diff --git a/doc/multisig-tutorial.md b/doc/multisig-tutorial.md
index fd74e62ed28f..0a9379d9caf7 100644
--- a/doc/multisig-tutorial.md
+++ b/doc/multisig-tutorial.md
@@ -20,15 +20,27 @@ This tutorial also uses the default PKH derivation path to get the xpubs and doe
 
 For a 2-of-3 multisig, create 3 wallets. These wallets contain HD seed and private keys, which will be used to sign the PSBTs and derive the xpub.
 
-These three wallets should not be used directly for privacy reasons (public key reuse). They should only be used to sign transactions for the (watch-only) multisig wallet.
+These three wallets should not be used directly for privacy reasons (public key reuse). They should only be used to sign transactions for the (watch-only) multisig wallet. To make that less likely to happen by accident, participant wallets only have singlesig legacy addresses, and no singlesig Bech32 addresses.
+
+`addhdkey` adds an HD key to the blank wallet, which `createwalletdescriptor` then uses:
 
 ```bash
 for ((n=1;n<=3;n++))
 do
- ./build/bin/bitcoin rpc -signet createwallet "participant_${n}"
+ ./build/bin/bitcoin rpc -signet -named createwallet wallet_name="participant_${n}" blank=true
+ ./build/bin/bitcoin rpc -signet -rpcwallet="participant_${n}" addhdkey
+ ./build/bin/bitcoin rpc -signet -rpcwallet="participant_${n}" createwalletdescriptor legacy
 done
 ```
 
+The `legacy` descriptor is only there to hold the private keys: it derives from `m/44h/1h/0h/<0;1>/*`, the same paths as the multisig descriptor defined below, and a wallet can only sign for a derivation path that one of its descriptors uses.
+
+A later step spends from the multisig wallet, so create one more wallet to receive that payment. This one is an ordinary singlesig wallet, standing in for whoever is being paid:
+
+```bash
+./build/bin/bitcoin rpc -signet createwallet "recipient"
+```
+
 Extract the xpub of each wallet. To do this, the `derivehdkey` RPC is used.
 
 Note that previously at least two descriptors were usually used, one for external derivation paths and one for internal ones. Since https://github.com/bitcoin/bitcoin/pull/22838 this redundancy has been eliminated by a multipath descriptor with <code><0;1></code> at the [BIP-44](https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki#change) change level expanding to external and internal descriptors when imported.
@@ -100,6 +112,7 @@ Once the wallets have already been created and this tutorial needs to be repeate
 ```bash
 for ((n=1;n<=3;n++)); do ./build/bin/bitcoin rpc -signet loadwallet "participant_${n}"; done
 ./build/bin/bitcoin rpc -signet loadwallet "multisig_wallet_01"
+./build/bin/bitcoin rpc -signet loadwallet "recipient"
 ```
 
 ### 1.4 Fund the wallet
@@ -138,7 +151,7 @@ PSBT is a data format that allows wallets and other tools to exchange informatio
 
 The current PSBT version (v0) is defined in [BIP 174](https://github.com/bitcoin/bips/blob/master/bip-0174.mediawiki).
 
-For simplicity, the destination address is taken from the `participant_1` wallet in the code above, but it can be any valid bitcoin address.
+The destination address is taken from the `recipient` wallet.
 
 The `walletcreatefundedpsbt` RPC is used to create and fund a transaction in the PSBT format. It is the first step in creating the PSBT.
 
@@ -147,7 +160,7 @@ balance=$(./build/bin/bitcoin rpc -signet -rpcwallet="multisig_wallet_01" getbal
 
 amount=$(echo "$balance * 0.8" | bc -l | sed -e 's/^\./0./' -e 's/^-\./-0./')
 
-destination_addr=$(./build/bin/bitcoin rpc -signet -rpcwallet="participant_1" getnewaddress)
+destination_addr=$(./build/bin/bitcoin rpc -signet -rpcwallet="recipient" getnewaddress "" bech32m)
 
 funded_psbt=$(./build/bin/bitcoin rpc -signet -rpcwallet="multisig_wallet_01" walletcreatefundedpsbt outputs="{\"$destination_addr\": $amount}" | jq -r '.psbt')
 ```
diff --git a/doc/release-notes-32857.md b/doc/release-notes-32857.md
new file mode 100644
index 000000000000..24cdb811e794
--- /dev/null
+++ b/doc/release-notes-32857.md
@@ -0,0 +1,8 @@
+Updated RPCs
+------------
+
+- The `send`, `sendall`, `walletprocesspsbt`, `walletcreatefundedpsbt`, and
+  `descriptorprocesspsbt` RPCs now accept a `keypath_only` option. When enabled,
+  they do not add new Taproot script-path data, sign script paths, or finalize
+  script-path spends. Existing script-path data and signatures remain in a
+  supplied PSBT. (#32857)
diff --git a/doc/release-notes-32861.md b/doc/release-notes-32861.md
new file mode 100644
index 000000000000..9030ee57f9f9
--- /dev/null
+++ b/doc/release-notes-32861.md
@@ -0,0 +1,9 @@
+Updated RPCs
+------------
+
+- `createwalletdescriptor` no longer requires the `hdkey` argument when the
+  wallet has no active descriptors but does have exactly one HD key added with
+  `addhdkey`. Previously the user had to look the key up with `listdescriptors`
+  and pass it in. This makes it easier to set up a blank wallet that only has
+  the descriptors it actually needs, which `doc/multisig-tutorial.md` now
+  demonstrates. (#32861)
diff --git a/src/common/types.h b/src/common/types.h
index 1ffcd392d609..efcebc9062df 100644
--- a/src/common/types.h
+++ b/src/common/types.h
@@ -48,6 +48,12 @@ struct PSBTFillOptions {
      * Whether to fill in bip32 derivation information if available.
      */
     bool bip32_derivs{true};
+
+    /**
+     * Only add new Taproot key-path data, and only sign and finalize Taproot
+     * inputs using the key path. Existing script-path data is left intact.
+     */
+    bool taproot_keypath_only{false};
 };
 
 } // namespace common
diff --git a/src/core_io.cpp b/src/core_io.cpp
index 3650d70810a9..cbaf24171237 100644
--- a/src/core_io.cpp
+++ b/src/core_io.cpp
@@ -338,9 +338,13 @@ const std::map<unsigned char, std::string> mapSigHashTypes = {
     {static_cast<unsigned char>(SIGHASH_SINGLE|SIGHASH_ANYONECANPAY), std::string("SINGLE|ANYONECANPAY")},
 };
 
-std::string SighashToStr(unsigned char sighash_type)
+std::string SighashToStr(int32_t sighash_type)
 {
-    const auto& it = mapSigHashTypes.find(sighash_type);
+    // Signatures encode the sighash type in a single byte, but the PSBT field
+    // for it is a 32 bit unsigned integer in BIP 174 (signed in PSBTInput)
+    if (sighash_type < 0 || sighash_type > 0xff) return "";
+    const uint8_t sighash_byte(sighash_type);
+    const auto& it = mapSigHashTypes.find(sighash_byte);
     if (it == mapSigHashTypes.end()) return "";
     return it->second;
 }
diff --git a/src/core_io.h b/src/core_io.h
index 904f5a8643b9..d78706216c20 100644
--- a/src/core_io.h
+++ b/src/core_io.h
@@ -8,6 +8,7 @@
 #include <consensus/amount.h>
 #include <util/result.h>
 
+#include <cstdint>
 #include <functional>
 #include <string>
 
@@ -42,7 +43,7 @@ bool DecodeHexBlockHeader(CBlockHeader&, const std::string& hex_header);
 UniValue ValueFromAmount(CAmount amount);
 std::string FormatScript(const CScript& script);
 std::string EncodeHexTx(const CTransaction& tx);
-std::string SighashToStr(unsigned char sighash_type);
+std::string SighashToStr(int32_t sighash_type);
 void ScriptToUniv(const CScript& script, UniValue& out, bool include_hex = true, bool include_address = false, const SigningProvider* provider = nullptr);
 void TxToUniv(const CTransaction& tx, const uint256& block_hash, UniValue& entry, bool include_hex = true, const CTxUndo* txundo = nullptr, TxVerbosity verbosity = TxVerbosity::SHOW_DETAILS, std::function<bool(const CTxOut&)> is_change_func = {});
 
diff --git a/src/external_signer.cpp b/src/external_signer.cpp
index cb49cedc69c2..c3e989466891 100644
--- a/src/external_signer.cpp
+++ b/src/external_signer.cpp
@@ -8,10 +8,13 @@
 #include <common/run_command.h>
 #include <core_io.h>
 #include <psbt.h>
+#include <script/interpreter.h>
 #include <util/strencodings.h>
 #include <util/subprocess.h>
 
 #include <algorithm>
+#include <cstdint>
+#include <optional>
 #include <stdexcept>
 #include <string>
 #include <vector>
@@ -77,6 +80,49 @@ UniValue ExternalSigner::GetDescriptors(const int account)
     return RunCommandParseJSON(Cat(m_command, Cat(Cat({"--fingerprint", m_fingerprint}, NetworkArg()), {"getdescriptors", "--account", strprintf("%d", account)})), "");
 }
 
+UniValue ExternalSigner::RegisterDescriptor(const std::string& name, const std::string& descriptor) const
+{
+    return RunCommandParseJSON(Cat(m_command, Cat(Cat({"--fingerprint", m_fingerprint}, NetworkArg()), {"registerdescriptor", name, descriptor})), "");
+}
+
+UniValue ExternalSigner::DisplayAddressRegistered(const std::string& registration, bool change, uint32_t index) const
+{
+    // The registration descriptor combines the chains as <receive;change>,
+    // so the change chain is multipath index 1.
