdescs;
         subdescs.reserve(m_subdescriptor_args.size());
         std::transform(m_subdescriptor_args.begin(), m_subdescriptor_args.end(), std::back_inserter(subdescs), [](const std::unique_ptr<DescriptorImpl>& d) { return d->Clone(); });
-        return std::make_unique<TRDescriptor>(m_pubkey_args.at(0)->Clone(), std::move(subdescs), m_depths);
+        return std::make_unique<TRDescriptor>(m_pubkey_args.at(0)->Clone(), std::move(subdescs), m_depths, m_witver);
     }
 };
 
@@ -2540,7 +2544,9 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
         error = "Can only have addr() at top level";
         return {};
     }
-    if (ctx == ParseScriptContext::TOP && Func("tr", expr)) {
+    // tr2() is tr() with a witness v2 output, which supports block references (see doc/block-reference.md)
+    const int tr_witver{ctx != ParseScriptContext::TOP ? 0 : Func("tr", expr) ? 1 : Func("tr2", expr) ? 2 : 0};
+    if (tr_witver) {
         auto arg = Expr(expr);
         auto internal_keys = ParsePubkey(key_exp_index, arg, ParseScriptContext::P2TR, out, error);
         if (internal_keys.empty()) {
@@ -2631,12 +2637,12 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
             for (auto& subs : subscripts) {
                 this_subs.emplace_back(std::move(subs.at(i)));
             }
-            ret.emplace_back(std::make_unique<TRDescriptor>(std::move(internal_keys.at(i)), std::move(this_subs), depths));
+            ret.emplace_back(std::make_unique<TRDescriptor>(std::move(internal_keys.at(i)), std::move(this_subs), depths, tr_witver));
         }
         return ret;
 
 
-    } else if (Func("tr", expr)) {
+    } else if (Func("tr", expr) || Func("tr2", expr)) {
         error = "Can only have tr at top level";
         return {};
     }
@@ -2865,7 +2871,7 @@ std::unique_ptr<DescriptorImpl> InferScript(const CScript& script, ParseScriptCo
             if (sub) return std::make_unique<WSHDescriptor>(std::move(sub));
         }
     }
-    if (txntype == TxoutType::WITNESS_V1_TAPROOT && ctx == ParseScriptContext::TOP) {
+    if ((txntype == TxoutType::WITNESS_V1_TAPROOT || txntype == TxoutType::WITNESS_V2_TAPROOT) && ctx == ParseScriptContext::TOP) {
         // Extract x-only pubkey from output.
         XOnlyPubKey pubkey;
         std::copy(data[0].begin(), data[0].end(), pubkey.begin());
@@ -2894,12 +2900,12 @@ std::unique_ptr<DescriptorImpl> InferScript(const CScript& script, ParseScriptCo
                 }
                 if (ok) {
                     auto key = InferXOnlyPubkey(tap.internal_key, ParseScriptContext::P2TR, provider);
-                    return std::make_unique<TRDescriptor>(std::move(key), std::move(subscripts), std::move(depths));
+                    return std::make_unique<TRDescriptor>(std::move(key), std::move(subscripts), std::move(depths), txntype == TxoutType::WITNESS_V2_TAPROOT ? 2 : 1);
                 }
             }
         }
         // If the above doesn't work, construct a rawtr() descriptor with just the encoded x-only pubkey.
-        if (pubkey.IsFullyValid()) {
+        if (txntype == TxoutType::WITNESS_V1_TAPROOT && pubkey.IsFullyValid()) {
             auto key = InferXOnlyPubkey(pubkey, ParseScriptContext::P2TR, provider);
             if (key) {
                 return std::make_unique<RawTRDescriptor>(std::move(key));
diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index 98b16eca6bcd..4a6148083ae9 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -5,6 +5,7 @@
 
 #include <script/interpreter.h>
 
+#include <crypto/common.h>
 #include <crypto/ripemd160.h>
 #include <crypto/sha1.h>
 #include <crypto/sha256.h>
@@ -21,6 +22,7 @@
 #include <compare>
 #include <cstring>
 #include <limits>
+#include <ranges>
 #include <stdexcept>
 
 typedef std::vector<unsigned char> valtype;
@@ -1426,9 +1428,9 @@ void PrecomputedTransactionData::Init(const T& txTo, std::vector<CTxOut>&& spent
     for (size_t inpos = 0; inpos < txTo.vin.size() && !(uses_bip143_segwit && uses_bip341_taproot); ++inpos) {
         if (!txTo.vin[inpos].scriptWitness.IsNull()) {
             if (m_spent_outputs_ready && m_spent_outputs[inpos].scriptPubKey.size() == 2 + WITNESS_V1_TAPROOT_SIZE &&
-                m_spent_outputs[inpos].scriptPubKey[0] == OP_1) {
-                // Treat every witness-bearing spend with 34-byte scriptPubKey that starts with OP_1 as a Taproot
-                // spend. This only works if spent_outputs was provided as well, but if it wasn't, actual validation
+                (m_spent_outputs[inpos].scriptPubKey[0] == OP_1 || m_spent_outputs[inpos].scriptPubKey[0] == OP_2)) {
+                // Treat every witness-bearing spend with 34-byte scriptPubKey that starts with OP_1 or OP_2 as a
+                // Taproot (v1 or v2) spend. This only works if spent_outputs was provided as well, but if it wasn't, actual validation
                 // will fail anyway. Note that this branch may trigger for scriptPubKeys that aren't actually segwit
                 // but in that case validation will fail as SCRIPT_ERR_WITNESS_UNEXPECTED anyway.
                 uses_bip341_taproot = true;
@@ -1489,9 +1491,30 @@ static bool HandleMissingData(MissingDataBehavior mdb)
     assert(!"Unknown MissingDataBehavior value");
 }
 
+bool ParseBlockReference(std::span<const unsigned char> annex, std::optional<int>& height)
+{
+    if (annex.size() < 2 || annex[1] != BLOCK_REF_ANNEX_TYPE) return true;
+    if (annex.size() < BLOCK_REF_ANNEX_SIZE) return false;
+    const uint32_t h{ReadLE32(annex.data() + 2)};
+    if (h > uint32_t{std::numeric_limits<int>::max()}) return false;
+    height = static_cast<int>(h);
+    return true;
+}
+
+std::vector<unsigned char> BlockReferenceAnnex(int height)
+{
+    std::vector<unsigned char> annex(BLOCK_REF_ANNEX_SIZE);
+    annex[0] = ANNEX_TAG;
+    annex[1] = BLOCK_REF_ANNEX_TYPE;
+    WriteLE32(annex.data() + 2, height);
+    return annex;
+}
+
 template<typename T>
 bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, const T& tx_to, uint32_t in_pos, uint8_t hash_type, SigVersion sigversion, const PrecomputedTransactionData& cache, MissingDataBehavior mdb)
 {
+    // ext_flag is a bitfield: bit 0 for the BIP342 tapscript extension, bit 1 for the block
+    // reference extension (witness v2). Extensions are appended in bit order.
     uint8_t ext_flag, key_version;
     switch (sigversion) {
     case SigVersion::TAPROOT:
@@ -1509,6 +1532,7 @@ bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, cons
     default:
         assert(false);
     }
+    if (execdata.m_block_ref_height) ext_flag |= 2;
     assert(in_pos < tx_to.vin.size());
     if (!(cache.m_bip341_taproot_ready && cache.m_spent_outputs_ready)) {
         return HandleMissingData(mdb);
@@ -1575,6 +1599,13 @@ bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, cons
         ss << execdata.m_codeseparator_pos;
     }
 
+    // Block reference extension: commit to the hash of the referenced block
+    if (execdata.m_block_ref_height) {
+        const auto it{std::ranges::find(cache.m_block_hashes, *execdata.m_block_ref_height, &std::pair<int, uint256>::first)};
+        if (it == cache.m_block_hashes.end()) return HandleMissingData(mdb);
+        ss << it->second;
+    }
+
     hash_out = ss.GetSHA256();
     return true;
 }
@@ -1954,15 +1985,20 @@ static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion,
         } else {
             return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WRONG_LENGTH);
         }
-    } else if (witversion == 1 && program.size() == WITNESS_V1_TAPROOT_SIZE && !is_p2sh) {
-        // BIP341 Taproot: 32-byte non-P2SH witness v1 program (which encodes a P2C-tweaked pubkey)
-        if (!(flags & SCRIPT_VERIFY_TAPROOT)) return set_success(serror);
+    } else if ((witversion == 1 || (witversion == 2 && (flags & SCRIPT_VERIFY_TAPROOT_V2))) && program.size() == WITNESS_V1_TAPROOT_SIZE && !is_p2sh) {
+        // BIP341 Taproot: 32-byte non-P2SH witness v1 program (which encodes a P2C-tweaked pubkey).
+        // Witness v2 programs of the same size follow the same rules (see below for the difference).
+        if (witversion == 1 && !(flags & SCRIPT_VERIFY_TAPROOT)) return set_success(serror);
         if (stack.size() == 0) return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WITNESS_EMPTY);
         if (stack.size() >= 2 && !stack.back().empty() && stack.back()[0] == ANNEX_TAG) {
             // Drop annex (this is non-standard; see IsWitnessStandard)
             const valtype& annex = SpanPopBack(stack);
             execdata.m_annex_hash = (HashWriter{} << annex).GetSHA256();
             execdata.m_annex_present = true;
+            // Witness v2: the annex may reference a block, which the signature message then commits to
+            if (witversion == 2 && !ParseBlockReference(annex, execdata.m_block_ref_height)) {
+                return set_error(serror, SCRIPT_ERR_BLOCK_REFERENCE);
+            }
         } else {
             execdata.m_annex_present = false;
         }
@@ -2200,6 +2236,7 @@ const std::map<std::string, script_verify_flag_name>& ScriptFlagNamesToEnum()
         FLAG_NAME(DISCOURAGE_UPGRADABLE_PUBKEYTYPE),
         FLAG_NAME(DISCOURAGE_OP_SUCCESS),
         FLAG_NAME(DISCOURAGE_UPGRADABLE_TAPROOT_VERSION),
+        FLAG_NAME(TAPROOT_V2),
     };
 #undef FLAG_NAME
     return g_names_to_enum;
diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index 47d9bfb09c90..ecd8ef266d5f 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -146,6 +146,10 @@ enum class script_verify_flag_name : uint8_t {
     // Making unknown public key versions (in BIP 342 scripts) non-standard
     SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_PUBKEYTYPE,
 
+    // Witness v2 Taproot validation (BIP341/342 rules, plus block references)
+    //
+    SCRIPT_VERIFY_TAPROOT_V2,
+
     // Constants to point to the highest flag in use. Add new flags above this line.
     //
     SCRIPT_VERIFY_END_MARKER
@@ -182,6 +186,11 @@ struct PrecomputedTransactionData
     //! Whether m_spent_outputs is initialized.
     bool m_spent_outputs_ready = false;
 
+    /** Block hashes (by height, sorted) that inputs of this transaction may commit to in their
+     *  signature message. This is chain context that is not derivable from the transaction, so it
+     *  is filled in by the caller (validation) rather than by Init(). */
+    std::vector<std::pair<int, uint256>> m_block_hashes;
+
     PrecomputedTransactionData() = default;
 
     /** Initialize this PrecomputedTransactionData with transaction data.
@@ -225,6 +234,9 @@ struct ScriptExecutionData
     //! Hash of the annex data.
     uint256 m_annex_hash;
 
+    //! Height of the block referenced by the annex (witness v2 block reference), if any.
+    std::optional<int> m_block_ref_height;
+
     //! Whether m_validation_weight_left is initialized.
     bool m_validation_weight_left_init = false;
     //! How much validation weight is left (decremented for every successful non-empty signature check).
@@ -238,6 +250,19 @@ struct ScriptExecutionData
 inline constexpr size_t WITNESS_V0_SCRIPTHASH_SIZE = 32;
 inline constexpr size_t WITNESS_V0_KEYHASH_SIZE = 20;
 inline constexpr size_t WITNESS_V1_TAPROOT_SIZE = 32;
+inline constexpr size_t WITNESS_V2_TAPROOT_SIZE = 32;
+
+/** Annex payload type byte for a block reference (see doc/block-reference.md). */
+inline constexpr uint8_t BLOCK_REF_ANNEX_TYPE = 0x01;
+/** Size of a block reference annex: annex tag, type byte, 4-byte little endian height. */
+inline constexpr size_t BLOCK_REF_ANNEX_SIZE = 6;
+
+/** Parse the block reference in an annex (including its leading ANNEX_TAG byte), if any.
+ *  Returns false if the annex is a malformed block reference; otherwise sets height when the
+ *  annex is a block reference and leaves it untouched when it is not. */
+bool ParseBlockReference(std::span<const unsigned char> annex, std::optional<int>& height);
+/** Build the annex (including the ANNEX_TAG byte) that references the block at the given height. */
+std::vector<unsigned char> BlockReferenceAnnex(int height);
 
 inline constexpr uint8_t TAPROOT_LEAF_MASK = 0xfe;
 inline constexpr uint8_t TAPROOT_LEAF_TAPSCRIPT = 0xc0;
diff --git a/src/script/script.cpp b/src/script/script.cpp
index 4097d13d2c4a..ab546da208a6 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -241,7 +241,7 @@ bool CScript::IsPayToWitnessScriptHash() const
 bool CScript::IsPayToTaproot() const
 {
     return (this->size() == 34 &&
-            (*this)[0] == OP_1 &&
+            ((*this)[0] == OP_1 || (*this)[0] == OP_2) &&
             (*this)[1] == 0x20);
 }
 
diff --git a/src/script/script_error.cpp b/src/script/script_error.cpp
index 7fa127420e65..463ac86af347 100644
--- a/src/script/script_error.cpp
+++ b/src/script/script_error.cpp
@@ -113,6 +113,8 @@ std::string ScriptErrorString(const ScriptError serror)
             return "OP_IF/NOTIF argument must be minimal in tapscript";
         case SCRIPT_ERR_TAPSCRIPT_EMPTY_PUBKEY:
             return "Empty public key in tapscript";
+        case SCRIPT_ERR_BLOCK_REFERENCE:
+            return "Malformed block reference in annex";
         case SCRIPT_ERR_OP_CODESEPARATOR:
             return "Using OP_CODESEPARATOR in non-witness script";
         case SCRIPT_ERR_SIG_FINDANDDELETE:
diff --git a/src/script/script_error.h b/src/script/script_error.h
index 60ab3e51bfe6..9ebd64455e14 100644
--- a/src/script/script_error.h
+++ b/src/script/script_error.h
@@ -79,6 +79,7 @@ typedef enum ScriptError_t
     SCRIPT_ERR_TAPSCRIPT_CHECKMULTISIG,
     SCRIPT_ERR_TAPSCRIPT_MINIMALIF,
     SCRIPT_ERR_TAPSCRIPT_EMPTY_PUBKEY,
+    SCRIPT_ERR_BLOCK_REFERENCE,
 