+    return RunCommandParseJSON(Cat(m_command, Cat(Cat({"--fingerprint", m_fingerprint}, NetworkArg()),
+        {"displayaddress",
+         "--registration", registration,
+         "--index", strprintf("%u", index),
+         "--multipath-index", change ? "1" : "0"})), "");
+}
+
+//! Find a sighash type used by the signer that doesn't commit to all outputs;
+//! a signature with SIGHASH_NONE or SIGHASH_SINGLE would let anyone alter
+//! them. SIGHASH_ANYONECANPAY is acceptable, since it only permits adding
+//! inputs, which does not affect us.
+static std::optional<int32_t> FindUnsafeSighashType(const PartiallySignedTransaction& psbtx)
+{
+    std::vector<int32_t> sighash_types;
+    for (const PSBTInput& input : psbtx.inputs) {
+        if (input.sighash_type) sighash_types.push_back(*input.sighash_type);
+        for (const auto& [_, sig] : input.partial_sigs) {
+            if (!sig.second.empty()) sighash_types.push_back(sig.second.back());
+        }
+        // A 64 byte taproot signature implies SIGHASH_DEFAULT, 65 bytes
+        // carries an explicit sighash type in the last byte
+        if (input.m_tap_key_sig.size() == 65) sighash_types.push_back(input.m_tap_key_sig.back());
+        for (const auto& [_, sig] : input.m_tap_script_sigs) {
+            if (sig.size() == 65) sighash_types.push_back(sig.back());
+        }
+    }
+
+    for (const int32_t sighash_type : sighash_types) {
+        const int32_t base_sighash_type{sighash_type & ~SIGHASH_ANYONECANPAY};
+        if (base_sighash_type != SIGHASH_DEFAULT && base_sighash_type != SIGHASH_ALL) return sighash_type;
+    }
+    return std::nullopt;
+}
+
 bool ExternalSigner::SignTransaction(PartiallySignedTransaction& psbtx, std::string& error)
 {
     // Serialize the PSBT
@@ -121,7 +167,51 @@ bool ExternalSigner::SignTransaction(PartiallySignedTransaction& psbtx, std::str
         return false;
     }
 
-    psbtx = *signer_psbtx;
+    if (const std::optional<int32_t> sighash{FindUnsafeSighashType(*signer_psbtx)}) {
+        const std::string sighash_str{SighashToStr(*sighash)};
+        error = strprintf("Signer used an unsafe sighash type: %s", sighash_str.empty() ? "unknown" : sighash_str);
+        return false;
+    }
+
+    if (!psbtx.Merge(*signer_psbtx)) {
+        error = "Signer returned a PSBT for a different transaction";
+        return false;
+    }
+
+    return true;
+}
 
+bool ExternalSigner::SignTransactionRegistered(PartiallySignedTransaction& psbtx,
+                                               const std::string& registration,
+                                               std::string& error)
+{
+    // Serialize the PSBT
+    DataStream ssTx{};
+    ssTx << psbtx;
+
+    const std::vector<std::string> command = Cat(m_command, Cat({"--stdin", "--fingerprint", m_fingerprint}, NetworkArg()));
+
+    // The registration is base64 encoded by HWI and therefore contains no
+    // whitespace for shlex to split when the command is read from stdin.
+    const std::string stdinStr = "signtx " + EncodeBase64(ssTx.str()) + " --registration " + registration;
+
+    const UniValue signer_result = RunCommandParseJSON(command, stdinStr);
+
+    if (signer_result.find_value("error").isStr()) {
+        error = signer_result.find_value("error").get_str();
+        return false;
+    }
+    if (!signer_result.find_value("psbt").isStr()) {
+        error = "Unexpected result from signer";
+        return false;
+    }
+
+    util::Result<PartiallySignedTransaction> signer_psbtx = DecodeBase64PSBT(signer_result.find_value("psbt").get_str());
+    if (!signer_psbtx) {
+        error = strprintf("TX decode failed %s", util::ErrorString(signer_psbtx).original);
+        return false;
+    }
+
+    psbtx = *signer_psbtx;
     return true;
 }
diff --git a/src/external_signer.h b/src/external_signer.h
index 5131a2078f3d..f9cf24fa734a 100644
--- a/src/external_signer.h
+++ b/src/external_signer.h
@@ -8,6 +8,7 @@
 #include <common/system.h>
 #include <univalue.h>
 
+#include <optional>
 #include <string>
 #include <vector>
 
@@ -52,6 +53,15 @@ class ExternalSigner
     //!            Must include a public key or xpub, as well as key origin.
     UniValue DisplayAddress(const std::string& descriptor) const;
 
+    //! Display an address from a previously registered descriptor.
+    //! Calls `<command> displayaddress --registration <registration>
+    //! --index <index> --multipath-index <0|1>`.
+    //! @param[in] registration opaque value returned by `registerdescriptor`
+    //! @param[in] change       whether to show the change-chain address
+    //! @param[in] index        address index within the chain
+    //! @returns                signer reply, expected to contain `address`
+    UniValue DisplayAddressRegistered(const std::string& registration, bool change, uint32_t index) const;
+
     //! Get receive and change Descriptor(s) from device for a given account.
     //! Calls `<command> --fingerprint <fingerprint> --chain <chain> getdescriptors
     //! --account <account>`.
@@ -59,11 +69,32 @@ class ExternalSigner
     //! @returns see doc/external-signer.md
     UniValue GetDescriptors(int account);
 
+    //! Register a descriptor on the device.
+    //! Calls `<command> registerdescriptor <name> <descriptor>`.
+    //! @param[in] name       descriptor name to display on the signer
+    //! @param[in] descriptor combined multipath descriptor
+    //! @returns opaque registration provided by the signer
+    UniValue RegisterDescriptor(const std::string& name, const std::string& descriptor) const;
+
     //! Sign PartiallySignedTransaction on the device.
     //! Calls `<command> --stdin --fingerprint <fingerprint> --chain <chain>` and passes the
     //! `signtx` command and PSBT via stdin.
     //! @param[in,out] psbt  PartiallySignedTransaction to be signed
     bool SignTransaction(PartiallySignedTransaction& psbt, std::string& error);
+
+    //! Sign a PartiallySignedTransaction using a previously registered
+    //! descriptor. Used for descriptors (e.g. MuSig2) that require
+    //! on-device registration before signing.
+    //!
+    //! Pipes `signtx <base64> --registration <registration>` to the
+    //! signer's stdin.
+    //!
+    //! @param[in,out] psbt         PSBT to be signed
+    //! @param[in] registration     opaque value returned by `registerdescriptor`
+    //! @param[out] error           populated on failure
+    bool SignTransactionRegistered(PartiallySignedTransaction& psbt,
+                                   const std::string& registration,
+                                   std::string& error);
 };
 
 #endif // BITCOIN_EXTERNAL_SIGNER_H
diff --git a/src/key_io.cpp b/src/key_io.cpp
index 94964bdd8d5b..fb2219fb7a25 100644
--- a/src/key_io.cpp
+++ b/src/key_io.cpp
@@ -81,6 +81,7 @@ class DestinationEncoder
     std::string operator()(const CNoDestination& no) const { return {}; }
     std::string operator()(const PubKeyDestination& pk) const { return {}; }
 };
+} // namespace
 
 CTxDestination DecodeDestination(const std::string& str, const CChainParams& params, std::string& error_str, std::vector<int>* error_locations)
 {
@@ -209,7 +210,6 @@ CTxDestination DecodeDestination(const std::string& str, const CChainParams& par
     if (error_locations) *error_locations = std::move(res.second);
     return CNoDestination();
 }
-} // namespace
 
 CKey DecodeSecret(const std::string& str)
 {
diff --git a/src/key_io.h b/src/key_io.h
index adc801378cd0..5fbfefcfa551 100644
--- a/src/key_io.h
+++ b/src/key_io.h
@@ -24,6 +24,7 @@ std::string EncodeExtPubKey(const CExtPubKey& extpubkey);
 std::string EncodeDestination(const CTxDestination& dest);
 CTxDestination DecodeDestination(const std::string& str);
 CTxDestination DecodeDestination(const std::string& str, std::string& error_msg, std::vector<int>* error_locations = nullptr);
+CTxDestination DecodeDestination(const std::string& str, const CChainParams& params, std::string& error_str, std::vector<int>* error_locations = nullptr);
 bool IsValidDestinationString(const std::string& str);
 bool IsValidDestinationString(const std::string& str, const CChainParams& params);
 
diff --git a/src/psbt.cpp b/src/psbt.cpp
index c9f0311634e5..00c29edbb7a7 100644
--- a/src/psbt.cpp
+++ b/src/psbt.cpp
@@ -464,6 +464,7 @@ bool PSBTInput::Merge(const PSBTInput& input)
     for (const auto& [agg_key_lh, psigs] : input.m_musig2_partial_sigs) {
         m_musig2_partial_sigs[agg_key_lh].insert(psigs.begin(), psigs.end());
     }
+    if (sighash_type == std::nullopt && input.sighash_type != std::nullopt) sighash_type = input.sighash_type;
     if (sequence == std::nullopt && input.sequence != std::nullopt) sequence = input.sequence;
     if (time_locktime == std::nullopt && input.time_locktime != std::nullopt) time_locktime = input.time_locktime;
     if (height_locktime == std::nullopt && input.height_locktime != std::nullopt) height_locktime = input.height_locktime;
@@ -733,7 +734,7 @@ util::Expected<void, PSBTError> SignPSBTInput(const SigningProvider& provider, P
     if (txdata == nullptr) {
         sig_complete = ProduceSignature(provider, DUMMY_SIGNATURE_CREATOR, utxo.scriptPubKey, sigdata);
     } else {
-        MutableTransactionSignatureCreator creator(tx, index, utxo.nValue, txdata, {.sighash_type = sighash});
+        MutableTransactionSignatureCreator creator(tx, index, utxo.nValue, txdata, {.sighash_type = sighash, .taproot_keypath_only = options.taproot_keypath_only});
         sig_complete = ProduceSignature(provider, creator, utxo.scriptPubKey, sigdata);
     }
     // Verify that a witness signature was produced in case one was required.
diff --git a/src/qt/createwalletdialog.cpp b/src/qt/createwalletdialog.cpp
index 59c6f51a27ec..b73c9728240e 100644
--- a/src/qt/createwalletdialog.cpp
+++ b/src/qt/createwalletdialog.cpp
@@ -26,34 +26,25 @@ CreateWalletDialog::CreateWalletDialog(QWidget* parent) :
     });
 
     connect(ui->encrypt_wallet_checkbox, &QCheckBox::toggled, [this](bool checked) {
-        // Disable the disable_privkeys_checkbox and external_signer_checkbox when isEncryptWalletChecked is
+        // Disable the disable_privkeys_checkbox when isEncryptWalletChecked is
         // set to true, enable it when isEncryptWalletChecked is false.
         ui->disable_privkeys_checkbox->setEnabled(!checked);
-#ifdef ENABLE_EXTERNAL_SIGNER
-        ui->external_signer_checkbox->setEnabled(m_has_signers && !checked);
-#endif
+
         // When the disable_privkeys_checkbox is disabled, uncheck it.
         if (!ui->disable_privkeys_checkbox->isEnabled()) {
             ui->disable_privkeys_checkbox->setChecked(false);
         }
-
-        // When the external_signer_checkbox box is disabled, uncheck it.
-        if (!ui->external_signer_checkbox->isEnabled()) {
-            ui->external_signer_checkbox->setChecked(false);
-        }
-
     });
 
     connect(ui->external_signer_checkbox, &QCheckBox::toggled, [this](bool checked) {
-        ui->encrypt_wallet_checkbox->setEnabled(!checked);
-        ui->blank_wallet_checkbox->setEnabled(!checked);
-        ui->disable_privkeys_checkbox->setEnabled(!checked);
+        // In the basic use case all keys will be on the external signer
+        // device and the wallet should be watch-only. Makes this the
+        // default suggestion.
+        ui->disable_privkeys_checkbox->setChecked(checked);
 
-        // The external signer checkbox is only enabled when a device is detected.
-        // In that case it is checked by default. Toggling it restores the other
-        // options to their default.
+        // The external signer box is checked by default when a device is
+        // detected. Toggling it restores the other options to their default.
         ui->encrypt_wallet_checkbox->setChecked(false);
-        ui->disable_privkeys_checkbox->setChecked(checked);
         ui->blank_wallet_checkbox->setChecked(false);
     });
 
@@ -103,12 +94,9 @@ void CreateWalletDialog::setSigners(const std::vector<std::unique_ptr<interfaces
     if (m_has_signers) {
         ui->external_signer_checkbox->setEnabled(true);
         ui->external_signer_checkbox->setChecked(true);
-        ui->encrypt_wallet_checkbox->setEnabled(false);
         ui->encrypt_wallet_checkbox->setChecked(false);
         // The order matters, because connect() is called when toggling a checkbox:
-        ui->blank_wallet_checkbox->setEnabled(false);
         ui->blank_wallet_checkbox->setChecked(false);
-        ui->disable_privkeys_checkbox->setEnabled(false);
         ui->disable_privkeys_checkbox->setChecked(true);
         const std::string label = signers[0]->getName();
         ui->wallet_name_line_edit->setText(QString::fromStdString(label));
diff --git a/src/qt/walletmodel.cpp b/src/qt/walletmodel.cpp
index 97f2f4268cac..35a5575051b4 100644
--- a/src/qt/walletmodel.cpp
+++ b/src/qt/walletmodel.cpp
@@ -203,7 +203,7 @@ WalletModel::SendCoinsReturn WalletModel::prepareTransaction(WalletModelTransact
 
     try {
         auto& newTx = transaction.getWtx();
-        const auto& res = m_wallet->createTransaction(vecSend, coinControl, /*sign=*/!wallet().privateKeysDisabled(), /*change_pos=*/std::nullopt);
+        const auto& res = m_wallet->createTransaction(vecSend, coinControl, /*sign=*/!wallet().privateKeysDisabled() && !wallet().hasExternalSigner(), /*change_pos=*/std::nullopt);
         if (!res) {
             Q_EMIT message(tr("Send Coins"), QString::fromStdString(util::ErrorString(res).translated),
                            CClientUIInterface::MSG_ERROR);
diff --git a/src/rpc/client.cpp b/src/rpc/client.cpp
index 21ed8795304f..22ad340f67fd 100644
--- a/src/rpc/client.cpp
+++ b/src/rpc/client.cpp
@@ -206,6 +206,7 @@ static const CRPCConvertParam vRPCConvertParams[] =
     { "walletcreatefundedpsbt", 3, "replaceable"},
     { "walletcreatefundedpsbt", 3, "solving_data"},
     { "walletcreatefundedpsbt", 3, "max_tx_weight"},
+    { "walletcreatefundedpsbt", 3, "keypath_only"},
     { "walletcreatefundedpsbt", 4, "bip32derivs" },
     { "walletcreatefundedpsbt", 5, "version" },
     { "walletcreatefundedpsbt", 6, "psbt_version" },
@@ -214,11 +215,13 @@ static const CRPCConvertParam vRPCConvertParams[] =
     { "walletprocesspsbt", 2, "sighashtype", ParamFormat::STRING },
     { "walletprocesspsbt", 3, "bip32derivs" },
     { "walletprocesspsbt", 4, "finalize" },
+    { "walletprocesspsbt", 5, "keypath_only"},
     { "descriptorprocesspsbt", 0, "psbt", ParamFormat::STRING },
     { "descriptorprocesspsbt", 1, "descriptors"},
     { "descriptorprocesspsbt", 2, "sighashtype", ParamFormat::STRING },
     { "descriptorprocesspsbt", 3, "bip32derivs" },
     { "descriptorprocesspsbt", 4, "finalize" },
+    { "descriptorprocesspsbt", 5, "keypath_only"},
     { "createpsbt", 0, "inputs" },
     { "createpsbt", 1, "outputs" },
     { "createpsbt", 2, "locktime" },
@@ -266,6 +269,7 @@ static const CRPCConvertParam vRPCConvertParams[] =
     { "send", 4, "replaceable"},
     { "send", 4, "solving_data"},
     { "send", 4, "max_tx_weight"},
+    { "send", 4, "keypath_only"},
     { "send", 5, "version"},
     { "sendall", 0, "recipients" },
     { "sendall", 1, "conf_target" },
@@ -281,6 +285,7 @@ static const CRPCConvertParam vRPCConvertParams[] =
     { "sendall", 4, "send_max"},
     { "sendall", 4, "minconf"},
     { "sendall", 4, "maxconf"},
+    { "sendall", 4, "keypath_only"},
     { "sendall", 4, "conf_target"},
     { "sendall", 4, "replaceable"},
     { "sendall", 4, "solving_data"},
diff --git a/src/rpc/rawtransaction.cpp b/src/rpc/rawtransaction.cpp
index e5a4e0ff5ad4..23ab26bf2276 100644
--- a/src/rpc/rawtransaction.cpp
+++ b/src/rpc/rawtransaction.cpp
@@ -124,7 +124,13 @@ static std::vector<RPCArg> CreateTxDoc()
 
 // Update PSBT with information from the mempool, the UTXO set, the txindex, and the provided descriptors.
 // Optionally, sign the inputs that we can using information from the descriptors.