     /* Constant scriptCode */
     SCRIPT_ERR_OP_CODESEPARATOR,
diff --git a/src/script/sign.cpp b/src/script/sign.cpp
index efee5a35fe01..474cbdc214d4 100644
--- a/src/script/sign.cpp
+++ b/src/script/sign.cpp
@@ -87,7 +87,15 @@ std::optional<uint256> MutableTransactionSignatureCreator::ComputeSchnorrSignatu
 
     ScriptExecutionData execdata;
     execdata.m_annex_init = true;
-    execdata.m_annex_present = false; // Only support annex-less signing for now.
+    execdata.m_annex_present = false; // Only support annex-less signing, except for a block reference.
+    int witnessversion;
+    std::vector<unsigned char> witnessprogram;
+    if (m_options.block_reference && m_txdata->m_spent_outputs[nIn].scriptPubKey.IsWitnessProgram(witnessversion, witnessprogram) && witnessversion == 2) {
+        const auto annex{BlockReferenceAnnex(m_options.block_reference->first)};
+        execdata.m_annex_present = true;
+        execdata.m_annex_hash = (HashWriter{} << annex).GetSHA256();
+        execdata.m_block_ref_height = m_options.block_reference->first;
+    }
     if (sigversion == SigVersion::TAPSCRIPT) {
         execdata.m_codeseparator_pos_init = true;
         execdata.m_codeseparator_pos = 0xFFFFFFFF; // Only support non-OP_CODESEPARATOR BIP342 signing for now.
@@ -717,6 +725,7 @@ static bool SignStep(const SigningProvider& provider, const BaseSignatureCreator
         return false;
 
     case TxoutType::WITNESS_V1_TAPROOT:
+    case TxoutType::WITNESS_V2_TAPROOT:
         return SignTaproot(provider, creator, WitnessV1Taproot(XOnlyPubKey{vSolutions[0]}), sigdata, ret);
 
     case TxoutType::ANCHOR:
@@ -795,9 +804,12 @@ bool ProduceSignature(const SigningProvider& provider, const BaseSignatureCreato
         sigdata.scriptWitness.stack = result;
         sigdata.witness = true;
         result.clear();
-    } else if (whichType == TxoutType::WITNESS_V1_TAPROOT && !P2SH) {
+    } else if ((whichType == TxoutType::WITNESS_V1_TAPROOT || whichType == TxoutType::WITNESS_V2_TAPROOT) && !P2SH) {
         sigdata.witness = true;
         if (solved) {
+            if (whichType == TxoutType::WITNESS_V2_TAPROOT && creator.BlockReferenceHeight()) {
+                result.push_back(BlockReferenceAnnex(*creator.BlockReferenceHeight()));
+            }
             sigdata.scriptWitness.stack = std::move(result);
         }
         result.clear();
@@ -1045,6 +1057,7 @@ bool SignTransaction(CMutableTransaction& mtx, const SigningProvider* keystore,
     if (spent_outputs.size() == mtx.vin.size()) {
         txdata.Init(txConst, std::move(spent_outputs), true);
     }
+    if (options.block_reference) txdata.m_block_hashes.push_back(*options.block_reference);
 
     // Sign what we can:
     for (unsigned int i = 0; i < mtx.vin.size(); ++i) {
diff --git a/src/script/sign.h b/src/script/sign.h
index 107abb9e8492..b559a2b727ca 100644
--- a/src/script/sign.h
+++ b/src/script/sign.h
@@ -33,6 +33,9 @@ struct SignatureData;
 
 struct SignOptions {
     int sighash_type{SIGHASH_DEFAULT};
+    /** Height and hash of a block that every witness v2 input references (see doc/block-reference.md):
+     *  the annex is added to the witness and the signatures commit to the block hash. */
+    std::optional<std::pair<int, uint256>> block_reference{};
 };
 
 /** Interface for signature creators. */
@@ -40,6 +43,8 @@ class BaseSignatureCreator {
 public:
     virtual ~BaseSignatureCreator() = default;
     virtual const BaseSignatureChecker& Checker() const =0;
+    /** Height of the block that witness v2 inputs signed by this creator reference, if any. */
+    virtual std::optional<int> BlockReferenceHeight() const { return std::nullopt; }
 
     /** Create a singular (non-script) signature. */
     virtual bool CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& keyid, const CScript& scriptCode, SigVersion sigversion) const =0;
@@ -65,6 +70,7 @@ class MutableTransactionSignatureCreator : public BaseSignatureCreator
     MutableTransactionSignatureCreator(const CMutableTransaction& tx LIFETIMEBOUND, unsigned int input_idx, const CAmount& amount, const SignOptions& options);
     MutableTransactionSignatureCreator(const CMutableTransaction& tx LIFETIMEBOUND, unsigned int input_idx, const CAmount& amount, const PrecomputedTransactionData* txdata, const SignOptions& options);
     const BaseSignatureChecker& Checker() const override { return checker; }
+    std::optional<int> BlockReferenceHeight() const override { return m_options.block_reference ? std::optional{m_options.block_reference->first} : std::nullopt; }
     bool CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& keyid, const CScript& scriptCode, SigVersion sigversion) const override;
     bool CreateSchnorrSig(const SigningProvider& provider, std::vector<unsigned char>& sig, const XOnlyPubKey& pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion) const override;
     std::vector<uint8_t> CreateMuSig2Nonce(const SigningProvider& provider, const CPubKey& aggregate_pubkey, const CPubKey& script_pubkey, const CPubKey& part_pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion, const SignatureData& sigdata) const override;
diff --git a/src/script/solver.cpp b/src/script/solver.cpp
index e99f1f099c92..58dfbe88f49c 100644
--- a/src/script/solver.cpp
+++ b/src/script/solver.cpp
@@ -28,6 +28,7 @@ std::string GetTxnOutputType(TxoutType t)
     case TxoutType::WITNESS_V0_KEYHASH: return "witness_v0_keyhash";
     case TxoutType::WITNESS_V0_SCRIPTHASH: return "witness_v0_scripthash";
     case TxoutType::WITNESS_V1_TAPROOT: return "witness_v1_taproot";
+    case TxoutType::WITNESS_V2_TAPROOT: return "witness_v2_taproot";
     case TxoutType::WITNESS_UNKNOWN: return "witness_unknown";
     } // no default case, so the compiler can warn about missing cases
     assert(false);
@@ -166,6 +167,10 @@ TxoutType Solver(const CScript& scriptPubKey, std::vector<std::vector<unsigned c
             vSolutionsRet.push_back(std::move(witnessprogram));
             return TxoutType::WITNESS_V1_TAPROOT;
         }
+        if (witnessversion == 2 && witnessprogram.size() == WITNESS_V2_TAPROOT_SIZE) {
+            vSolutionsRet.push_back(std::move(witnessprogram));
+            return TxoutType::WITNESS_V2_TAPROOT;
+        }
         if (scriptPubKey.IsPayToAnchor()) {
             return TxoutType::ANCHOR;
         }
diff --git a/src/script/solver.h b/src/script/solver.h
index 07e7b728741c..743801a8a491 100644
--- a/src/script/solver.h
+++ b/src/script/solver.h
@@ -31,6 +31,7 @@ enum class TxoutType {
     WITNESS_V0_SCRIPTHASH,
     WITNESS_V0_KEYHASH,
     WITNESS_V1_TAPROOT,
+    WITNESS_V2_TAPROOT, //!< Witness v2 with 32-byte program: Taproot with block references
     WITNESS_UNKNOWN, //!< Only for Witness versions not already defined above
 };
 
diff --git a/src/test/descriptor_tests.cpp b/src/test/descriptor_tests.cpp
index 349695ac6bb8..8d6a79ea6dda 100644
--- a/src/test/descriptor_tests.cpp
+++ b/src/test/descriptor_tests.cpp
@@ -614,6 +614,8 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
     Check("wpkh(L4rK1yDtCWekvXuE6oXD9jCYfFNV2cWRpVuPLBcCU2z8TrisoyY1)", "wpkh(03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd)", "wpkh(03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd)", SIGNABLE, {{"00149a1c78a507689f6f54b847ad1cef1e614ee23f1e"}}, OutputType::BECH32, /*op_compat_desc_hash=*/uint256{"4a47b7f497721bf3fc48c69a5d22bc1f3617238649a8ba7cb96fbd92fec84a7e"});
     Check("sh(wpkh(L4rK1yDtCWekvXuE6oXD9jCYfFNV2cWRpVuPLBcCU2z8TrisoyY1))", "sh(wpkh(03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd))", "sh(wpkh(03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd))", SIGNABLE, {{"a91484ab21b1b2fd065d4504ff693d832434b6108d7b87"}}, OutputType::P2SH_SEGWIT, /*op_compat_desc_hash=*/uint256{"a13112753066b5c59473a87c5771b1694a10531944a60e0ab2d7ad66ecb65bcd"});
     Check("tr(L4rK1yDtCWekvXuE6oXD9jCYfFNV2cWRpVuPLBcCU2z8TrisoyY1)", "tr(a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd)", "tr(a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd)", SIGNABLE | XONLY_KEYS, {{"512077aab6e066f8a7419c5ab714c12c67d25007ed55a43cadcacb4d7a970a093f11"}}, OutputType::BECH32M, /*op_compat_desc_hash=*/uint256{"4290f3d017b270be53b91abc56d9d2f23a3ff361d5b1d39550ba011e6cae0da5"});
+    Check("tr2(L4rK1yDtCWekvXuE6oXD9jCYfFNV2cWRpVuPLBcCU2z8TrisoyY1)", "tr2(a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd)", "tr2(a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd)", SIGNABLE | XONLY_KEYS, {{"522077aab6e066f8a7419c5ab714c12c67d25007ed55a43cadcacb4d7a970a093f11"}}, OutputType::BECH32M);
+    CheckUnparsable("sh(tr2(L4rK1yDtCWekvXuE6oXD9jCYfFNV2cWRpVuPLBcCU2z8TrisoyY1))", "sh(tr2(a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd))", "Can only have tr at top level");
     CheckUnparsable("sh(wpkh(L4rK1yDtCWekvXuE6oXD9jCYfFNV2cWRpVuPLBcCU2z8TrisoyY2))", "sh(wpkh(03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5))", "wpkh(): Pubkey '03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5' is invalid"); // Invalid pubkey
     CheckUnparsable("pkh(deadbeef/1/2'/3/4']L4rK1yDtCWekvXuE6oXD9jCYfFNV2cWRpVuPLBcCU2z8TrisoyY1)", "pkh(deadbeef/1/2h/3/4h]03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd)", "pkh(): Key origin start '[ character expected but not found, got 'd' instead"); // Missing start bracket in key origin
     CheckUnparsable("pkh([deadbeef]/1/2'/3/4']L4rK1yDtCWekvXuE6oXD9jCYfFNV2cWRpVuPLBcCU2z8TrisoyY1)", "pkh([deadbeef]/1/2'/3/4']03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd)", "pkh(): Multiple ']' characters found for a single pubkey"); // Multiple end brackets in key origin
diff --git a/src/test/fuzz/script_flags.cpp b/src/test/fuzz/script_flags.cpp
index 3ab5880035cc..7801fc70711a 100644
--- a/src/test/fuzz/script_flags.cpp
+++ b/src/test/fuzz/script_flags.cpp
@@ -4,6 +4,7 @@
 
 #include <consensus/amount.h>
 #include <primitives/transaction.h>
+#include <hash.h>
 #include <script/interpreter.h>
 #include <serialize.h>
 #include <streams.h>
@@ -53,6 +54,15 @@ FUZZ_TARGET(script_flags)
         }
         PrecomputedTransactionData txdata;
         txdata.Init(tx, std::move(spent_outputs));
+        // Provide a hash for every referenced block (witness v2 block reference annex), so that
+        // signature checks, which assert on missing data, can run. The value is arbitrary.
+        for (const CTxIn& txin : tx.vin) {
+            const auto& stack{txin.scriptWitness.stack};
+            std::optional<int> height;
+            if (stack.size() >= 2 && !stack.back().empty() && stack.back()[0] == ANNEX_TAG && ParseBlockReference(stack.back(), height) && height) {
+                txdata.m_block_hashes.emplace_back(*height, (HashWriter{} << *height).GetSHA256());
+            }
+        }
 
         for (unsigned i = 0; i < tx.vin.size(); ++i) {
             const CTxOut& prevout = txdata.m_spent_outputs.at(i);
diff --git a/src/test/interfaces_tests.cpp b/src/test/interfaces_tests.cpp
index 584a5cef2f6c..10beea551308 100644
--- a/src/test/interfaces_tests.cpp
+++ b/src/test/interfaces_tests.cpp
@@ -26,6 +26,11 @@ BOOST_FIXTURE_TEST_CASE(findBlock, TestChain100Setup)
     BOOST_CHECK(chain->findBlock(active[10]->GetBlockHash(), FoundBlock().hash(hash)));
     BOOST_CHECK_EQUAL(hash, active[10]->GetBlockHash());
 