-PartiallySignedTransaction ProcessPSBT(const std::string& psbt_string, const std::any& context, const HidingSigningProvider& provider, std::optional<int> sighash_type, bool finalize)
+PartiallySignedTransaction ProcessPSBT(
+    const std::string& psbt_string,
+    const std::any& context,
+    const HidingSigningProvider& provider,
+    std::optional<int> sighash_type,
+    bool finalize,
+    bool taproot_keypath_only)
 {
     // Unserialize the transactions
     util::Result<PartiallySignedTransaction> psbt_res = DecodeBase64PSBT(psbt_string);
@@ -194,7 +200,10 @@ PartiallySignedTransaction ProcessPSBT(const std::string& psbt_string, const std
         // We only actually care about those if our signing provider doesn't hide private
         // information, as is the case with `descriptorprocesspsbt`
         // Only error for mismatching sighash types as it is critical that the sighash to sign with matches the PSBT's
-        const auto sign_result = SignPSBTInput(provider, psbtx, /*index=*/i, &txdata, {.sighash_type = sighash_type, .finalize = finalize}, /*out_sigdata=*/nullptr);
+        const auto sign_result = SignPSBTInput(provider, psbtx, /*index=*/i, &txdata, {
+                .sighash_type = sighash_type,
+                .finalize = finalize,
+                .taproot_keypath_only = taproot_keypath_only}, /*out_sigdata=*/nullptr);
         if (!sign_result.has_value() && sign_result.error() == common::PSBTError::SIGHASH_MISMATCH) {
             throw JSONRPCPSBTError(common::PSBTError::SIGHASH_MISMATCH);
         }
@@ -1224,7 +1233,7 @@ static RPCMethod decodepsbt()
 
         // Sighash
         if (input.sighash_type != std::nullopt) {
-            in.pushKV("sighash", SighashToStr((unsigned char)*input.sighash_type));
+            in.pushKV("sighash", SighashToStr(*input.sighash_type));
         }
 
         // Redeem script and witness script
@@ -1851,7 +1860,8 @@ static RPCMethod utxoupdatepsbt()
         request.context,
         HidingSigningProvider(&provider, /*hide_secret=*/true, /*hide_origin=*/false),
         /*sighash_type=*/std::nullopt,
-        /*finalize=*/false);
+        /*finalize=*/false,
+        /*taproot_keypath_only=*/false);
 
     DataStream ssTx{};
     ssTx << psbtx;
@@ -2078,6 +2088,7 @@ RPCMethod descriptorprocesspsbt()
             "       \"SINGLE|ANYONECANPAY\""},
                     {"bip32derivs", RPCArg::Type::BOOL, RPCArg::Default{true}, "Include BIP 32 derivation paths for public keys if we know them"},
                     {"finalize", RPCArg::Type::BOOL, RPCArg::Default{true}, "Also finalize inputs if possible"},
+                    {"keypath_only", RPCArg::Type::BOOL, RPCArg::Default{false}, "Only add Taproot key-path data, and only sign and finalize Taproot inputs using the key path. Existing script-path data is not signed or finalized."},
                 },
                 RPCResult{
                     RPCResult::Type::OBJ, "", "",
@@ -2104,13 +2115,15 @@ RPCMethod descriptorprocesspsbt()
     std::optional<int> sighash_type = ParseSighashString(request.params[2]);
     bool bip32derivs = request.params[3].isNull() ? true : request.params[3].get_bool();
     bool finalize = request.params[4].isNull() ? true : request.params[4].get_bool();
+    bool keypath_only{request.params[5].isNull() ? false : request.params[5].get_bool()};
 
     const PartiallySignedTransaction& psbtx = ProcessPSBT(
         request.params[0].get_str(),
         request.context,
         HidingSigningProvider(&provider, /*hide_secret=*/false, !bip32derivs),
         sighash_type,
-        finalize);
+        finalize,
+        keypath_only);
 
     // Check whether or not all of the inputs are now correctly signed
     bool complete = true;
diff --git a/src/script/descriptor.cpp b/src/script/descriptor.cpp
index 5d9e62494726..919f9289605c 100644
--- a/src/script/descriptor.cpp
+++ b/src/script/descriptor.cpp
@@ -33,12 +33,14 @@
 #include <util/vector.h>
 
 #include <algorithm>
+#include <array>
 #include <compare>
 #include <iterator>
 #include <map>
 #include <memory>
 #include <numeric>
 #include <optional>
+#include <ranges>
 #include <span>
 #include <stdexcept>
 #include <string>
@@ -176,6 +178,68 @@ std::string AddChecksum(const std::string& str) { return str + "#" + DescriptorC
 
 typedef std::vector<uint32_t> KeyPath;
 
+/** Index of the last hardened derivation step in path, if any. */
+static std::optional<size_t> LastHardenedIndex(const KeyPath& path)
+{
+    for (size_t i = path.size(); i > 0; --i) {
+        if (path[i - 1] >> 31) return i - 1;
+    }
+    return std::nullopt;
+}
+
+/** Return the prefix through the last hardened derivation step.
+ *
+ *  @param[in] path Derivation path.
+ *  @return Prefix through the last hardened step, or an empty path if there is
+ *  no hardened step.
+ */
+static KeyPath HardenedPrefix(const KeyPath& path)
+{
+    const auto last_hardened{LastHardenedIndex(path)};
+    if (!last_hardened) return {};
+    return {path.begin(), path.begin() + *last_hardened + 1};
+}
+
+/** Format the normalized public form of a derived key: its origin followed by
+ *  the extended public key at the last hardened derivation step. */
+static std::string OriginKeyString(const KeyOriginInfo& origin, const CExtPubKey& xpub)
+{
+    return "[" + HexStr(origin.fingerprint) + FormatHDKeypath(origin.path) + "]" + EncodeExtPubKey(xpub);
+}
+
+/** Prefix the normalized public form of a key with an outer key origin,
+ *  formatted as origin_str (the fingerprint and derivation path). If the key
+ *  carries an origin of its own, its fingerprint is dropped and its path is
+ *  appended to the outer origin's path. */
+static std::string MergeNormalizedOrigin(const std::string& origin_str, const std::string& key_str)
+{
+    // A leading origin starts with '[' followed by an 8-character fingerprint
+    if (key_str.starts_with('[')) return "[" + origin_str + key_str.substr(9);
+    return "[" + origin_str + "]" + key_str;
+}
+
+/** Find the extended private key among xprvs from which xpub derives via origin. */
+static std::optional<CExtKey> FindOriginExtKey(const std::map<CExtPubKey, CExtKey>& xprvs, const KeyOriginInfo& origin, const CExtPubKey& xpub)
+{
+    for (const auto& [root_xpub, root_xprv] : xprvs) {
+        if (root_xpub.id_key_fingerprint() != origin.fingerprint) continue;
+        const auto derived{DeriveExtKey(root_xprv, origin.path)};
+        if (derived && derived->first.Neuter() == xpub) return root_xprv;
+    }
+    return std::nullopt;
+}
+
+/** A source-text replacement used by Parse() to construct the public form of a
+ *  multipath descriptor string. */
+struct KeyReplacement {
+    //! The text within the string being parsed
+    std::span<const char> text;
+    //! The replacement text
+    std::string replacement;
+    //! Whether the replacement keeps the multipath descriptor publicly derivable
+    bool publicly_derivable{true};
+};
+
 /** Interface for public key objects in descriptors. */
 struct PubkeyProvider
 {
@@ -299,15 +363,8 @@ class OriginPubkeyProvider final : public PubkeyProvider
     {
         std::string sub;
         if (!m_provider->ToNormalizedString(arg, sub, cache)) return false;
-        // If m_provider is a BIP32PubkeyProvider, we may get a string formatted like a OriginPubkeyProvider
-        // In that case, we need to strip out the leading square bracket and fingerprint from the substring,
-        // and append that to our own origin string.
-        if (sub[0] == '[') {
-            sub = sub.substr(9);
-            ret = "[" + OriginString(StringType::PUBLIC, /*normalized=*/true) + std::move(sub);
-        } else {
-            ret = "[" + OriginString(StringType::PUBLIC, /*normalized=*/true) + "]" + std::move(sub);
-        }
+        // If m_provider is a BIP32PubkeyProvider, sub may carry an origin of its own to merge with ours.
+        ret = MergeNormalizedOrigin(OriginString(StringType::PUBLIC, /*normalized=*/true), sub);
         return true;
     }
     void GetPrivKey(int pos, const SigningProvider& arg, FlatSigningProvider& out) const override
@@ -400,6 +457,71 @@ enum class DeriveType {
     HARDENED_RANGED,
 };
 
+/** Find the derivation prefix needed to normalize a private extended key in a
+ *  multipath descriptor to one public extended key covering every expanded path.
+ *
+ *  A hardened wildcard prevents normalization. For multipath derivation, a
+ *  hardened step at or after the multipath element prevents a single public
+ *  key from covering every path.
+ *
+ *  @param[in] paths Parsed derivation paths, after multipath expansion.
+ *  @param[in] type Derivation type of the key expression.
+ *  @return `std::nullopt` if the key cannot be normalized to a publicly
+ *  derivable form; otherwise the prefix through the last hardened step, empty
+ *  if there is no hardened step.
+ */
+static std::optional<KeyPath> MultipathExtKeyNormalizationPrefix(const std::vector<KeyPath>& paths, DeriveType type)
+{
+    if (type == DeriveType::HARDENED_RANGED) return std::nullopt;
+    if (paths.size() > 1) {
+        size_t common_prefix_size{0};
+        while (common_prefix_size < paths.front().size() &&
+               std::ranges::all_of(paths, [&](const KeyPath& path) { return path[common_prefix_size] == paths.front()[common_prefix_size]; })) {
+            ++common_prefix_size;
+        }
+        if (std::ranges::any_of(paths, [common_prefix_size](const KeyPath& path) {
+                const auto last_hardened{LastHardenedIndex(path)};
+                return last_hardened && common_prefix_size <= *last_hardened;
+            })) {
+            return std::nullopt;
+        }
+    }
+    return HardenedPrefix(paths.front());
+}
+
+/** Construct the source-text replacement for a parsed private extended key.
+ *
+ * When possible, normalize through the last hardened derivation step, matching
+ * Descriptor::ToNormalizedString(). A hardened multipath element or wildcard
+ * prevents producing a publicly derivable replacement.
+ *
+ * @param[in] split Key expression split at path separators, with the wildcard removed.
+ * @param[in] paths Parsed derivation paths, after multipath expansion.
+ * @param[in] type Derivation type of the key expression.
+ * @param[in] extkey Private extended key.
+ * @param[in] extpubkey Public form of `extkey`.
+ * @return Source span, its public replacement, and whether the replacement is
+ * publicly derivable.
+ */
+static KeyReplacement NormalizedExtKeyReplacement(const std::vector<std::span<const char>>& split, const std::vector<KeyPath>& paths, DeriveType type, const CExtKey& extkey, const CExtPubKey& extpubkey)
+{
+    KeyReplacement plain{split[0], EncodeExtPubKey(extpubkey)};
+    const auto prefix{MultipathExtKeyNormalizationPrefix(paths, type)};
+    if (!prefix) {
+        plain.publicly_derivable = false;
+        return plain;
+    }
+    if (prefix->empty()) return plain;
+    const auto derived{DeriveExtKey(extkey, *prefix)};
+    if (!derived) {
+        plain.publicly_derivable = false;
+        return plain;
+    }
+    // Replace from the key through the last hardened path element
+    const std::span<const char> text{split[0].data(), split[prefix->size()].data() + split[prefix->size()].size()};
+    return {text, OriginKeyString(derived->second, derived->first.Neuter())};
+}
+
 /** An object representing a parsed extended public key in a descriptor. */
 class BIP32PubkeyProvider final : public PubkeyProvider
 {
@@ -542,31 +664,18 @@ class BIP32PubkeyProvider final : public PubkeyProvider
 
             return true;
         }
-        // Step backwards to find the last hardened step in the path
-        int i = (int)m_path.size() - 1;
-        for (; i >= 0; --i) {
-            if (m_path.at(i) >> 31) {
-                break;
-            }
-        }
+        const KeyPath prefix{HardenedPrefix(m_path)};
         // Either no derivation or all unhardened derivation
-        if (i == -1) {
+        if (prefix.empty()) {
             out = ToString();
             return true;
         }
-        // Get the path to the last hardened stup
+        // The origin is the path up to and including the last hardened step
         KeyOriginInfo origin;
-        int k = 0;
-        for (; k <= i; ++k) {
-            // Add to the path
-            origin.path.push_back(m_path.at(k));
-        }
-        // Build the remaining path
-        KeyPath end_path;
-        for (; k < (int)m_path.size(); ++k) {
-            end_path.push_back(m_path.at(k));
-        }
+        origin.path = prefix;
         origin.fingerprint = m_root_extkey.id_key_fingerprint();
+        // Build the remaining path
+        const KeyPath end_path{m_path.begin() + prefix.size(), m_path.end()};
 
         CExtPubKey xpub;
         CExtKey lh_xprv;
@@ -583,8 +692,7 @@ class BIP32PubkeyProvider final : public PubkeyProvider
         assert(xpub.pubkey.IsValid());
 
         // Build the string
-        std::string origin_str = HexStr(origin.fingerprint) + FormatHDKeypath(origin.path);
-        out = "[" + origin_str + "]" + EncodeExtPubKey(xpub) + FormatHDKeypath(end_path);
+        out = OriginKeyString(origin, xpub) + FormatHDKeypath(end_path);
         if (IsRange()) {
             out += "/*";
             assert(m_derive == DeriveType::UNHARDENED_RANGED);
@@ -1925,88 +2033,138 @@ static DeriveType ParseDeriveType(std::vector<std::span<const char>>& split, boo
     return type;
 }
 
-/** Parse a public key that excludes origin information. */
-std::vector<std::unique_ptr<PubkeyProvider>> ParsePubkeyInner(uint32_t& key_exp_index, const std::span<const char>& sp, ParseScriptContext ctx, FlatSigningProvider& out, bool& apostrophe, std::string& error)
+/** Parsed providers and an optional replacement for ParsePubkey to collect
+ * after processing explicit key origin information. */
+struct ParsePubkeyInnerResult {
+    std::vector<std::unique_ptr<PubkeyProvider>> providers;
+    std::optional<KeyReplacement> key_replacement;
+    //! Whether a known extended private key replaced the explicit key origin
+    bool origin_absorbed{false};
+};
+using ParsePubkeyResult = std::vector<std::unique_ptr<PubkeyProvider>>;
+
+/** Mutable state shared by recursive descriptor parser calls. */
+struct ParseState {
+    uint32_t& key_exp_index;
+    FlatSigningProvider& out;
+    std::vector<KeyReplacement>* key_replacements{nullptr};
+    const std::map<CExtPubKey, CExtKey>* known_xprvs{nullptr};
+};
+
+/** Parse the key part of a key expression, after the caller split off any
+ *  origin information and parsed it into origin. The origin is only used to
+ *  match a known extended private key, which then replaces it by the full
+ *  derivation path in the providers. */
+util::Expected<ParsePubkeyInnerResult, std::string> ParsePubkeyInner(ParseState& state, const std::span<const char>& sp, ParseScriptContext ctx, bool& apostrophe, const KeyOriginInfo* origin)
 {
     std::vector<std::unique_ptr<PubkeyProvider>> ret;
+    // Return the replacement separately so ParsePubkey can incorporate an explicit
+    // origin before adding it to the parse state.
+    std::optional<KeyReplacement> key_replacement;
     bool permit_uncompressed = ctx == ParseScriptContext::TOP || ctx == ParseScriptContext::P2SH;
     auto split = Split(sp, '/');
     std::string str(split[0].begin(), split[0].end());
     if (str.size() == 0) {
-        error = "No key provided";
-        return {};
+        return util::Unexpected{"No key provided"};
     }
     if (IsSpace(str.front()) || IsSpace(str.back())) {
-        error = strprintf("Key '%s' is invalid due to whitespace", str);
-        return {};
+        return util::Unexpected{strprintf("Key '%s' is invalid due to whitespace", str)};
     }
     if (split.size() == 1) {
         if (IsHex(str)) {
+            // Hex keys need no public replacement, but normalize their case.
+            if (state.key_replacements) key_replacement = KeyReplacement{split[0], ToLower(str)};
             std::vector<unsigned char> data = ParseHex(str);
             CPubKey pubkey(data);
             if (pubkey.IsValid() && !pubkey.IsValidNonHybrid()) {
-                error = "Hybrid public keys are not allowed";
-                return {};
+                return util::Unexpected{"Hybrid public keys are not allowed"};
             }
             if (pubkey.IsFullyValid()) {
                 if (permit_uncompressed || pubkey.IsCompressed()) {
-                    ret.emplace_back(std::make_unique<ConstPubkeyProvider>(key_exp_index, pubkey, false));
-                    ++key_exp_index;
-                    return ret;
+                    ret.emplace_back(std::make_unique<ConstPubkeyProvider>(state.key_exp_index, pubkey, false));
+                    ++state.key_exp_index;
+                    return ParsePubkeyInnerResult{std::move(ret), std::move(key_replacement)};
                 } else {
-                    error = "Uncompressed keys are not allowed";
-                    return {};
+                    return util::Unexpected{"Uncompressed keys are not allowed"};
                 }
             } else if (data.size() == 32 && ctx == ParseScriptContext::P2TR) {
                 unsigned char fullkey[33] = {0x02};
                 std::copy(data.begin(), data.end(), fullkey + 1);
                 pubkey.Set(std::begin(fullkey), std::end(fullkey));
                 if (pubkey.IsFullyValid()) {
-                    ret.emplace_back(std::make_unique<ConstPubkeyProvider>(key_exp_index, pubkey, true));
-                    ++key_exp_index;
-                    return ret;
+                    ret.emplace_back(std::make_unique<ConstPubkeyProvider>(state.key_exp_index, pubkey, true));
+                    ++state.key_exp_index;
+                    return ParsePubkeyInnerResult{std::move(ret), std::move(key_replacement)};
                 }
             }
-            error = strprintf("Pubkey '%s' is invalid", str);
-            return {};
+            return util::Unexpected{strprintf("Pubkey '%s' is invalid", str)};
         }
         CKey key = DecodeSecret(str);
         if (key.IsValid()) {
             if (permit_uncompressed || key.IsCompressed()) {
                 CPubKey pubkey = key.GetPubKey();
-                out.keys.emplace(pubkey.GetID(), key);
-                ret.emplace_back(std::make_unique<ConstPubkeyProvider>(key_exp_index, pubkey, ctx == ParseScriptContext::P2TR));
-                ++key_exp_index;
-                return ret;
+                state.out.keys.emplace(pubkey.GetID(), key);
+                if (state.key_replacements) {
+                    std::string replacement{ctx == ParseScriptContext::P2TR ? HexStr(XOnlyPubKey{pubkey}) : HexStr(pubkey)};
+                    key_replacement = KeyReplacement{split[0], std::move(replacement)};
+                }
+                ret.emplace_back(std::make_unique<ConstPubkeyProvider>(state.key_exp_index, pubkey, ctx == ParseScriptContext::P2TR));
+                ++state.key_exp_index;
+                return ParsePubkeyInnerResult{std::move(ret), std::move(key_replacement)};
             } else {
-                error = "Uncompressed keys are not allowed";
-                return {};
+                return util::Unexpected{"Uncompressed keys are not allowed"};
             }
         }
     }
     CExtKey extkey = DecodeExtKey(str);
     CExtPubKey extpubkey = DecodeExtPubKey(str);
     if (!extkey.key.IsValid() && !extpubkey.pubkey.IsValid()) {
-        error = strprintf("key '%s' is not valid", str);
-        return {};
+        return util::Unexpected{strprintf("key '%s' is not valid", str)};
     }
     std::vector<KeyPath> paths;
     DeriveType type = ParseDeriveType(split, apostrophe);
-    if (!ParseKeyPath(split, paths, apostrophe, error, /*allow_multipath=*/true)) return {};
+    bool has_hardened_path{false};
+    std::string error;
+    if (!ParseKeyPath(split, paths, apostrophe, error, /*allow_multipath=*/true, has_hardened_path)) return util::Unexpected{std::move(error)};
+    const bool has_hardened_derivation{type == DeriveType::HARDENED_RANGED || has_hardened_path};
+    bool origin_absorbed{false};
     if (extkey.key.IsValid()) {
         extpubkey = extkey.Neuter();
-        out.keys.emplace(extpubkey.pubkey.GetID(), extkey.key);
+        state.out.keys.emplace(extpubkey.pubkey.GetID(), extkey.key);
+        if (state.key_replacements) key_replacement = NormalizedExtKeyReplacement(split, paths, type, extkey, extpubkey);
+    } else {
+        if (state.key_replacements && has_hardened_derivation) {
+            key_replacement = KeyReplacement{split[0], str, /*publicly_derivable=*/false};
+        }
+        // Fill in a known private key. The multipath replacement above is
+        // left as is: known keys do not change the multipath descriptor.