+    CBlockHeader header;
+    BOOST_CHECK(chain->findBlock(active[10]->GetBlockHash(), FoundBlock().header(header)));
+    BOOST_CHECK_EQUAL(header.GetHash(), active[10]->GetBlockHash());
+    BOOST_CHECK_EQUAL(header.hashPrevBlock, active[9]->GetBlockHash());
+
     int height = -1;
     BOOST_CHECK(chain->findBlock(active[20]->GetBlockHash(), FoundBlock().height(height)));
     BOOST_CHECK_EQUAL(height, active[20]->nHeight);
diff --git a/src/test/psbt_tests.cpp b/src/test/psbt_tests.cpp
index 8a7004d05e17..c5bbd10be52a 100644
--- a/src/test/psbt_tests.cpp
+++ b/src/test/psbt_tests.cpp
@@ -4,6 +4,7 @@
 
 #include <addresstype.h>
 #include <key.h>
+#include <primitives/block.h>
 #include <psbt.h>
 #include <script/descriptor.h>
 #include <script/script.h>
@@ -20,6 +21,45 @@
 
 BOOST_FIXTURE_TEST_SUITE(psbt_tests, BasicTestingSetup)
 
+BOOST_AUTO_TEST_CASE(block_headers)
+{
+    CMutableTransaction tx;
+    tx.vin.emplace_back();
+    tx.vout.emplace_back(1, CScript() << OP_TRUE);
+    CBlockHeader first;
+    first.nVersion = 1;
+    CBlockHeader second;
+    second.nVersion = 1;
+    second.hashPrevBlock = first.GetHash();
+
+    for (const uint32_t version : {0, 2}) {
+        PartiallySignedTransaction psbt{tx, version};
+        psbt.m_block_headers.emplace(100, first);
+        DataStream stream;
+        stream << psbt;
+        auto decoded = DecodeRawPSBT(stream);
+        BOOST_REQUIRE(decoded);
+        BOOST_REQUIRE_EQUAL(decoded->m_block_headers.size(), 1);
+        BOOST_CHECK(decoded->m_block_headers.at(100).GetHash() == first.GetHash());
+
+        // Combining overlapping collections retains both headers, with no duplicate keys.
+        PartiallySignedTransaction other{tx, version};
+        other.m_block_headers.emplace(100, first);
+        other.m_block_headers.emplace(101, second);
+        BOOST_REQUIRE(decoded->Merge(other));
+        BOOST_CHECK_EQUAL(decoded->m_block_headers.size(), 2);
+        BOOST_CHECK(decoded->m_block_headers.at(101).hashPrevBlock == first.GetHash());
+
+        // Reject a conflict before inserting even the nonconflicting headers.
+        other.m_block_headers.emplace(99, first);
+        other.m_block_headers.at(101).nNonce++;
+        BOOST_CHECK(!decoded->Merge(other));
+        BOOST_CHECK_EQUAL(decoded->m_block_headers.size(), 2);
+        BOOST_CHECK(decoded->m_block_headers.at(101).GetHash() == second.GetHash());
+        BOOST_CHECK(!other.Merge(*decoded));
+    }
+}
+
 static PSBTProprietary MakeProprietary(uint64_t subtype, uint8_t key_data, uint8_t value)
 {
     return PSBTProprietary{
diff --git a/src/test/script_standard_tests.cpp b/src/test/script_standard_tests.cpp
index 90b2a9856ec9..9b9227578d89 100644
--- a/src/test/script_standard_tests.cpp
+++ b/src/test/script_standard_tests.cpp
@@ -122,6 +122,13 @@ BOOST_AUTO_TEST_CASE(script_standard_Solver_success)
     BOOST_CHECK_EQUAL(solutions.size(), 1U);
     BOOST_CHECK(solutions[0] == ToByteVector(uint256::ZERO));
 
+    // TxoutType::WITNESS_V2_TAPROOT
+    s.clear();
+    s << OP_2 << ToByteVector(uint256::ZERO);
+    BOOST_CHECK_EQUAL(Solver(s, solutions), TxoutType::WITNESS_V2_TAPROOT);
+    BOOST_CHECK_EQUAL(solutions.size(), 1U);
+    BOOST_CHECK(solutions[0] == ToByteVector(uint256::ZERO));
+
     // TxoutType::WITNESS_UNKNOWN
     s.clear();
     s << OP_16 << ToByteVector(uint256::ONE);
diff --git a/src/test/script_tests.cpp b/src/test/script_tests.cpp
index e6e0744fffe2..1da1f29e123f 100644
--- a/src/test/script_tests.cpp
+++ b/src/test/script_tests.cpp
@@ -5,6 +5,8 @@
 #include <common/system.h>
 #include <compressor.h>
 #include <core_io.h>
+#include <coins.h>
+#include <policy/policy.h>
 #include <key.h>
 #include <rpc/util.h>
 #include <script/interpreter.h>
@@ -92,6 +94,7 @@ static ScriptErrorDesc script_errors[]={
     {SCRIPT_ERR_WITNESS_UNEXPECTED, "WITNESS_UNEXPECTED"},
     {SCRIPT_ERR_WITNESS_PUBKEYTYPE, "WITNESS_PUBKEYTYPE"},
     {SCRIPT_ERR_TAPSCRIPT_EMPTY_PUBKEY, "TAPSCRIPT_EMPTY_PUBKEY"},
+    {SCRIPT_ERR_BLOCK_REFERENCE, "BLOCK_REFERENCE"},
     {SCRIPT_ERR_OP_CODESEPARATOR, "OP_CODESEPARATOR"},
     {SCRIPT_ERR_SIG_FINDANDDELETE, "SIG_FINDANDDELETE"},
     {SCRIPT_ERR_SCRIPTNUM, "SCRIPTNUM"}
@@ -1423,6 +1426,45 @@ BOOST_AUTO_TEST_CASE(sign_paytoanchor)
     BOOST_CHECK(SignSignature(keystore, CTransaction(prev), curr, 0, SIGHASH_ALL, sig_data));
 }
 
+/* Signing a witness v2 spend with a block reference adds the annex and commits to the block hash. */
+BOOST_AUTO_TEST_CASE(sign_block_reference)
+{
+    CKey key;
+    key.MakeNewKey(true);
+    FlatSigningProvider keystore;
+    keystore.keys.emplace(key.GetPubKey().GetID(), key);
+    TaprootBuilder builder;
+    builder.Finalize(XOnlyPubKey{key.GetPubKey()});
+    keystore.tr_trees[builder.GetOutput()] = builder;
+    const CScript spk{CScript() << OP_2 << ToByteVector(builder.GetOutput())};
+
+    CMutableTransaction prev, curr;
+    prev.vout.emplace_back(1, spk);
+    curr.vin.emplace_back(COutPoint{prev.GetHash(), 0});
+    curr.vout.emplace_back(1, CScript{});
+    const std::map<COutPoint, Coin> coins{{curr.vin[0].prevout, Coin(prev.vout[0], 1, false)}};
+    const int height{1000};
+    std::map<int, bilingual_str> errors;
+
+    BOOST_CHECK(SignTransaction(curr, &keystore, coins, {.block_reference = {{height, uint256::ONE}}}, errors));
+    BOOST_CHECK_EQUAL(curr.vin[0].scriptWitness.stack.size(), 2U);
+    BOOST_CHECK(curr.vin[0].scriptWitness.stack[1] == BlockReferenceAnnex(height));
+
+    // The signature only verifies with the referenced block's hash.
+    for (const uint256& block_hash : {uint256::ONE, uint256::ZERO}) {
+        PrecomputedTransactionData txdata;
+        txdata.Init(curr, {prev.vout[0]});
+        txdata.m_block_hashes.emplace_back(height, block_hash);
+        const MutableTransactionSignatureChecker checker{&curr, 0, 1, txdata, MissingDataBehavior::FAIL};
+        BOOST_CHECK_EQUAL(VerifyScript(CScript{}, spk, &curr.vin[0].scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, checker, nullptr), block_hash == uint256::ONE);
+    }
+
+    // Without the option, a v2 spend is signed without an annex.
+    curr.vin[0].scriptWitness.SetNull();
+    BOOST_CHECK(SignTransaction(curr, &keystore, coins, {}, errors));
+    BOOST_CHECK_EQUAL(curr.vin[0].scriptWitness.stack.size(), 1U);
+}
+
 BOOST_AUTO_TEST_CASE(script_standard_push)
 {
     ScriptError err;
diff --git a/src/test/transaction_tests.cpp b/src/test/transaction_tests.cpp
index 0e29024bab42..5517173ef766 100644
--- a/src/test/transaction_tests.cpp
+++ b/src/test/transaction_tests.cpp
@@ -1376,7 +1376,7 @@ BOOST_AUTO_TEST_CASE(spends_witness_prog)
     const auto program{ToByteVector(XOnlyPubKey{pubkey})};
     for (int i{2}; i <= 16; ++i) {
         tx_create.vout[0].scriptPubKey = GetScriptForDestination(WitnessUnknown{i, program});
-        BOOST_CHECK_EQUAL(Solver(tx_create.vout[0].scriptPubKey, sol_dummy), TxoutType::WITNESS_UNKNOWN);
+        BOOST_CHECK_EQUAL(Solver(tx_create.vout[0].scriptPubKey, sol_dummy), i == 2 ? TxoutType::WITNESS_V2_TAPROOT : TxoutType::WITNESS_UNKNOWN);
         tx_spend.vin[0].prevout.hash = tx_create.GetHash();
         AddCoins(coins, CTransaction{tx_create}, 0, false);
         BOOST_CHECK(::SpendsNonAnchorWitnessProg(CTransaction{tx_spend}, coins));
diff --git a/src/test/txvalidationcache_tests.cpp b/src/test/txvalidationcache_tests.cpp
index 1995c10ed349..634aae3066b3 100644
--- a/src/test/txvalidationcache_tests.cpp
+++ b/src/test/txvalidationcache_tests.cpp
@@ -152,6 +152,11 @@ static void ValidateCheckInputsForAllFlags(const CTransaction &tx, script_verify
             std::vector<CScriptCheck> scriptchecks;
             BOOST_CHECK(CheckInputScripts(tx, state, &active_coins_tip, test_flags, true, add_to_cache, txdata, validation_cache, &scriptchecks));
             BOOST_CHECK(scriptchecks.empty());
+            // ... but not if the inputs reference a different set of block hashes
+            PrecomputedTransactionData txdata_block_ref;
+            txdata_block_ref.m_block_hashes.emplace_back(0, uint256::ONE);
+            BOOST_CHECK(CheckInputScripts(tx, state, &active_coins_tip, test_flags, true, add_to_cache, txdata_block_ref, validation_cache, &scriptchecks));
+            BOOST_CHECK_EQUAL(scriptchecks.size(), tx.vin.size());
         } else {
             // Check that we get script executions to check, if the transaction
             // was invalid, or we didn't add to cache.
diff --git a/src/txmempool.cpp b/src/txmempool.cpp
index ed758a3ceb80..64f6e4ce1798 100644
--- a/src/txmempool.cpp
+++ b/src/txmempool.cpp
@@ -1050,7 +1050,7 @@ util::Result<std::pair<std::vector<FeeFrac>, std::vector<FeeFrac>>> CTxMemPool::
     return m_pool->m_txgraph->GetMainStagingDiagrams();
 }
 
-CTxMemPool::ChangeSet::TxHandle CTxMemPool::ChangeSet::StageAddition(const CTransactionRef& tx, const CAmount fee, int64_t time, unsigned int entry_height, uint64_t entry_sequence, bool spends_coinbase, int64_t sigops_cost, LockPoints lp)
+CTxMemPool::ChangeSet::TxHandle CTxMemPool::ChangeSet::StageAddition(const CTransactionRef& tx, const CAmount fee, int64_t time, unsigned int entry_height, uint64_t entry_sequence, bool spends_coinbase, int64_t sigops_cost, LockPoints lp, std::vector<const CBlockIndex*> block_refs)
 {
     LOCK(m_pool->cs);
     Assume(m_to_add.find(tx->GetHash()) == m_to_add.end());
@@ -1063,7 +1063,7 @@ CTxMemPool::ChangeSet::TxHandle CTxMemPool::ChangeSet::StageAddition(const CTran
     m_pool->ApplyDelta(tx->GetHash(), delta);
 
     FeePerWeight feerate(fee, GetSigOpsAdjustedWeight(GetTransactionWeight(*tx), sigops_cost, ::nBytesPerSigOp));
-    auto newit = m_to_add.emplace(tx, fee, time, entry_height, entry_sequence, spends_coinbase, sigops_cost, lp).first;
+    auto newit = m_to_add.emplace(tx, fee, time, entry_height, entry_sequence, spends_coinbase, sigops_cost, lp, std::move(block_refs)).first;
     m_pool->m_txgraph->AddTransaction(const_cast<CTxMemPoolEntry&>(*newit), feerate);
     if (delta) {
         newit->UpdateModifiedFee(delta);
diff --git a/src/txmempool.h b/src/txmempool.h
index 7d7aafde7818..3d9a8e022140 100644
--- a/src/txmempool.h
+++ b/src/txmempool.h
@@ -657,7 +657,7 @@ class CTxMemPool
 
         using TxHandle = CTxMemPool::txiter;
 
-        TxHandle StageAddition(const CTransactionRef& tx, CAmount fee, int64_t time, unsigned int entry_height, uint64_t entry_sequence, bool spends_coinbase, int64_t sigops_cost, LockPoints lp);
+        TxHandle StageAddition(const CTransactionRef& tx, CAmount fee, int64_t time, unsigned int entry_height, uint64_t entry_sequence, bool spends_coinbase, int64_t sigops_cost, LockPoints lp, std::vector<const CBlockIndex*> block_refs = {});
 
         void StageRemoval(CTxMemPool::txiter it);
 
diff --git a/src/validation.cpp b/src/validation.cpp
index c85a3af7303f..f00ef90e288c 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -252,6 +252,43 @@ std::optional<LockPoints> CalculateLockPointsAtTip(
     return LockPoints{min_height, min_time, Assert(tip->GetAncestor(max_input_height))};
 }
 