+        if (state.known_xprvs) {
+            if (const auto it{state.known_xprvs->find(extpubkey)}; it != state.known_xprvs->end()) {
+                // The key expression names a known key directly. Keep the
+                // expression, and provide the private key as if the
+                // descriptor had contained it.
+                state.out.keys.emplace(extpubkey.pubkey.GetID(), it->second.key);
+            } else if (const auto root{origin ? FindOriginExtKey(*state.known_xprvs, *origin, extpubkey) : std::nullopt}) {
+                // The key expression names a child of a known key. Replace
+                // the origin and the child key by the known key and the full
+                // path, like a descriptor containing that key.
+                extpubkey = root->Neuter();
+                state.out.keys.emplace(extpubkey.pubkey.GetID(), root->key);
+                for (auto& path : paths) path.insert(path.begin(), origin->path.begin(), origin->path.end());
+                origin_absorbed = true;
+            }
+        }
     }
     for (auto& path : paths) {
-        ret.emplace_back(std::make_unique<BIP32PubkeyProvider>(key_exp_index, extpubkey, std::move(path), type, apostrophe));
+        ret.emplace_back(std::make_unique<BIP32PubkeyProvider>(state.key_exp_index, extpubkey, std::move(path), type, apostrophe));
     }
-    ++key_exp_index;
-    return ret;
+    ++state.key_exp_index;
+    return ParsePubkeyInnerResult{std::move(ret), std::move(key_replacement), origin_absorbed};
 }
 
 /** Parse a public key including origin information (if enabled). */
 // NOLINTNEXTLINE(misc-no-recursion)
-std::vector<std::unique_ptr<PubkeyProvider>> ParsePubkey(uint32_t& key_exp_index, const std::span<const char>& sp, ParseScriptContext ctx, FlatSigningProvider& out, std::string& error)
+util::Expected<ParsePubkeyResult, std::string> ParsePubkey(ParseState& state, const std::span<const char>& sp, ParseScriptContext ctx)
 {
     std::vector<std::unique_ptr<PubkeyProvider>> ret;
 
@@ -2016,21 +2174,18 @@ std::vector<std::unique_ptr<PubkeyProvider>> ParsePubkey(uint32_t& key_exp_index
     std::span<const char> span = sp;
     if (Const("musig(", span, /*skip=*/false)) {
         if (ctx != ParseScriptContext::P2TR) {
-            error = "musig() is only allowed in tr() and rawtr()";
-            return {};
+            return util::Unexpected{"musig() is only allowed in tr() and rawtr()"};
         }
 
         // Split the span on the end parentheses. The end parentheses must
         // be included in the resulting span so that Expr is happy.
         auto split = Split(sp, ')', /*include_sep=*/true);
         if (split.size() > 2) {
-            error = "Too many ')' in musig() expression";
-            return {};
+            return util::Unexpected{"Too many ')' in musig() expression"};
         }
         std::span<const char> expr(split.at(0).begin(), split.at(0).end());
         if (!Func("musig", expr)) {
-            error = "Invalid musig() expression";
-            return {};
+            return util::Unexpected{"Invalid musig() expression"};
         }
 
         // Parse the participant pubkeys
@@ -2041,15 +2196,12 @@ std::vector<std::unique_ptr<PubkeyProvider>> ParsePubkey(uint32_t& key_exp_index
         size_t max_multipath_len = 0;
         while (expr.size()) {
             if (any_key_parsed && !Const(",", expr)) {
-                error = strprintf("musig(): expected ',', got '%c'", expr[0]);
-                return {};
+                return util::Unexpected{strprintf("musig(): expected ',', got '%c'", expr[0])};
             }
             auto arg = Expr(expr);
-            auto pk = ParsePubkey(key_exp_index, arg, ParseScriptContext::MUSIG, out, error);
-            if (pk.empty()) {
-                error = strprintf("musig(): %s", error);
-                return {};
-            }
+            auto result = ParsePubkey(state, arg, ParseScriptContext::MUSIG);
+            if (!result) return util::Unexpected{strprintf("musig(): %s", result.error())};
+            auto pk = std::move(*result);
             any_key_parsed = true;
 
             any_ranged = any_ranged || pk.at(0)->IsRange();
@@ -2060,8 +2212,7 @@ std::vector<std::unique_ptr<PubkeyProvider>> ParsePubkey(uint32_t& key_exp_index
             providers.emplace_back(std::move(pk));
         }
         if (!any_key_parsed) {
-            error = "musig(): Must contain key expressions";
-            return {};
+            return util::Unexpected{"musig(): Must contain key expressions"};
         }
 
         // Parse any derivation
@@ -2069,28 +2220,24 @@ std::vector<std::unique_ptr<PubkeyProvider>> ParsePubkey(uint32_t& key_exp_index
         std::vector<KeyPath> derivation_multipaths;
         if (split.size() == 2 && Const("/", split.at(1), /*skip=*/false)) {
             if (!all_bip32) {
-                error = "musig(): derivation requires all participants to be xpubs or xprvs";
-                return {};
+                return util::Unexpected{"musig(): derivation requires all participants to be xpubs or xprvs"};
             }
             if (any_ranged) {
-                error = "musig(): Cannot have ranged participant keys if musig() also has derivation";
-                return {};
+                return util::Unexpected{"musig(): Cannot have ranged participant keys if musig() also has derivation"};
             }
             bool dummy = false;
             auto deriv_split = Split(split.at(1), '/');
             deriv_type = ParseDeriveType(deriv_split, dummy);
             if (deriv_type == DeriveType::HARDENED_RANGED) {
-                error = "musig(): Cannot have hardened child derivation";
-                return {};
+                return util::Unexpected{"musig(): Cannot have hardened child derivation"};
             }
             bool has_hardened = false;
+            std::string error;
             if (!ParseKeyPath(deriv_split, derivation_multipaths, dummy, error, /*allow_multipath=*/true, has_hardened)) {
-                error = "musig(): " + error;
-                return {};
+                return util::Unexpected{"musig(): " + error};
             }
             if (has_hardened) {
-                error = "musig(): cannot have hardened derivation steps";
-                return {};
+                return util::Unexpected{"musig(): cannot have hardened derivation steps"};
             }
         } else {
             derivation_multipaths.emplace_back();
@@ -2113,23 +2260,21 @@ std::vector<std::unique_ptr<PubkeyProvider>> ParsePubkey(uint32_t& key_exp_index
 
         // Emplace the final MuSigPubkeyProvider into ret with the pubkey providers from the specified provider vectors index
         // and the path from the specified path index
-        const auto& emplace_final_provider = [&ret, &key_exp_index, &deriv_type, &derivation_multipaths, &providers](size_t vec_idx, size_t path_idx) -> void {
+        const auto& emplace_final_provider = [&ret, &state, &deriv_type, &derivation_multipaths, &providers](size_t vec_idx, size_t path_idx) -> void {
             KeyPath& path = derivation_multipaths.at(path_idx);
             std::vector<std::unique_ptr<PubkeyProvider>> pubs;
             pubs.reserve(providers.size());
             for (auto& vec : providers) {
                 pubs.emplace_back(std::move(vec.at(vec_idx)));
             }
-            ret.emplace_back(std::make_unique<MuSigPubkeyProvider>(key_exp_index, std::move(pubs), path, deriv_type));
+            ret.emplace_back(std::make_unique<MuSigPubkeyProvider>(state.key_exp_index, std::move(pubs), path, deriv_type));
         };
 
         if (max_multipath_len > 1 && derivation_multipaths.size() > 1) {
-            error = "musig(): Cannot have multipath participant keys if musig() is also multipath";
-            return {};
+            return util::Unexpected{"musig(): Cannot have multipath participant keys if musig() is also multipath"};
         } else if (max_multipath_len > 1) {
             if (!clone_providers(max_multipath_len)) {
-                error = strprintf("musig(): Multipath derivation paths have mismatched lengths");
-                return {};
+                return util::Unexpected{"musig(): Multipath derivation paths have mismatched lengths"};
             }
             for (size_t i = 0; i < max_multipath_len; ++i) {
                 // Final MuSigPubkeyProvider uses participant pubkey providers at each multipath position, and the first (and only) path
@@ -2138,8 +2283,7 @@ std::vector<std::unique_ptr<PubkeyProvider>> ParsePubkey(uint32_t& key_exp_index
         } else if (derivation_multipaths.size() > 1) {
             // All key provider vectors should be length 1. Clone them until they have the same length as paths
             if (!Assume(clone_providers(derivation_multipaths.size()))) {
-                error = "musig(): Multipath derivation path with multipath participants is disallowed"; // This error is unreachable due to earlier check
-                return {};
+                return util::Unexpected{"musig(): Multipath derivation path with multipath participants is disallowed"}; // This error is unreachable due to earlier check
             }
             for (size_t i = 0; i < derivation_multipaths.size(); ++i) {
                 // Final MuSigPubkeyProvider uses cloned participant pubkey providers, and the multipath derivation paths
@@ -2149,34 +2293,39 @@ std::vector<std::unique_ptr<PubkeyProvider>> ParsePubkey(uint32_t& key_exp_index
             // No multipath derivation, MuSigPubkeyProvider uses the first (and only) participant pubkey providers, and the first (and only) path
             emplace_final_provider(0, 0);
         }
-        ++key_exp_index; // Increment key expression index for the MuSigPubkeyProvider too
+        ++state.key_exp_index; // Increment key expression index for the MuSigPubkeyProvider too
         return ret;
     }
 
+    // Split the optional "[fingerprint/path]" origin from the key.
     auto origin_split = Split(sp, ']');
     if (origin_split.size() > 2) {
-        error = "Multiple ']' characters found for a single pubkey";
-        return {};
+        return util::Unexpected{"Multiple ']' characters found for a single pubkey"};
     }
     // This is set if either the origin or path suffix contains a hardened derivation.
     bool apostrophe = false;
     if (origin_split.size() == 1) {
-        return ParsePubkeyInner(key_exp_index, origin_split[0], ctx, out, apostrophe, error);
-    }
+        // With no closing ']', there is no complete origin to apply. Parse the
+        // entire expression as a key and collect its replacement unchanged.
+        auto result = ParsePubkeyInner(state, origin_split[0], ctx, apostrophe, /*origin=*/nullptr);
+        if (!result) return util::Unexpected{std::move(result.error())};
+        if (result->key_replacement) state.key_replacements->push_back(std::move(*result->key_replacement));
+        return std::move(result->providers);
+    }
+    // The only remaining case has one closing ']', whose prefix must start with '['.
+    Assume(origin_split.size() == 2);
     if (origin_split[0].empty() || origin_split[0][0] != '[') {
-        error = strprintf("Key origin start '[ character expected but not found, got '%c' instead",
-                          origin_split[0].empty() ? /** empty, implies split char */ ']' : origin_split[0][0]);
-        return {};
+        const std::string error{strprintf("Key origin start '[ character expected but not found, got '%c' instead",
+                                          origin_split[0].empty() ? /** empty, implies split char */ ']' : origin_split[0][0])};
+        return util::Unexpected{error};
     }
     auto slash_split = Split(origin_split[0].subspan(1), '/');
     if (slash_split[0].size() != 8) {
-        error = strprintf("Fingerprint is not 4 bytes (%u characters instead of 8 characters)", slash_split[0].size());
-        return {};
+        return util::Unexpected{strprintf("Fingerprint is not 4 bytes (%u characters instead of 8 characters)", slash_split[0].size())};
     }
     std::string fpr_hex = std::string(slash_split[0].begin(), slash_split[0].end());
     if (!IsHex(fpr_hex)) {
-        error = strprintf("Fingerprint '%s' is not hex", fpr_hex);
-        return {};
+        return util::Unexpected{strprintf("Fingerprint '%s' is not hex", fpr_hex)};
     }
     auto fpr_bytes = ParseHex(fpr_hex);
     KeyOriginInfo info;
@@ -2184,10 +2333,27 @@ std::vector<std::unique_ptr<PubkeyProvider>> ParsePubkey(uint32_t& key_exp_index
     assert(fpr_bytes.size() == 4);
     std::copy_n(fpr_bytes.begin(), info.fingerprint.size(), info.fingerprint.begin());
     std::vector<KeyPath> path;
-    if (!ParseKeyPath(slash_split, path, apostrophe, error, /*allow_multipath=*/false)) return {};
+    std::string error;
+    if (!ParseKeyPath(slash_split, path, apostrophe, error, /*allow_multipath=*/false)) return util::Unexpected{std::move(error)};
     info.path = path.at(0);
-    auto providers = ParsePubkeyInner(key_exp_index, origin_split[1], ctx, out, apostrophe, error);
-    if (providers.empty()) return {};
+    auto result = ParsePubkeyInner(state, origin_split[1], ctx, apostrophe, &info);
+    if (!result) return util::Unexpected{std::move(result.error())};
+    auto [providers, key_replacement, origin_absorbed] = std::move(*result);
+    if (key_replacement) {
+        // Include the explicit origin in the replacement, merging it with any
+        // origin produced by normalization, like OriginPubkeyProvider does.
+        key_replacement->replacement = MergeNormalizedOrigin(HexStr(info.fingerprint) + FormatHDKeypath(info.path), key_replacement->replacement);
+        key_replacement->text = std::span<const char>{sp.data(), key_replacement->text.data() + key_replacement->text.size()};
+        state.key_replacements->push_back(std::move(*key_replacement));
+    } else if (state.key_replacements) {
+        // The key needs no replacement, but the explicit origin may use
+        // apostrophe hardened markers or uppercase fingerprint hex. Replace it
+        // with its normalized form, like OriginPubkeyProvider does.
+        const std::span<const char> origin_text{sp.data(), origin_split[0].size() + 1};
+        state.key_replacements->push_back({origin_text, "[" + HexStr(info.fingerprint) + FormatHDKeypath(info.path) + "]"});
+    }
+    // A known key already accounts for the origin in the providers' paths.
+    if (origin_absorbed) return std::move(providers);
     ret.reserve(providers.size());
     for (auto& prov : providers) {
         ret.emplace_back(std::make_unique<OriginPubkeyProvider>(prov->m_expr_index, info, std::move(prov), apostrophe));
@@ -2242,10 +2408,15 @@ struct KeyParser {
     const miniscript::MiniscriptContext m_script_ctx;
     //! The current key expression index
     uint32_t& m_expr_index;
+    //! Source-text replacements collected while parsing Miniscript keys, if requested.
+    std::vector<KeyReplacement>* m_key_replacements;
+    //! Extended private keys known to the caller, if any.