+/**
+ * Check that the blocks referenced by tx's inputs (see doc/block-reference.md) are at least
+ * COINBASE_MATURITY blocks before spend_height, and record their hashes in txdata so that
+ * signature verification can commit to them.
+ *
+ * @param[in] tip           The block preceding the one the transaction is (to be) included in.
+ * @param[in] spend_height  Height of the block the transaction is (to be) included in.
+ * @param[in] min_height    Lowest height that may be referenced (the activation height of witness v2).
+ * @param[out] block_refs   If given, the referenced blocks (for the mempool entry, see BlockReferencesValid()).
+ */
+static bool CheckBlockReferences(const CTransaction& tx, const CCoinsViewCache& inputs, const CBlockIndex& tip, int spend_height, int min_height, PrecomputedTransactionData& txdata, TxValidationState& state, std::vector<const CBlockIndex*>* block_refs = nullptr)
+{
+    assert(txdata.m_block_hashes.empty());
+    for (const int height : Consensus::GetBlockReferences(tx, inputs)) {
+        if (height < min_height) {
+            return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-txns-block-reference-before-activation",
+                                 strprintf("references block at height %d, before activation at %d", height, min_height));
+        }
+        if (int64_t{height} + COINBASE_MATURITY > spend_height) {
+            return state.Invalid(TxValidationResult::TX_PREMATURE_SPEND, "bad-txns-block-reference-immature",
+                                 strprintf("references block at height %d, at depth %d", height, spend_height - height));
+        }
+        const CBlockIndex* ref{Assert(tip.GetAncestor(height))};
+        txdata.m_block_hashes.emplace_back(height, ref->GetBlockHash());
+        if (block_refs) block_refs->push_back(ref);
+    }
+    return true;
+}
+
+/** Whether the blocks referenced by a mempool transaction are still in the chain and mature for the next block. */
+static bool BlockReferencesValid(const CChain& chain, const std::vector<const CBlockIndex*>& block_refs)
+{
+    return std::ranges::all_of(block_refs, [&](const CBlockIndex* ref) {
+        return chain.Contains(*ref) && ref->nHeight + COINBASE_MATURITY <= chain.Height() + 1;
+    });
+}
+
 bool CheckSequenceLocksAtTip(CBlockIndex* tip,
                              const LockPoints& lock_points)
 {
@@ -341,8 +378,8 @@ void Chainstate::MaybeUpdateMempoolForReorg(
     m_mempool->UpdateTransactionsFromBlock(vHashUpdate);
 
     // Predicate to use for filtering transactions in removeForReorg.
-    // Checks whether the transaction is still final and, if it spends a coinbase output, mature.
-    // Also updates valid entries' cached LockPoints if needed.
+    // Checks whether the transaction is still final and, if it spends a coinbase output or references
+    // a block, mature. Also updates valid entries' cached LockPoints if needed.
     // If false, the tx is still valid and its lockpoints are updated.
     // If true, the tx would be invalid in the next block; remove this entry and all of its descendants.
     // Note that TRUC rules are not applied here, so reorgs may cause violations of TRUC inheritance or
@@ -356,6 +393,10 @@ void Chainstate::MaybeUpdateMempoolForReorg(
         // The transaction must be final.
         if (!CheckFinalTxAtTip(*Assert(m_chain.Tip()), tx)) return true;
 
+        // Referenced blocks must still be in the chain (a reorg of at least COINBASE_MATURITY blocks,
+        // after which the signatures no longer verify) and mature (a reorg to a shorter chain).
+        if (!BlockReferencesValid(m_chain, it->GetBlockReferences())) return true;
+
         const LockPoints& lp = it->GetLockPoints();
         // CheckSequenceLocksAtTip checks if the transaction will be final in the next block to be
         // created on top of the new chain.
@@ -890,6 +931,13 @@ bool MemPoolAccept::PreChecks(ATMPArgs& args, Workspace& ws)
         return false; // state filled in by CheckTxInputs
     }
 
+    // Likewise, referenced blocks must be mature for the next block. This is checked regardless of
+    // activation, as the standard script flags always apply the witness v2 rules (and need the hashes).
+    std::vector<const CBlockIndex*> block_refs;
+    if (!CheckBlockReferences(tx, m_view, *m_active_chainstate.m_chain.Tip(), m_active_chainstate.m_chain.Height() + 1, m_active_chainstate.m_chainman.GetConsensus().TaprootV2Height, ws.m_precomputed_txdata, state, &block_refs)) {
+        return false; // state filled in by CheckBlockReferences
+    }
+
     if (m_pool.m_opts.require_standard) {
         state = ValidateInputsStandardness(tx, m_view);
         if (state.IsInvalid()) {
@@ -921,7 +969,7 @@ bool MemPoolAccept::PreChecks(ATMPArgs& args, Workspace& ws)
     if (!m_subpackage.m_changeset) {
         m_subpackage.m_changeset = m_pool.GetChangeSet();
     }
-    ws.m_tx_handle = m_subpackage.m_changeset->StageAddition(ptx, ws.m_base_fees, nAcceptTime, m_active_chainstate.m_chain.Height(), entry_sequence, fSpendsCoinbase, nSigOpsCost, lock_points.value());
+    ws.m_tx_handle = m_subpackage.m_changeset->StageAddition(ptx, ws.m_base_fees, nAcceptTime, m_active_chainstate.m_chain.Height(), entry_sequence, fSpendsCoinbase, nSigOpsCost, lock_points.value(), std::move(block_refs));
 
     // ws.m_modified_fees includes any fee deltas from PrioritiseTransaction
     ws.m_modified_fees = ws.m_tx_handle->GetModifiedFee();
@@ -2076,7 +2124,13 @@ bool CheckInputScripts(const CTransaction& tx, TxValidationState& state,
     // transaction).
     uint256 hashCacheEntry;
     CSHA256 hasher = validation_cache.ScriptExecutionCacheHasher();
-    hasher.Write(UCharCast(tx.GetWitnessHash().begin()), 32).Write((unsigned char*)&flags, sizeof(flags)).Finalize(hashCacheEntry.begin());
+    hasher.Write(UCharCast(tx.GetWitnessHash().begin()), 32).Write((unsigned char*)&flags, sizeof(flags));
+    // Block hashes referenced by the inputs are part of the signature message but not of the wtxid,
+    // so a script execution result is only reusable for the same referenced blocks.
+    for (const auto& [height, block_hash] : txdata.m_block_hashes) {
+        hasher.Write(block_hash.begin(), 32);
+    }
+    hasher.Finalize(hashCacheEntry.begin());
     AssertLockHeld(cs_main); //TODO: Remove this requirement by making CuckooCache not require external locks
     if (validation_cache.m_script_execution_cache.contains(hashCacheEntry, !cacheFullScriptStore)) {
         return true;
@@ -2284,6 +2338,11 @@ script_verify_flags GetBlockScriptFlags(const CBlockIndex& block_index, const Ch
         flags |= SCRIPT_VERIFY_NULLDUMMY;
     }
 
+    // Enforce witness v2 Taproot (with block references)
+    if (DeploymentActiveAt(block_index, chainman, Consensus::DEPLOYMENT_TAPROOT_V2)) {
+        flags |= SCRIPT_VERIFY_TAPROOT_V2;
+    }
+
     return flags;
 }
 
@@ -2557,6 +2616,16 @@ bool Chainstate::ConnectBlock(const CBlock& block, BlockValidationState& state,
                               "contains a non-BIP68-final transaction " + tx.GetHash().ToString());
                 break;
             }
+
+            // Check that referenced blocks are mature, and look up their hashes for the script checks below.
+            // Like BIP68 this must be in ConnectBlock, as it depends on the UTXO set (to identify v2 spends).
+            // Before activation a witness v2 spend is anyone-can-spend and its annex has no meaning.
+            if ((flags & SCRIPT_VERIFY_TAPROOT_V2) && !CheckBlockReferences(tx, view, *pindex, pindex->nHeight, m_chainman.GetConsensus().TaprootV2Height, txsdata[i], tx_state)) {
+                state.Invalid(BlockValidationResult::BLOCK_CONSENSUS,
+                              tx_state.GetRejectReason(),
+                              tx_state.GetDebugMessage() + " in transaction " + tx.GetHash().ToString());
+                break;
+            }
         }
 
         // GetTransactionSigOpCost counts 3 types of sigops:
@@ -3594,6 +3663,9 @@ bool Chainstate::InvalidateBlock(BlockValidationState& state, CBlockIndex* const
         // transactions back to the mempool if disconnecting was successful,
         // and we're not doing a very deep invalidation (in which case
         // keeping the mempool up to date is probably futile anyway).
+        // Note that this limit is specific to invalidateblock; a normal reorg
+        // re-adds all disconnected transactions through AcceptToMemoryPool,
+        // which re-validates them (block references included) against the new tip.
         MaybeUpdateMempoolForReorg(disconnectpool, /* fAddToMempool = */ (++disconnected <= 10) && ret);
         if (!ret) return false;
         CBlockIndex* new_tip{m_chain.Tip()};
diff --git a/src/wallet/rpc/spend.cpp b/src/wallet/rpc/spend.cpp
index 1cc5e0445cb2..58be27c0e9ce 100644
--- a/src/wallet/rpc/spend.cpp
+++ b/src/wallet/rpc/spend.cpp
@@ -3,12 +3,16 @@
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <common/messages.h>
+#include <consensus/consensus.h>
 #include <consensus/validation.h>
 #include <core_io.h>
+#include <interfaces/chain.h>
 #include <key_io.h>
 #include <node/types.h>
 #include <policy/policy.h>
+#include <script/solver.h>
 #include <policy/truc_policy.h>
+#include <primitives/block.h>
 #include <rpc/rawtransaction_util.h>
 #include <rpc/util.h>
 #include <script/script.h>
@@ -93,6 +97,55 @@ std::set<int> InterpretSubtractFeeFromOutputInstructions(const UniValue& sffo_in
     return sffo_set;
 }
 
+/** Make every witness v2 input of the PSBT reference the most recent eligible block (see doc/block-reference.md). */
+static void SetBlockReferences(const CWallet& wallet, PartiallySignedTransaction& psbtx)
+{
+    LOCK(wallet.cs_wallet);
+    const int tip_height{wallet.GetLastBlockHeight()};
+    const int height{tip_height - (COINBASE_MATURITY - 1)};
+    if (height < 0) throw JSONRPCError(RPC_INVALID_PARAMETER, "Chain too short for a block reference");
+    const uint256 tip_hash{wallet.GetLastBlockHash()};
+    uint256 block_hash;
+    if (!wallet.chain().findAncestorByHeight(tip_hash, height, interfaces::FoundBlock().hash(block_hash))) {
+        throw JSONRPCError(RPC_INTERNAL_ERROR, "Unable to retrieve referenced block");
+    }
+    bool any{false};
+    for (PSBTInput& input : psbtx.inputs) {
+        CTxOut utxo;
+        std::vector<std::vector<unsigned char>> solutions;
+        if (input.GetUTXO(utxo) && Solver(utxo.scriptPubKey, solutions) == TxoutType::WITNESS_V2_TAPROOT) {
+            input.m_block_reference = {height, block_hash};
+            any = true;
+        }
+    }
+    // A transaction without any referencing input would be replayable, which is what the caller asked to avoid.
+    if (!any) throw JSONRPCError(RPC_INVALID_PARAMETER, "block_reference requires at least one witness v2 (tr2) input, but none was selected");
+
+    // An external signer can use a height locktime as the endpoint; it need not know our tip.
+    const auto locktime{psbtx.ComputeTimeLock()};
+    if (!locktime || *locktime == 0 || *locktime >= LOCKTIME_THRESHOLD ||
+        *locktime < uint32_t(height) || *locktime > uint32_t(tip_height)) return;
+
+    uint256 header_hash;
+    if (!wallet.chain().findAncestorByHeight(tip_hash, *locktime, interfaces::FoundBlock().hash(header_hash))) {
+        throw JSONRPCError(RPC_INTERNAL_ERROR, "Unable to retrieve locktime block");
+    }
+    // Follow the same tip's ancestors so the headers stay consistent with the reference during a reorg.
+    for (int h{int(*locktime)}; h >= height; --h) {
+        CBlockHeader header;
+        if (!wallet.chain().findBlock(header_hash, interfaces::FoundBlock().header(header))) {
+            throw JSONRPCError(RPC_INTERNAL_ERROR, "Unable to retrieve block reference headers");
+        }
+        psbtx.m_block_headers.emplace(h, header);
+        header_hash = header.hashPrevBlock;
+    }
+}
+
+static bool WantBlockReference(const UniValue& options)
+{
+    return options.exists("block_reference") && options["block_reference"].get_bool();
+}
+
 static UniValue FinishTransaction(const std::shared_ptr<CWallet> pwallet, const UniValue& options, CMutableTransaction& rawTx)
 {
     bool can_anti_fee_snipe = !options.exists("locktime");
@@ -115,6 +168,7 @@ static UniValue FinishTransaction(const std::shared_ptr<CWallet> pwallet, const
     // so external signers are not asked to sign more than once.
     bool complete;
     pwallet->FillPSBT(psbtx, {.sign = false, .bip32_derivs = true}, complete);
+    if (WantBlockReference(options)) SetBlockReferences(*pwallet, psbtx);
     const auto err{pwallet->FillPSBT(psbtx, {.sign = true, .bip32_derivs = false}, complete)};
     if (err) {
         throw JSONRPCPSBTError(*err);
@@ -491,6 +545,7 @@ CreatedTransactionResult FundTransaction(CWallet& wallet, const CMutableTransact
                     {"add_inputs", UniValueType(UniValue::VBOOL)},
                     {"include_unsafe", UniValueType(UniValue::VBOOL)},
                     {"add_to_wallet", UniValueType(UniValue::VBOOL)},
+                    {"block_reference", UniValueType(UniValue::VBOOL)},
                     {"changeAddress", UniValueType(UniValue::VSTR)},
                     {"change_address", UniValueType(UniValue::VSTR)},
                     {"changePosition", UniValueType(UniValue::VNUM)},
@@ -1203,6 +1258,7 @@ RPCMethod send()
                     {"minconf", RPCArg::Type::NUM, RPCArg::Default{0}, "If add_inputs is specified, require inputs with at least this many confirmations."},
                     {"maxconf", RPCArg::Type::NUM, RPCArg::Optional::OMITTED, "If add_inputs is specified, require inputs with at most this many confirmations."},
                     {"add_to_wallet", RPCArg::Type::BOOL, RPCArg::Default{true}, "When false, returns a serialized transaction which will not be added to the wallet or broadcast"},
+                    {"block_reference", RPCArg::Type::BOOL, RPCArg::Default{false}, "Reference the block at height tip-99 from every witness v2 (tr2) input, so that the transaction is only valid on this chain (see doc/block-reference.md)."},
                     {"change_address", RPCArg::Type::STR, RPCArg::DefaultHint{"automatic"}, "The bitcoin address to receive the change"},
                     {"change_position", RPCArg::Type::NUM, RPCArg::DefaultHint{"random"}, "The index of the change output"},
                     {"change_type", RPCArg::Type::STR, RPCArg::DefaultHint{"set by -changetype"}, "The output type to use. Only valid if change_address is not specified. Options are " + FormatAllOutputTypes() + "."},
@@ -1327,6 +1383,7 @@ RPCMethod sendall()
                 Cat<std::vector<RPCArg>>(
                     {
                         {"add_to_wallet", RPCArg::Type::BOOL, RPCArg::Default{true}, "When false, returns the serialized transaction without broadcasting or adding it to the wallet"},
+                        {"block_reference", RPCArg::Type::BOOL, RPCArg::Default{false}, "Reference the block at height tip-99 from every witness v2 (tr2) input, so that the transaction is only valid on this chain (see doc/block-reference.md)."},
                         {"fee_rate", RPCArg::Type::AMOUNT, RPCArg::DefaultHint{"not set, fall back to wallet fee estimation"}, "Specify a fee rate in " + CURRENCY_ATOM + "/vB.", RPCArgOptions{.also_positional = true}},
                         {"include_watching", RPCArg::Type::BOOL, RPCArg::Default{false}, "(DEPRECATED) No longer used"},
                         {"inputs", RPCArg::Type::ARR, RPCArg::Default{UniValue::VARR}, "Use exactly the specified inputs to build the transaction. Specifying inputs is incompatible with the send_max, minconf, and maxconf options.",
@@ -1712,6 +1769,7 @@ RPCMethod walletcreatefundedpsbt()
                                                           "Warning: the resulting transaction may become invalid if one of the unsafe inputs disappears.\n"
                                                           "If that happens, you will need to fund the transaction with different inputs and republish it."},
                             {"minconf", RPCArg::Type::NUM, RPCArg::Default{0}, "If add_inputs is specified, require inputs with at least this many confirmations."},
+                            {"block_reference", RPCArg::Type::BOOL, RPCArg::Default{false}, "Reference the block at height tip-99 from every witness v2 (tr2) input, so that the transaction is only valid on this chain (see doc/block-reference.md)."},
                             {"maxconf", RPCArg::Type::NUM, RPCArg::Optional::OMITTED, "If add_inputs is specified, require inputs with at most this many confirmations."},
                             {"changeAddress", RPCArg::Type::STR, RPCArg::DefaultHint{"automatic"}, "The bitcoin address to receive the change"},
                             {"changePosition", RPCArg::Type::NUM, RPCArg::DefaultHint{"random"}, "The index of the change output"},
@@ -1802,6 +1860,7 @@ RPCMethod walletcreatefundedpsbt()
     if (err) {
         throw JSONRPCPSBTError(*err);
     }
+    if (!request.params[3].isNull() && WantBlockReference(request.params[3])) SetBlockReferences(wallet, psbtx);
 
     // Serialize the PSBT
     DataStream ssTx{};
diff --git a/src/wallet/scriptpubkeyman.cpp b/src/wallet/scriptpubkeyman.cpp
index 295bfa18afe7..d3ec654f9047 100644
--- a/src/wallet/scriptpubkeyman.cpp
+++ b/src/wallet/scriptpubkeyman.cpp
@@ -96,6 +96,7 @@ IsMineResult LegacyWalletIsMineInnerDONOTUSE(const LegacyDataSPKM& keystore, con
     case TxoutType::NULL_DATA:
     case TxoutType::WITNESS_UNKNOWN:
     case TxoutType::WITNESS_V1_TAPROOT:
+    case TxoutType::WITNESS_V2_TAPROOT:
     case TxoutType::ANCHOR:
         break;
     case TxoutType::PUBKEY:
diff --git a/src/wallet/spend.cpp b/src/wallet/spend.cpp
index cf5be440f732..3e0fd3179d2a 100644
--- a/src/wallet/spend.cpp
+++ b/src/wallet/spend.cpp
@@ -247,6 +247,7 @@ static OutputType GetOutputType(TxoutType type, bool is_from_p2sh)
 {
     switch (type) {
         case TxoutType::WITNESS_V1_TAPROOT:
+        case TxoutType::WITNESS_V2_TAPROOT:
             return OutputType::BECH32M;
         case TxoutType::WITNESS_V0_KEYHASH:
         case TxoutType::WITNESS_V0_SCRIPTHASH:
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index f81deca52bd3..d5e0b3de1a6c 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -1346,6 +1346,29 @@ bool CWallet::AbandonTransaction(CWalletTx& tx)
     return true;
 }
 
+void CWallet::AbandonBlockReferences(int height)
+{
+    AssertLockHeld(cs_wallet);
+    for (auto& [txid, wtx] : mapWallet) {
+        if (wtx.isConfirmed() || wtx.isAbandoned()) continue;
+        for (const CTxIn& txin : wtx.GetTx()->vin) {
+            const auto& stack{txin.scriptWitness.stack};
+            if (stack.size() < 2 || stack.back().empty() || stack.back()[0] != ANNEX_TAG) continue;
+            const auto parent{mapWallet.find(txin.prevout.hash)};
+            if (parent == mapWallet.end() || txin.prevout.n >= parent->second.GetTx()->vout.size()) continue;
+            int witnessversion;
+            std::vector<unsigned char> witnessprogram;
+            if (!parent->second.GetTx()->vout[txin.prevout.n].scriptPubKey.IsWitnessProgram(witnessversion, witnessprogram) || witnessversion != 2) continue;
+            std::optional<int> ref_height;
+            if (ParseBlockReference(stack.back(), ref_height) && ref_height == height) {
+                WalletLogPrintf("Abandoning %s: it references block %d, which was replaced by a reorg\n", txid.ToString(), height);
+                AbandonTransaction(wtx);
+                break;
+            }
+        }
+    }
+}
+
 void CWallet::MarkConflicted(const uint256& hashBlock, int conflicting_height, const Txid& hashTx)
 {
     LOCK(cs_wallet);
@@ -1556,6 +1579,12 @@ void CWallet::blockConnected(const ChainstateRole& role, const interfaces::Block
     // needed by MarkConflicted.
     SetLastBlockProcessedInMem(block.height, block.hash);
 
+    // A reorg that replaced a block invalidates transactions referencing it.
+    if (const auto it{m_disconnected_blocks.find(block.height)}; it != m_disconnected_blocks.end()) {
+        if (it->second != block.hash) AbandonBlockReferences(block.height);
+        m_disconnected_blocks.erase(it);
+    }
+
     // No need to scan block if it was created before the wallet birthday.
     // Uses chain max time and twice the grace period to adjust time for block time variability.
     if (block.chain_time_max < m_birth_time.load() - (TIMESTAMP_WINDOW * 2)) return;
@@ -1583,6 +1612,7 @@ void CWallet::blockDisconnected(const interfaces::BlockInfo& block)
     // User may have to call abandontransaction again. It may be addressed in the
     // future with a stickier abandoned state or even removing abandontransaction call.
     int disconnect_height = block.height;
+    m_disconnected_blocks[disconnect_height] = block.hash;
 
     for (size_t index = 0; index < block.data->vtx.size(); index++) {
         const CTransactionRef& ptx = block.data->vtx[index];
diff --git a/src/wallet/wallet.h b/src/wallet/wallet.h
index 61ba2dea2634..ddd4844e0363 100644
--- a/src/wallet/wallet.h
+++ b/src/wallet/wallet.h
@@ -448,6 +448,13 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     // Update last block processed in memory only
     void SetLastBlockProcessedInMem(int block_height, uint256 block_hash) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
 
+    /** Hashes of blocks disconnected by a reorg that has not (yet) reconnected a block at that height.
+     *  Used to notice when a block that wallet transactions reference is replaced. */
+    std::map<int, uint256> m_disconnected_blocks GUARDED_BY(cs_wallet);
+    /** Abandon unconfirmed transactions with a block reference (see doc/block-reference.md) to the given
+     *  height: their signatures no longer verify once that block is replaced. */
+    void AbandonBlockReferences(int height) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+
     //! Update mempool conflicts for TRUC sibling transactions
     void UpdateTrucSiblingConflicts(const CWalletTx& parent_wtx, const Txid& child_txid, bool add_conflict) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
 
diff --git a/test/functional/feature_block_reference.py b/test/functional/feature_block_reference.py
new file mode 100755
index 000000000000..570b3428a2c8
--- /dev/null
+++ b/test/functional/feature_block_reference.py
@@ -0,0 +1,341 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Test witness v2 Taproot outputs (BIP341/342 semantics plus block references).
+
+A witness v2 output is spent exactly like a v1 Taproot output. In addition, an
+input may carry an annex with a block reference; the signature message then
+commits to the hash of the referenced block (see doc/block-reference.md).
+"""
+
+from test_framework.blocktools import (
+    COINBASE_MATURITY,
+    add_witness_commitment,
+    create_block,
+    create_coinbase,
+)
+from test_framework.key import (
+    ECKey,
+    compute_xonly_pubkey,
+    sign_schnorr,
+    tweak_add_privkey,
+)
+from test_framework.messages import (
+    COutPoint,
+    CTransaction,
+    CTxIn,
+    CTxInWitness,
+    CTxOut,
+)
+from test_framework.p2p import P2PDataStore
+from test_framework.script import (
+    CScript,
+    OP_CHECKSIG,
+    TaprootSignatureHash,
+    block_ref_annex,
+    taproot_construct,
+)
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import (
+    assert_equal,
+    assert_raises_rpc_error,
+)
+from test_framework.wallet import MiniWallet
+
+FEE = 1000
+AMOUNT = 100_000
+
+
+class V2Coin:
+    """A witness v2 output funded from the MiniWallet, with everything needed to spend it."""
+
+    def __init__(self, test, node, amount=AMOUNT):
+        self.node = node
+        self.key = ECKey()
+        self.key.generate()
+        self.seckey = self.key.get_bytes()
+        self.pubkey = compute_xonly_pubkey(self.seckey)[0]
+        self.leaf_script = CScript([self.pubkey, OP_CHECKSIG])
+        self.tap = taproot_construct(self.pubkey, [("leaf", self.leaf_script)], witver=2)
+        self.amount = amount
+        funding = test.wallet.send_to(from_node=node, scriptPubKey=self.tap.scriptPubKey, amount=amount)
+        test.generate(node, 1)
+        self.outpoint = COutPoint(int(funding["txid"], 16), funding["sent_vout"])
+        self.utxo = CTxOut(amount, self.tap.scriptPubKey)
+
+    def spend(self, test, *, scriptpath=False, ref_height=None, block_hash=None, annex=None, fee=FEE):
+        """Build a transaction spending this coin back to the MiniWallet.
+
+        ref_height: put a block reference annex for this height in the witness.
+        block_hash: the hash committed to by the signature (defaults to the hash
+                    at ref_height on self.node); pass a different one to sign
+                    for another chain.
+        annex: raw annex to use instead of the block reference one.
+        """
+        tx = CTransaction()
+        tx.vin = [CTxIn(self.outpoint)]
+        tx.vout = [CTxOut(self.amount - fee, test.wallet.get_output_script())]
+        if ref_height is not None:
+            annex = block_ref_annex(ref_height)
+            if block_hash is None:
+                block_hash = bytes.fromhex(self.node.getblockhash(ref_height))[::-1]
+        if scriptpath:
+            leaf = self.tap.leaves["leaf"]
+            sighash = TaprootSignatureHash(tx, [self.utxo], 0, scriptpath=True, leaf_script=self.leaf_script, codeseparator_pos=0xFFFFFFFF, annex=annex, block_hash=block_hash)
+            control = bytes([leaf.version + self.tap.negflag]) + self.tap.internal_pubkey + leaf.merklebranch
+            stack = [sign_schnorr(self.seckey, sighash), self.leaf_script, control]
+        else:
+            sighash = TaprootSignatureHash(tx, [self.utxo], 0, annex=annex, block_hash=block_hash)
+            stack = [sign_schnorr(tweak_add_privkey(self.seckey, self.tap.tweak), sighash)]
+        if annex is not None:
+            stack.append(annex)
+        tx.wit.vtxinwit = [CTxInWitness()]
+        tx.wit.vtxinwit[0].scriptWitness.stack = stack
+        return tx
+
+
+class BlockReferenceTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.num_nodes = 2
+
+    def submit_block(self, node, txs, sync=True):
+        """Mine a block containing txs on top of node's tip; return submitblock's result (None if accepted)."""
+        height = node.getblockcount() + 1
+        block = create_block(int(node.getbestblockhash(), 16), create_coinbase(height), txlist=txs, ntime=node.getblock(node.getbestblockhash())["time"] + 1)
+        add_witness_commitment(block)
+        block.solve()
+        result = node.submitblock(block.serialize().hex())
+        if result is None and sync:
+            self.sync_blocks()
+        return result
+
+    def run_test(self):
+        self.wallet = MiniWallet(self.nodes[0])
+        self.test_v2_spends()
+        self.test_block_references()
+        self.test_block_references_mempool()
+        self.test_shallow_reorg()
+        self.test_unmature_by_reorg()
+        self.test_deep_reorg()
+        self.test_fork_split()
+        self.test_activation()
+
+    def test_v2_spends(self):
+        self.log.info("Witness v2 outputs spend like Taproot")
+        node = self.nodes[0]
+        for scriptpath in (False, True):
+            coin = V2Coin(self, node)
+            tx = coin.spend(self, scriptpath=scriptpath)
+            node.sendrawtransaction(tx.serialize().hex())
+            self.generate(node, 1)
+            assert_equal(node.gettxout(tx.txid_hex, 0)["confirmations"], 1)
+            # An annex without defined meaning is not standard, as for v1
+            unknown_annex = V2Coin(self, node).spend(self, scriptpath=scriptpath, annex=bytes([0x50, 0x02]))
+            assert_raises_rpc_error(-26, "bad-witness-nonstandard", node.sendrawtransaction, unknown_annex.serialize().hex())
+            assert_equal(self.submit_block(node, [unknown_annex]), None)
+            # An invalid signature is rejected (v2 is not anyone-can-spend)
+            bad = V2Coin(self, node).spend(self, scriptpath=scriptpath)
+            bad.wit.vtxinwit[0].scriptWitness.stack[0] = bytes(64)
+            assert_equal(self.submit_block(node, [bad]), "block-script-verify-flag-failed (Invalid Schnorr signature)")
+
+    def test_block_references(self):
+        self.log.info("Block references: maturity and signature commitment (block validation)")
+        node = self.nodes[0]
+        for scriptpath in (False, True):
+            # The referenced block must be COINBASE_MATURITY blocks before the block containing the spend
+            coin = V2Coin(self, node)
+            tip = node.getblockcount()
+            immature = coin.spend(self, scriptpath=scriptpath, ref_height=tip + 1 - COINBASE_MATURITY + 1)
+            assert_equal(self.submit_block(node, [immature]), "bad-txns-block-reference-immature")
+            coin = V2Coin(self, node)
+            tip = node.getblockcount()
+            tx = coin.spend(self, scriptpath=scriptpath, ref_height=tip + 1 - COINBASE_MATURITY)
+            # Signatures over the wrong block hash, or a malformed reference, are invalid
+            wrong = V2Coin(self, node).spend(self, scriptpath=scriptpath, ref_height=tip + 1 - COINBASE_MATURITY, block_hash=bytes(32))
+            assert_equal(self.submit_block(node, [wrong]), "block-script-verify-flag-failed (Invalid Schnorr signature)")
+            malformed = V2Coin(self, node).spend(self, scriptpath=scriptpath, annex=bytes([0x50, 0x01, 0x00]))
+            assert_equal(self.submit_block(node, [malformed]), "block-script-verify-flag-failed (Malformed block reference in annex)")
+            # Bytes after the height have no meaning
+            tip = node.getblockcount()
+            tail = V2Coin(self, node)
+            trailing = tail.spend(self, scriptpath=scriptpath, annex=block_ref_annex(tip + 1 - COINBASE_MATURITY) + b"data",
+                                  block_hash=bytes.fromhex(node.getblockhash(tip + 1 - COINBASE_MATURITY))[::-1])
+            assert_equal(self.submit_block(node, [tx, trailing]), None)
+            assert_equal(node.gettxout(tx.txid_hex, 0)["confirmations"], 1)
+            assert_equal(node.gettxout(trailing.txid_hex, 0)["confirmations"], 1)
+            # The rejected immature reference is fine one block later
+            assert_equal(self.submit_block(node, [immature]), None)
+
+    def test_block_references_mempool(self):
+        self.log.info("Block references: relay policy and mempool acceptance")
+        node = self.nodes[0]
+        peer = node.add_p2p_connection(P2PDataStore())
+        for scriptpath in (False, True):
+            coin = V2Coin(self, node)
+            tip = node.getblockcount()
+            ref_height = tip + 1 - COINBASE_MATURITY
+            # Immature: rejected, but not as a consensus failure
+            immature = coin.spend(self, scriptpath=scriptpath, ref_height=ref_height + 1)
+            assert_raises_rpc_error(-26, "bad-txns-block-reference-immature", node.sendrawtransaction, immature.serialize().hex())
+            # Signed for another chain: rejected, and the relaying peer is not punished
+            wrong = coin.spend(self, scriptpath=scriptpath, ref_height=ref_height, block_hash=bytes(32))
+            peer.send_txs_and_test([wrong], node, success=False, reject_reason="mempool-script-verify-flag-failed (Invalid Schnorr signature)")
+            # Only the bare 6-byte reference is standard
+            block_hash = bytes.fromhex(node.getblockhash(ref_height))[::-1]
+            trailing = coin.spend(self, scriptpath=scriptpath, annex=block_ref_annex(ref_height) + b"data", block_hash=block_hash)
+            assert_raises_rpc_error(-26, "bad-witness-nonstandard", node.sendrawtransaction, trailing.serialize().hex())
+            # A mature reference is standard and gets mined
+            tx = coin.spend(self, scriptpath=scriptpath, ref_height=ref_height)
+            node.sendrawtransaction(tx.serialize().hex())
+            self.generate(node, 1)
+            assert_equal(node.gettxout(tx.txid_hex, 0)["confirmations"], 1)
+
+        # An immature reference becomes acceptable one block later
+        coin = V2Coin(self, node)
+        tip = node.getblockcount()
+        immature = coin.spend(self, ref_height=tip + 1 - COINBASE_MATURITY + 1)
+        assert_raises_rpc_error(-26, "bad-txns-block-reference-immature", node.sendrawtransaction, immature.serialize().hex())
+        self.generate(node, 1)
+        node.sendrawtransaction(immature.serialize().hex())
+        assert immature.txid_hex in node.getrawmempool()
+
+    def test_shallow_reorg(self):
+        self.log.info("A reorg that keeps the referenced block puts the transaction back in the mempool")
+        node0, node1 = self.nodes
+        coin = V2Coin(self, node0)
+        self.sync_blocks()
+        tip = node0.getblockcount()
+        tx = coin.spend(self, ref_height=tip + 1 - COINBASE_MATURITY)
+        self.disconnect_nodes(0, 1)
+        node0.sendrawtransaction(tx.serialize().hex())
+        self.generate(node0, 1, sync_fun=self.no_op)
+        assert_equal(node0.gettxout(tx.txid_hex, 0)["confirmations"], 1)
+        self.generate(node1, 2, sync_fun=self.no_op)
+        self.connect_nodes(0, 1)
+        self.sync_blocks()
+        assert tx.txid_hex in node0.getrawmempool()
+        self.generate(node0, 1)
+        assert_equal(node0.gettxout(tx.txid_hex, 0)["confirmations"], 1)
+
+    def test_unmature_by_reorg(self):
+        self.log.info("A reorg to a shorter chain evicts a reference that is no longer mature")
+        node0, node1 = self.nodes
+        coin = V2Coin(self, node0)
+        self.sync_blocks()
+        tip = node0.getblockcount()
+        tx = coin.spend(self, ref_height=tip + 1 - COINBASE_MATURITY)
+        node0.sendrawtransaction(tx.serialize().hex())
+        assert tx.txid_hex in node0.getrawmempool()
+        tip_hash = node0.getblockhash(tip)
+        node0.invalidateblock(tip_hash)
+        assert tx.txid_hex not in node0.getrawmempool()
+        node0.reconsiderblock(tip_hash)
+        assert tx.txid_hex not in node0.getrawmempool()
+        node0.sendrawtransaction(tx.serialize().hex())
+        self.generate(node0, 1)
+        assert_equal(node0.gettxout(tx.txid_hex, 0)["confirmations"], 1)
+
+    def test_deep_reorg(self):
+        self.log.info("A reorg that replaces the referenced block invalidates the transaction")
+        node0, node1 = self.nodes
+        a1, a2, a3 = (V2Coin(self, node0) for _ in range(3))
+        self.sync_blocks()
+        split = node0.getblockcount()
+        self.disconnect_nodes(0, 1)
+        # Chain A: node0 mines COINBASE_MATURITY blocks, then a spend referencing the first post-split block,
+        # then holds another such spend in its mempool.
+        self.generate(node0, COINBASE_MATURITY, sync_fun=self.no_op)
+        hash_a = bytes.fromhex(node0.getblockhash(split + 1))[::-1]
+        tx_a1 = a1.spend(self, ref_height=split + 1)
+        node0.sendrawtransaction(tx_a1.serialize().hex())
+        self.generate(node0, 1, sync_fun=self.no_op)
+        assert_equal(node0.gettxout(tx_a1.txid_hex, 0)["confirmations"], 1)
+        tx_a2 = a2.spend(self, ref_height=split + 1)
+        node0.sendrawtransaction(tx_a2.serialize().hex())
+        # Chain B: node1 mines a longer chain.
+        self.generate(node1, COINBASE_MATURITY + 3, sync_fun=self.no_op)
+        self.connect_nodes(0, 1)
+        self.sync_blocks()
+        assert_equal(node0.getblockcount(), split + COINBASE_MATURITY + 3)
+        hash_b = bytes.fromhex(node0.getblockhash(split + 1))[::-1]
+        assert hash_a != hash_b
+        # Neither chain-A spend survives: the disconnected one is not re-added, the unconfirmed one is evicted.
+        assert tx_a1.txid_hex not in node0.getrawmempool()
+        assert tx_a2.txid_hex not in node0.getrawmempool()
+        # Re-submitting must re-verify the signature against chain B. Both spends were accepted to node0's
+        # mempool on chain A, which cached their script execution under the block validation flags; a block
+        # containing them must not be accepted from that cache (script execution cache regression).
+        for tx in (tx_a1, tx_a2):
+            assert_raises_rpc_error(-26, "mempool-script-verify-flag-failed (Invalid Schnorr signature)", node0.sendrawtransaction, tx.serialize().hex())
+            assert_raises_rpc_error(-26, "mempool-script-verify-flag-failed (Invalid Schnorr signature)", node1.sendrawtransaction, tx.serialize().hex())
+            assert_equal(self.submit_block(node0, [tx]), "block-script-verify-flag-failed (Invalid Schnorr signature)")
+        # A reference to the chain-B block works on both nodes.
+        tx_b = a3.spend(self, ref_height=split + 1)
+        node0.sendrawtransaction(tx_b.serialize().hex())
+        self.sync_mempools()
+        self.generate(node0, 1)
+        assert_equal(node1.gettxout(tx_b.txid_hex, 0)["confirmations"], 1)
+
+    def test_fork_split(self):
+        self.log.info("Splitting a coin across a fork: each side accepts only its own spend")
+        node0, node1 = self.nodes
+        coin = V2Coin(self, node0)
+        self.sync_blocks()
+        split = node0.getblockcount()
+        self.disconnect_nodes(0, 1)
+        self.generate(node0, COINBASE_MATURITY, sync_fun=self.no_op)
+        self.generate(node1, COINBASE_MATURITY, sync_fun=self.no_op)
+        # Spend the same coin on both sides, each referencing that side's first post-split block
+        # (different fees so that the txids differ).
+        coin.node = node0
+        tx_a = coin.spend(self, ref_height=split + 1)
+        coin.node = node1
+        tx_b = coin.spend(self, ref_height=split + 1, fee=FEE + 1)
+        assert_raises_rpc_error(-26, "mempool-script-verify-flag-failed (Invalid Schnorr signature)", node0.sendrawtransaction, tx_b.serialize().hex())
+        assert_raises_rpc_error(-26, "mempool-script-verify-flag-failed (Invalid Schnorr signature)", node1.sendrawtransaction, tx_a.serialize().hex())
+        node0.sendrawtransaction(tx_a.serialize().hex())
+        node1.sendrawtransaction(tx_b.serialize().hex())
+        self.generate(node0, 1, sync_fun=self.no_op)
+        self.generate(node1, 2, sync_fun=self.no_op)
+        # Side B wins; its spend is confirmed and side A's spend is gone
+        self.connect_nodes(0, 1)
+        self.sync_blocks()
+        assert_equal(node0.gettxout(tx_b.txid_hex, 0)["confirmations"], 2)
+        assert_equal(node0.gettxout(tx_a.txid_hex, 0), None)
+        assert tx_a.txid_hex not in node0.getrawmempool()
+
+    def test_activation(self):
+        self.log.info("Before activation v2 outputs are anyone-can-spend; after it, references below the activation height are invalid")
+        node0, node1 = self.nodes
+        coins = [V2Coin(self, node0) for _ in range(4)]
+        self.sync_blocks()
+        self.disconnect_nodes(0, 1)
+        activation = node1.getblockcount() + 3
+        self.restart_node(1, extra_args=["-testactivationheight=taproot_v2@%d" % activation])
+        for coin in coins:
+            coin.node = node1
+        # Before activation, an immature reference is not enforced in blocks (the annex has no meaning),
+        # while the mempool applies the rules as policy.
+        tip = node1.getblockcount()
+        immature = coins[0].spend(self, ref_height=tip + 1 - COINBASE_MATURITY + 1)
+        assert_raises_rpc_error(-26, "bad-txns-block-reference-before-activation", node1.sendrawtransaction, immature.serialize().hex())
+        assert_equal(self.submit_block(node1, [immature], sync=False), None)
+        node1.invalidateblock(node1.getbestblockhash())  # keep node1's chain valid for node0
+        # Activate, then mature the first post-activation block
+        self.generate(node1, activation + COINBASE_MATURITY - 1 - node1.getblockcount(), sync_fun=self.no_op)
+        assert_equal(node1.getdeploymentinfo()["deployments"]["taproot_v2"], {"type": "buried", "active": True, "height": activation})
+        before = coins[1].spend(self, ref_height=activation - 1)
+        assert_raises_rpc_error(-26, "bad-txns-block-reference-before-activation", node1.sendrawtransaction, before.serialize().hex())
+        assert_equal(self.submit_block(node1, [before], sync=False), "bad-txns-block-reference-before-activation")
+        tx = coins[2].spend(self, ref_height=activation)
+        node1.sendrawtransaction(tx.serialize().hex())
+        self.generate(node1, 1, sync_fun=self.no_op)
+        assert_equal(node1.gettxout(tx.txid_hex, 0)["confirmations"], 1)
+        # node0 (always active) accepts node1's chain
+        self.connect_nodes(0, 1)
+        self.sync_blocks()
+
+
+if __name__ == '__main__':
+    BlockReferenceTest(__file__).main()
diff --git a/test/functional/feature_taproot.py b/test/functional/feature_taproot.py
index 188d2011424b..b0e0c74ce2e2 100755
--- a/test/functional/feature_taproot.py
+++ b/test/functional/feature_taproot.py
@@ -848,7 +848,7 @@ def hashtype(_):
         add_spender(spenders, "siglen/invalid_cs_neg", tap=tap, key=secs[2], leaf="cs_neg", hashtype=hashtype, **SINGLE_SIG, sign=b"", failure={"sign": default_sign, "sighash": bitflipper(default_sighash)}, **ERR_SCHNORR_SIG)
         add_spender(spenders, "siglen/invalid_csa_neg", tap=tap, key=secs[2], leaf="csa_neg", hashtype=hashtype, **SINGLE_SIG, sign=b"", failure={"sign": default_sign, "sighash": bitflipper(default_sighash)}, **ERR_SCHNORR_SIG)
 
-    # == Test that BIP341 spending only applies to witness version 1, program length 32, no P2SH ==
+    # == Test that BIP341 spending only applies to witness version 1 (and 2, which shares its rules), program length 32, no P2SH ==
 
     for p2sh in [False, True]:
         for witver in range(1, 17):
@@ -863,7 +863,7 @@ def mutate(spk):
                     return CScript([CScriptOp.encode_op_n(witver), prog])
                 scripts = [("s0", CScript([pubs[0], OP_CHECKSIG])), ("dummy", CScript([OP_RETURN]))]
                 tap = taproot_construct(pubs[1], scripts)
-                if not p2sh and witver == 1 and witlen == 32:
+                if not p2sh and witver in (1, 2) and witlen == 32:
                     add_spender(spenders, "applic/keypath", p2sh=p2sh, spk_mutate_pre_p2sh=mutate, tap=tap, key=secs[1], **SIGHASH_BITFLIP, **ERR_SCHNORR_SIG)
                     add_spender(spenders, "applic/scriptpath", p2sh=p2sh, leaf="s0", spk_mutate_pre_p2sh=mutate, tap=tap, key=secs[0], **SINGLE_SIG, failure={"leaf": "dummy"}, **ERR_OP_RETURN)
                 else:
diff --git a/test/functional/p2p_segwit.py b/test/functional/p2p_segwit.py
index 41e6764fc09f..fe0b08b7bdc4 100755
--- a/test/functional/p2p_segwit.py
+++ b/test/functional/p2p_segwit.py
@@ -54,6 +54,7 @@
     OP_0,
     OP_1,
     OP_2,
+    OP_3,
     OP_16,
     OP_2DROP,
     OP_CHECKMULTISIG,
@@ -1349,8 +1350,8 @@ def test_segwit_versions(self):
         assert_equal(len(self.nodes[1].getrawmempool()), 0)
         for version in list(range(OP_1, OP_16 + 1)) + [OP_0]:
             # First try to spend to a future version segwit script_pubkey.
-            if version == OP_1:
-                # Don't use 32-byte v1 witness (used by Taproot; see BIP 341)
+            if version in (OP_1, OP_2):
+                # Don't use 32-byte v1/v2 witness (used by Taproot; see BIP 341)
                 script_pubkey = CScript([CScriptOp(version), witness_hash + b'\x00'])
             else:
                 script_pubkey = CScript([CScriptOp(version), witness_hash])
@@ -1364,9 +1365,9 @@ def test_segwit_versions(self):
         self.generate(self.nodes[0], 1)  # Mine all the transactions
         assert_equal(len(self.nodes[0].getrawmempool()), 0)
 
-        # Finally, verify that version 0 -> version 2 transactions
+        # Finally, verify that version 0 -> version 3 transactions
         # are standard
-        script_pubkey = CScript([CScriptOp(OP_2), witness_hash])
+        script_pubkey = CScript([CScriptOp(OP_3), witness_hash])
         tx2 = CTransaction()
         tx2.vin = [CTxIn(COutPoint(tx.txid_int, 0), b"")]
         tx2.vout = [CTxOut(tx.vout[0].nValue - 1000, script_pubkey)]
diff --git a/test/functional/rpc_blockchain.py b/test/functional/rpc_blockchain.py
index d731907fd8ca..979fda1e3fc7 100755
--- a/test/functional/rpc_blockchain.py
+++ b/test/functional/rpc_blockchain.py
@@ -216,13 +216,14 @@ def check_signalling_deploymentinfo_result(self, gdi_result, height, blockhash,
         assert_equal(gdi_result, {
           "hash": blockhash,
           "height": height,
-          "script_flags": ["CHECKLOCKTIMEVERIFY","CHECKSEQUENCEVERIFY","DERSIG","NULLDUMMY","P2SH","TAPROOT","WITNESS"],
+          "script_flags": ["CHECKLOCKTIMEVERIFY","CHECKSEQUENCEVERIFY","DERSIG","NULLDUMMY","P2SH","TAPROOT","TAPROOT_V2","WITNESS"],
           "deployments": {
             'bip34': {'type': 'buried', 'active': True, 'height': 2},
             'bip66': {'type': 'buried', 'active': True, 'height': 3},
             'bip65': {'type': 'buried', 'active': True, 'height': 4},
             'csv': {'type': 'buried', 'active': True, 'height': 5},
             'segwit': {'type': 'buried', 'active': True, 'height': 6},
+            'taproot_v2': {'type': 'buried', 'active': True, 'height': 0},
             'testdummy': {
                 'type': 'bip9',
                 'bip9': {
diff --git a/test/functional/rpc_psbt.py b/test/functional/rpc_psbt.py
index 8641417cfdc3..970399814f0c 100755
--- a/test/functional/rpc_psbt.py
+++ b/test/functional/rpc_psbt.py
@@ -1576,7 +1576,7 @@ def global_xpub_key(extended_pubkey):
         psbt1 = PSBT(g=PSBTMap({PSBT_GLOBAL_UNSIGNED_TX: tx.serialize()}), i=[PSBTMap()], o=[PSBTMap()]).to_base64()
         tx.vout[0].nValue += 1  # slightly modify tx
         psbt2 = PSBT(g=PSBTMap({PSBT_GLOBAL_UNSIGNED_TX: tx.serialize()}), i=[PSBTMap()], o=[PSBTMap()]).to_base64()
-        assert_raises_rpc_error(-8, "PSBTs not compatible (different transactions)", self.nodes[0].combinepsbt, [psbt1, psbt2])
+        assert_raises_rpc_error(-8, "PSBTs not compatible (different transactions, versions, or conflicting block headers)", self.nodes[0].combinepsbt, [psbt1, psbt2])
         assert_equal(self.nodes[0].combinepsbt([psbt1, psbt1]), psbt1)
 
         self.log.info("Test that PSBT inputs are being checked via script execution")
diff --git a/test/functional/test_framework/psbt.py b/test/functional/test_framework/psbt.py
index a025790f38ab..c1771f2a59bf 100644
--- a/test/functional/test_framework/psbt.py
+++ b/test/functional/test_framework/psbt.py
@@ -26,6 +26,7 @@
 PSBT_GLOBAL_INPUT_COUNT = 0x04
 PSBT_GLOBAL_OUTPUT_COUNT = 0x05
 PSBT_GLOBAL_TX_MODIFIABLE = 0x06
+PSBT_GLOBAL_BLOCK_HEADER = 0x7f
 PSBT_GLOBAL_VERSION = 0xfb
 PSBT_GLOBAL_PROPRIETARY = 0xfc
 
diff --git a/test/functional/test_framework/script.py b/test/functional/test_framework/script.py
index fb168928c3e8..880d4ae8afd3 100644
--- a/test/functional/test_framework/script.py
+++ b/test/functional/test_framework/script.py
@@ -28,6 +28,7 @@
 MAX_PUBKEYS_PER_MULTI_A = 999
 LOCKTIME_THRESHOLD = 500000000
 ANNEX_TAG = 0x50
+BLOCK_REF_ANNEX_TYPE = 0x01
 
 SEQUENCE_LOCKTIME_DISABLE_FLAG = (1<<31)
 SEQUENCE_LOCKTIME_TYPE_FLAG = (1<<22) # this means use time (0 means height)
@@ -814,7 +815,9 @@ def BIP341_sha_sequences(txTo):
 def BIP341_sha_outputs(txTo):
     return sha256(b"".join(o.serialize() for o in txTo.vout))
 
-def TaprootSignatureMsg(txTo, spent_utxos, hash_type, input_index=0, *, scriptpath=False, leaf_script=None, codeseparator_pos=-1, annex=None, leaf_ver=LEAF_VERSION_TAPSCRIPT):
+def TaprootSignatureMsg(txTo, spent_utxos, hash_type, input_index=0, *, scriptpath=False, leaf_script=None, codeseparator_pos=-1, annex=None, leaf_ver=LEAF_VERSION_TAPSCRIPT, block_hash=None):
+    """Compute the BIP341 signature message. If block_hash is given, the block reference
+    extension (witness v2, ext_flag bit 1) is included: the message commits to that hash."""
     assert_equal(len(txTo.vin), len(spent_utxos))
     assert input_index < len(txTo.vin)
     out_type = SIGHASH_ALL if hash_type == 0 else hash_type & 3
@@ -835,6 +838,8 @@ def TaprootSignatureMsg(txTo, spent_utxos, hash_type, input_index=0, *, scriptpa
         spend_type |= 1
     if scriptpath:
         spend_type |= 2
+    if block_hash is not None:
+        spend_type |= 4
     ss += bytes([spend_type])
     if in_type == SIGHASH_ANYONECANPAY:
         ss += txTo.vin[input_index].prevout.serialize()
@@ -854,7 +859,9 @@ def TaprootSignatureMsg(txTo, spent_utxos, hash_type, input_index=0, *, scriptpa
         ss += TaggedHash("TapLeaf", bytes([leaf_ver]) + ser_string(leaf_script))
         ss += bytes([0])
         ss += codeseparator_pos.to_bytes(4, "little", signed=False)
-    assert_equal(len(ss), 175 - (in_type == SIGHASH_ANYONECANPAY) * 49 - (out_type != SIGHASH_ALL and out_type != SIGHASH_SINGLE) * 32 + (annex is not None) * 32 + scriptpath * 37)
+    if block_hash is not None:
+        ss += block_hash
+    assert_equal(len(ss), 175 - (in_type == SIGHASH_ANYONECANPAY) * 49 - (out_type != SIGHASH_ALL and out_type != SIGHASH_SINGLE) * 32 + (annex is not None) * 32 + scriptpath * 37 + (block_hash is not None) * 32)
     return ss
 
 def TaprootSignatureHash(*args, **kwargs):
@@ -914,10 +921,15 @@ def taproot_tree_helper(scripts):
 # - merklebranch: the merkle branch to use for this leaf (32*N bytes)
 TaprootLeafInfo = namedtuple("TaprootLeafInfo", "script,version,merklebranch,leaf_hash")
 
-def taproot_construct(pubkey, scripts=None, treat_internal_as_infinity=False):
+def block_ref_annex(height):
+    """Annex committing to the block at the given height (witness v2 block reference)."""
+    return bytes([ANNEX_TAG, BLOCK_REF_ANNEX_TYPE]) + height.to_bytes(4, "little")
+
+def taproot_construct(pubkey, scripts=None, treat_internal_as_infinity=False, witver=1):
     """Construct a tree of Taproot spending conditions
 
     pubkey: a 32-byte xonly pubkey for the internal pubkey (bytes)
+    witver: witness version of the resulting scriptPubKey (1 for BIP341, 2 for v2 with block references)
     scripts: a list of items; each item is either:
              - a (name, CScript or bytes, leaf version) tuple
              - a (name, CScript or bytes) tuple (defaulting to leaf version 0xc0)
@@ -938,7 +950,7 @@ def taproot_construct(pubkey, scripts=None, treat_internal_as_infinity=False):
     else:
         tweaked, negated = tweak_add_pubkey(pubkey, tweak)
     leaves = dict((name, TaprootLeafInfo(script, version, merklebranch, leaf)) for name, version, script, merklebranch, leaf in ret)
-    return TaprootInfo(CScript([OP_1, tweaked]), pubkey, negated + 0, tweak, leaves, h, tweaked)
+    return TaprootInfo(CScript([CScriptOp.encode_op_n(witver), tweaked]), pubkey, negated + 0, tweak, leaves, h, tweaked)
 
 def is_op_success(o):
     return o == 0x50 or o == 0x62 or o == 0x89 or o == 0x8a or o == 0x8d or o == 0x8e or (o >= 0x7e and o <= 0x81) or (o >= 0x83 and o <= 0x86) or (o >= 0x95 and o <= 0x99) or (o >= 0xbb and o <= 0xfe)
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 6a9c2ec3c62e..064042aa1675 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -104,6 +104,7 @@
     # vv Tests less than 5m vv
     'feature_fee_estimation.py',
     'feature_taproot.py',
+    'feature_block_reference.py',
     'feature_block.py',
     'mempool_ephemeral_dust.py',
     'wallet_conflicts.py',
@@ -140,6 +141,7 @@
     'p2p_blockfilters.py',
     'feature_assumevalid.py',
     'wallet_taproot.py',
+    'wallet_block_reference.py',
     'feature_bip68_sequence.py',
     'rpc_packages.py',
     'rpc_bind.py --ipv4',
diff --git a/test/functional/wallet_block_reference.py b/test/functional/wallet_block_reference.py
new file mode 100755
index 000000000000..4fff6a69cfbf
--- /dev/null
+++ b/test/functional/wallet_block_reference.py
@@ -0,0 +1,229 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Test wallet support for witness v2 (tr2) outputs and block references.
+
+The wallet receives to tr2() descriptors and, when asked with the
+block_reference option, spends with an annex referencing the block at
+tip - 99 (see doc/block-reference.md), both through send/sendall and
+through the PSBT workflow.
+"""
+
+from decimal import Decimal
+
+from test_framework.address import address_to_scriptpubkey
+from test_framework.blocktools import COINBASE_MATURITY
+from test_framework.psbt import PSBT, PSBT_GLOBAL_BLOCK_HEADER
+from test_framework.script import LOCKTIME_THRESHOLD, block_ref_annex
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import (
+    assert_equal,
+    assert_raises_rpc_error,
+)
+from test_framework.wallet import MiniWallet
+
+
+class WalletBlockReferenceTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.num_nodes = 2
+
+    def skip_test_if_missing_module(self):
+        self.skip_if_no_wallet()
+
+    def check_annexes(self, txid, expect_reference):
+        """Every input of the (in-mempool) transaction spends a tr2 output; check the block reference annex."""
+        node = self.nodes[0]
+        tx = node.getrawtransaction(txid, True)
+        expected = block_ref_annex(node.getblockcount() - (COINBASE_MATURITY - 1)).hex()
+        for vin in tx["vin"]:
+            witness = vin["txinwitness"]
+            if expect_reference:
+                assert_equal(len(witness), 2)
+                assert_equal(witness[1], expected)
+            else:
+                assert_equal(len(witness), 1)
+
+    def run_test(self):
+        node = self.nodes[0]
+        node.createwallet("w")
+        w = node.get_wallet_rpc("w")
+
+        self.log.info("Import tr2() descriptors derived from the wallet's tr() descriptors")
+        for desc in w.listdescriptors(True)["descriptors"]:
+            if not desc["desc"].startswith("tr("):
+                continue
+            tr2 = "tr2(" + desc["desc"][len("tr("):].split("#")[0]
+            tr2 += "#" + node.getdescriptorinfo(tr2)["checksum"]
+            res = w.importdescriptors([{"desc": tr2, "active": True, "internal": desc["internal"], "timestamp": "now"}])
+            assert_equal(res[0]["success"], True)
+        addr = w.getnewaddress(address_type="bech32m")
+        assert addr.startswith("bcrt1z")  # witness v2
+        assert_equal(w.getaddressinfo(addr)["desc"].startswith("tr2("), True)
+
+        miniwallet = MiniWallet(node)
+        for _ in range(3):
+            miniwallet.send_to(from_node=node, scriptPubKey=address_to_scriptpubkey(addr), amount=1_000_000)
+        self.generate(node, 1)
+        assert_equal(w.getbalance(), Decimal("0.03"))
+
+        self.log.info("send with block_reference adds the annex to every input")
+        res = w.send({addr: Decimal("0.005")}, options={"block_reference": True})
+        assert_equal(res["complete"], True)
+        self.check_annexes(res["txid"], True)
+        self.generate(node, 1)
+        assert_equal(w.gettransaction(res["txid"])["confirmations"], 1)
+
+        self.log.info("send without the option spends without an annex")
+        res = w.send({addr: Decimal("0.005")})
+        self.check_annexes(res["txid"], False)
+        self.generate(node, 1)
+
+        self.log.info("sendall with block_reference")
+        res = w.sendall([addr], options={"block_reference": True})
+        self.check_annexes(res["txid"], True)
+        self.generate(node, 1)
+
+        self.log.info("PSBT workflow carries the reference through walletcreatefundedpsbt, walletprocesspsbt and finalizepsbt")
+        tip = node.getblockcount()
+        plain = w.walletcreatefundedpsbt([], {addr: Decimal("0.004")})["psbt"]
+        assert "block_headers" not in node.decodepsbt(plain)
+
+        self.log.info("Headers require a height locktime whose complete range is available")
+        ref_height = tip - (COINBASE_MATURITY - 1)
+        for locktime in [0, LOCKTIME_THRESHOLD, tip + 1, ref_height - 1]:
+            psbt = w.walletcreatefundedpsbt([], {addr: Decimal("0.004")}, locktime, {"block_reference": True})["psbt"]
+            decoded = node.decodepsbt(psbt)
+            assert "block_headers" not in decoded
+            assert_equal(decoded["fallback_locktime"], locktime)
+            assert "block_reference" in decoded["inputs"][0]
+
+        self.log.info("Header ranges end at the locktime, including when it is below the tip")
+        for locktime in [ref_height, tip - 1, tip]:
+            psbt = w.walletcreatefundedpsbt([], {addr: Decimal("0.004")}, locktime, {"block_reference": True})["psbt"]
+            expected = {
+                str(height): node.getblockheader(node.getblockhash(height), False)
+                for height in range(ref_height, locktime + 1)
+            }
+            assert_equal(node.decodepsbt(psbt)["block_headers"], expected)
+
+        res = w.walletcreatefundedpsbt([], {addr: Decimal("0.004")}, tip, {"block_reference": True})
+        expected_headers = {
+            str(height): node.getblockheader(node.getblockhash(height), False)
+            for height in range(tip - (COINBASE_MATURITY - 1), tip + 1)
+        }
+        assert_equal(node.decodepsbt(res["psbt"])["block_headers"], expected_headers)
+        for psbt_input in node.decodepsbt(res["psbt"])["inputs"]:
+            assert_equal(psbt_input["block_reference"], {"height": tip - (COINBASE_MATURITY - 1), "hash": node.getblockhash(tip - (COINBASE_MATURITY - 1))})
+        processed = w.walletprocesspsbt(res["psbt"])
+        assert_equal(processed["complete"], True)
+        assert_equal(node.decodepsbt(processed["psbt"])["block_headers"], expected_headers)
+        finalized_psbt = node.finalizepsbt(processed["psbt"], False)["psbt"]
+        assert_equal(node.decodepsbt(finalized_psbt)["block_headers"], expected_headers)
+
+        self.log.info("Combining PSBTs preserves and deduplicates headers")
+        without_headers = PSBT.from_base64(res["psbt"])
+        header_keys = [key for key in without_headers.g.map if isinstance(key, bytes) and key[0] == PSBT_GLOBAL_BLOCK_HEADER]
+        assert_equal(len(header_keys), COINBASE_MATURITY)
+        assert_equal(set(header_keys), {bytes([PSBT_GLOBAL_BLOCK_HEADER]) + height.to_bytes(4, "little") for height in range(ref_height, tip + 1)})
+        for key in header_keys:
+            del without_headers.g.map[key]
+        combined = node.combinepsbt([without_headers.to_base64(), res["psbt"], res["psbt"]])
+        assert_equal(node.decodepsbt(combined)["block_headers"], expected_headers)
+        # Headers are optional metadata; older PSBTs can still be signed.
+        assert_equal(w.walletprocesspsbt(without_headers.to_base64())["complete"], True)
+
+        self.log.info("Combiners reject conflicting headers at the same height in either order")
+        key = bytes([PSBT_GLOBAL_BLOCK_HEADER]) + ref_height.to_bytes(4, "little")
+        conflicting_headers = PSBT.from_base64(res["psbt"])
+        conflicting_headers.g.map[key] = bytes.fromhex(node.getblockheader(node.getblockhash(tip), False))
+        for psbts in [[res["psbt"], conflicting_headers.to_base64()], [conflicting_headers.to_base64(), res["psbt"]]]:
+            assert_raises_rpc_error(-8, "conflicting block headers", node.combinepsbt, psbts)
+
+        self.log.info("Joining PSBTs also preserves headers and rejects conflicting heights")
+        original_v0 = w.walletcreatefundedpsbt([], {addr: Decimal("0.004")}, tip, {"block_reference": True}, psbt_version=0)["psbt"]
+        utxo = miniwallet.get_utxo(mark_as_spent=False)
+        other_v0 = PSBT.from_base64(node.createpsbt([{"txid": utxo["txid"], "vout": utxo["vout"]}], {addr: Decimal("0.001")}, tip, psbt_version=0))
+        other_v0.g.map[key] = PSBT.from_base64(original_v0).g.map[key]
+        joined = node.joinpsbts([original_v0, other_v0.to_base64()])
+        assert_equal(node.decodepsbt(joined)["block_headers"], expected_headers)
+        other_v0.g.map[key] = conflicting_headers.g.map[key]
+        assert_raises_rpc_error(-8, "conflicting block headers", node.joinpsbts, [original_v0, other_v0.to_base64()])
+
+        self.log.info("Block header records must have the expected key and value sizes")
+        key = header_keys[0]
+        for bad_key, bad_value, error in [
+            (key[:-1], PSBT.from_base64(res["psbt"]).g.map[key], "Global Block Header"),
+            (key + b"\x00", PSBT.from_base64(res["psbt"]).g.map[key], "Global Block Header"),
+            (key, bytes(79), "TX decode failed"),
+            (key, bytes(81), "TX decode failed"),
+        ]:
+            malformed = PSBT.from_base64(res["psbt"])
+            del malformed.g.map[key]
+            malformed.g.map[bad_key] = bad_value
+            assert_raises_rpc_error(-22, error, node.decodepsbt, malformed.to_base64())
+
+        finalized = node.finalizepsbt(processed["psbt"])
+        txid = node.sendrawtransaction(finalized["hex"])
+        self.check_annexes(txid, True)
+        self.generate(node, 1)
+        assert_equal(w.gettransaction(txid)["confirmations"], 1)
+
+        self.log.info("Inputs claiming different hashes for the same referenced height are rejected")
+        # Spend more than one coin so that the PSBT has two referencing inputs
+        res = w.walletcreatefundedpsbt([], {addr: w.getbalance() - Decimal("0.001")}, node.getblockcount(), {"block_reference": True})
+        psbt = PSBT.from_base64(res["psbt"])
+        assert len(psbt.i) >= 2
+        assert_equal(len(node.decodepsbt(res["psbt"])["block_headers"]), COINBASE_MATURITY)
+        key = 0x7f
+        value = psbt.i[1].map[key]
+        psbt.i[1].map[key] = value[:4] + bytes(32)
+        conflicting = psbt.to_base64()
+        assert_raises_rpc_error(-25, "The transaction cannot be valid", w.walletprocesspsbt, conflicting)
+        assert_equal(node.finalizepsbt(conflicting)["complete"], False)
+        assert_equal(node.analyzepsbt(conflicting)["error"], "PSBT inputs reference conflicting block hashes for the same height")
+
+        self.log.info("Asking for a block reference without any tr2 input is an error, not a silently replayable transaction")
+        node.createwallet("v1")
+        v1 = node.get_wallet_rpc("v1")
+        miniwallet.send_to(from_node=node, scriptPubKey=address_to_scriptpubkey(v1.getnewaddress(address_type="bech32m")), amount=1_000_000)
+        self.generate(node, 1)
+        assert_raises_rpc_error(-8, "block_reference requires at least one witness v2 (tr2) input", v1.send, {addr: Decimal("0.001")}, options={"block_reference": True})
+        assert_raises_rpc_error(-8, "block_reference requires at least one witness v2 (tr2) input", v1.walletcreatefundedpsbt, [], {addr: Decimal("0.001")}, 0, {"block_reference": True})
+
+        self.log.info("A shallow reorg keeps a referencing transaction; one that replaces the referenced block abandons it")
+        node1 = self.nodes[1]
+        self.sync_blocks()
+        self.disconnect_nodes(0, 1)
+        res = w.send({addr: Decimal("0.001")}, options={"block_reference": True})
+        self.generate(node, 1, sync_fun=self.no_op)
+        self.generate(node1, 2, sync_fun=self.no_op)
+        self.connect_nodes(0, 1)
+        self.sync_blocks()
+        assert res["txid"] in node.getrawmempool()
+        assert_equal(w.gettransaction(res["txid"])["details"][0]["abandoned"], False)
+        self.generate(node, 1)
+
+        # Bury everything so far, so that the deep reorg below only replaces empty blocks and the new spend
+        self.generate(node, COINBASE_MATURITY + 1)
+        self.disconnect_nodes(0, 1)
+        ref_height = node.getblockcount() - (COINBASE_MATURITY - 1)
+        balance_before = w.getbalance()
+        res = w.send({addr: Decimal("0.001")}, options={"block_reference": True})
+        self.generate(node, 1, sync_fun=self.no_op)
+        assert_equal(w.gettransaction(res["txid"])["confirmations"], 1)
+        # node1 rebuilds the chain from below the referenced block and outgrows node0
+        node1.invalidateblock(node1.getblockhash(ref_height))
+        self.generate(node1, node.getblockcount() - node1.getblockcount() + 1, sync_fun=self.no_op)
+        self.connect_nodes(0, 1)
+        self.sync_blocks()
+        assert res["txid"] not in node.getrawmempool()
+        tx_info = w.gettransaction(res["txid"])
+        assert_equal(tx_info["confirmations"], 0)
+        assert_equal(tx_info["details"][0]["abandoned"], True)
+        # The abandoned transaction's inputs are spendable again
+        assert_equal(w.getbalance(), balance_before)
+
+
+if __name__ == '__main__':
+    WalletBlockReferenceTest(__file__).main()