+    const std::map<CExtPubKey, CExtKey>* m_known_xprvs;
 
     KeyParser(FlatSigningProvider* out LIFETIMEBOUND, const SigningProvider* in LIFETIMEBOUND,
-              miniscript::MiniscriptContext ctx, uint32_t& key_exp_index LIFETIMEBOUND)
-        : m_out(out), m_in(in), m_script_ctx(ctx), m_expr_index(key_exp_index) {}
+              miniscript::MiniscriptContext ctx, uint32_t& key_exp_index LIFETIMEBOUND,
+              std::vector<KeyReplacement>* key_replacements = nullptr, const std::map<CExtPubKey, CExtKey>* known_xprvs = nullptr)
+        : m_out(out), m_in(in), m_script_ctx(ctx), m_expr_index(key_exp_index), m_key_replacements(key_replacements), m_known_xprvs(known_xprvs) {}
 
     bool KeyCompare(const Key& a, const Key& b) const {
         // Deriving a hardened step needs the private key, so use the provider that was filled
@@ -2275,9 +2446,13 @@ struct KeyParser {
     {
         assert(m_out);
         Key key = m_keys.size();
-        auto pk = ParsePubkey(m_expr_index, in, ParseContext(), *m_out, m_key_parsing_error);
-        if (pk.empty()) return {};
-        m_keys.emplace_back(std::move(pk));
+        ParseState state{m_expr_index, *m_out, m_key_replacements, m_known_xprvs};
+        auto result = ParsePubkey(state, in, ParseContext());
+        if (!result) {
+            m_key_parsing_error = std::move(result.error());
+            return {};
+        }
+        m_keys.emplace_back(std::move(*result));
         return key;
     }
 
@@ -2334,48 +2509,43 @@ struct KeyParser {
 };
 
 /** Parse a script in a particular context. */
+using ParseScriptResult = std::vector<std::unique_ptr<DescriptorImpl>>;
+
 // NOLINTNEXTLINE(misc-no-recursion)
-std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index, std::span<const char>& sp, ParseScriptContext ctx, FlatSigningProvider& out, std::string& error)
+util::Expected<ParseScriptResult, std::string> ParseScript(ParseState& state, std::span<const char>& sp, ParseScriptContext ctx)
 {
     using namespace script;
     Assume(ctx == ParseScriptContext::TOP || ctx == ParseScriptContext::P2SH || ctx == ParseScriptContext::P2WSH || ctx == ParseScriptContext::P2TR);
     std::vector<std::unique_ptr<DescriptorImpl>> ret;
     auto expr = Expr(sp);
     if (Func("pk", expr)) {
-        auto pubkeys = ParsePubkey(key_exp_index, expr, ctx, out, error);
-        if (pubkeys.empty()) {
-            error = strprintf("pk(): %s", error);
-            return {};
-        }
+        auto result = ParsePubkey(state, expr, ctx);
+        if (!result) return util::Unexpected{strprintf("pk(): %s", result.error())};
+        auto pubkeys = std::move(*result);
         for (auto& pubkey : pubkeys) {
             ret.emplace_back(std::make_unique<PKDescriptor>(std::move(pubkey), ctx == ParseScriptContext::P2TR));
         }
         return ret;
     }
     if ((ctx == ParseScriptContext::TOP || ctx == ParseScriptContext::P2SH || ctx == ParseScriptContext::P2WSH) && Func("pkh", expr)) {
-        auto pubkeys = ParsePubkey(key_exp_index, expr, ctx, out, error);
-        if (pubkeys.empty()) {
-            error = strprintf("pkh(): %s", error);
-            return {};
-        }
+        auto result = ParsePubkey(state, expr, ctx);
+        if (!result) return util::Unexpected{strprintf("pkh(): %s", result.error())};
+        auto pubkeys = std::move(*result);
         for (auto& pubkey : pubkeys) {
             ret.emplace_back(std::make_unique<PKHDescriptor>(std::move(pubkey)));
         }
         return ret;
     }
     if (ctx == ParseScriptContext::TOP && Func("combo", expr)) {
-        auto pubkeys = ParsePubkey(key_exp_index, expr, ctx, out, error);
-        if (pubkeys.empty()) {
-            error = strprintf("combo(): %s", error);
-            return {};
-        }
+        auto result = ParsePubkey(state, expr, ctx);
+        if (!result) return util::Unexpected{strprintf("combo(): %s", result.error())};
+        auto pubkeys = std::move(*result);
         for (auto& pubkey : pubkeys) {
             ret.emplace_back(std::make_unique<ComboDescriptor>(std::move(pubkey)));
         }
         return ret;
     } else if (Func("combo", expr)) {
-        error = "Can only have combo() at top level";
-        return {};
+        return util::Unexpected{"Can only have combo() at top level"};
     }
     const bool multi = Func("multi", expr);
     const bool sortedmulti = !multi && Func("sortedmulti", expr);
@@ -2389,50 +2559,40 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
         if (const auto maybe_thres{ToIntegral<uint32_t>(std::string_view{threshold.begin(), threshold.end()})}) {
             thres = *maybe_thres;
         } else {
-            error = strprintf("Multi threshold '%s' is not valid", std::string(threshold.begin(), threshold.end()));
-            return {};
+            return util::Unexpected{strprintf("Multi threshold '%s' is not valid", std::string(threshold.begin(), threshold.end()))};
         }
         size_t script_size = 0;
         size_t max_providers_len = 0;
         while (expr.size()) {
             if (!Const(",", expr)) {
-                error = strprintf("Multi: expected ',', got '%c'", expr[0]);
-                return {};
+                return util::Unexpected{strprintf("Multi: expected ',', got '%c'", expr[0])};
             }
             auto arg = Expr(expr);
-            auto pks = ParsePubkey(key_exp_index, arg, ctx, out, error);
-            if (pks.empty()) {
-                error = strprintf("Multi: %s", error);
-                return {};
-            }
+            auto result = ParsePubkey(state, arg, ctx);
+            if (!result) return util::Unexpected{strprintf("Multi: %s", result.error())};
+            auto pks = std::move(*result);
             script_size += pks.at(0)->GetSize() + 1;
             max_providers_len = std::max(max_providers_len, pks.size());
             providers.emplace_back(std::move(pks));
         }
         if ((multi || sortedmulti) && (providers.empty() || providers.size() > MAX_PUBKEYS_PER_MULTISIG)) {
-            error = strprintf("Cannot have %u keys in multisig; must have between 1 and %d keys, inclusive", providers.size(), MAX_PUBKEYS_PER_MULTISIG);
-            return {};
+            return util::Unexpected{strprintf("Cannot have %u keys in multisig; must have between 1 and %d keys, inclusive", providers.size(), MAX_PUBKEYS_PER_MULTISIG)};
         } else if ((multi_a || sortedmulti_a) && (providers.empty() || providers.size() > MAX_PUBKEYS_PER_MULTI_A)) {
-            error = strprintf("Cannot have %u keys in multi_a; must have between 1 and %d keys, inclusive", providers.size(), MAX_PUBKEYS_PER_MULTI_A);
-            return {};
+            return util::Unexpected{strprintf("Cannot have %u keys in multi_a; must have between 1 and %d keys, inclusive", providers.size(), MAX_PUBKEYS_PER_MULTI_A)};
         } else if (thres < 1) {
-            error = strprintf("Multisig threshold cannot be %d, must be at least 1", thres);
-            return {};
+            return util::Unexpected{strprintf("Multisig threshold cannot be %d, must be at least 1", thres)};
         } else if (thres > providers.size()) {
-            error = strprintf("Multisig threshold cannot be larger than the number of keys; threshold is %d but only %u keys specified", thres, providers.size());
-            return {};
+            return util::Unexpected{strprintf("Multisig threshold cannot be larger than the number of keys; threshold is %d but only %u keys specified", thres, providers.size())};
         }
         if (ctx == ParseScriptContext::TOP) {
             if (providers.size() > 3) {
-                error = strprintf("Cannot have %u pubkeys in bare multisig; only at most 3 pubkeys", providers.size());
-                return {};
+                return util::Unexpected{strprintf("Cannot have %u pubkeys in bare multisig; only at most 3 pubkeys", providers.size())};
             }
         }
         if (ctx == ParseScriptContext::P2SH) {
             // This limits the maximum number of compressed pubkeys to 15.
             if (script_size + 3 > MAX_SCRIPT_ELEMENT_SIZE) {
-                error = strprintf("P2SH script is too large, %d bytes is larger than %d bytes", script_size + 3, MAX_SCRIPT_ELEMENT_SIZE);
-                return {};
+                return util::Unexpected{strprintf("P2SH script is too large, %d bytes is larger than %d bytes", script_size + 3, MAX_SCRIPT_ELEMENT_SIZE)};
             }
         }
 
@@ -2444,8 +2604,7 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
                     vec.emplace_back(vec.at(0)->Clone());
                 }
             } else if (vec.size() != max_providers_len) {
-                error = strprintf("multi(): Multipath derivation paths have mismatched lengths");
-                return {};
+                return util::Unexpected{"multi(): Multipath derivation paths have mismatched lengths"};
             }
         }
 
@@ -2465,29 +2624,26 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
         }
         return ret;
     } else if (multi || sortedmulti) {
-        error = "Can only have multi/sortedmulti at top level, in sh(), or in wsh()";
-        return {};
+        return util::Unexpected{"Can only have multi/sortedmulti at top level, in sh(), or in wsh()"};
     } else if (multi_a || sortedmulti_a) {
-        error = "Can only have multi_a/sortedmulti_a inside tr()";
-        return {};
+        return util::Unexpected{"Can only have multi_a/sortedmulti_a inside tr()"};
     }
     if ((ctx == ParseScriptContext::TOP || ctx == ParseScriptContext::P2SH) && Func("wpkh", expr)) {
-        auto pubkeys = ParsePubkey(key_exp_index, expr, ParseScriptContext::P2WPKH, out, error);
-        if (pubkeys.empty()) {
-            error = strprintf("wpkh(): %s", error);
-            return {};
-        }
+        auto result = ParsePubkey(state, expr, ParseScriptContext::P2WPKH);
+        if (!result) return util::Unexpected{strprintf("wpkh(): %s", result.error())};
+        auto pubkeys = std::move(*result);
         for (auto& pubkey : pubkeys) {
             ret.emplace_back(std::make_unique<WPKHDescriptor>(std::move(pubkey)));
         }
         return ret;
     } else if (Func("wpkh", expr)) {
-        error = "Can only have wpkh() at top level or inside sh()";
-        return {};
+        return util::Unexpected{"Can only have wpkh() at top level or inside sh()"};
     }
     if (ctx == ParseScriptContext::TOP && Func("sh", expr)) {
-        auto descs = ParseScript(key_exp_index, expr, ParseScriptContext::P2SH, out, error);
-        if (descs.empty() || expr.size()) return {};
+        auto result = ParseScript(state, expr, ParseScriptContext::P2SH);
+        if (!result) return util::Unexpected{std::move(result.error())};
+        if (expr.size()) return util::Unexpected{""};
+        auto descs = std::move(*result);
         std::vector<std::unique_ptr<DescriptorImpl>> ret;
         ret.reserve(descs.size());
         for (auto& desc : descs) {
@@ -2495,46 +2651,41 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
         }
         return ret;
     } else if (Func("sh", expr)) {
-        error = "Can only have sh() at top level";
-        return {};
+        return util::Unexpected{"Can only have sh() at top level"};
     }
     if ((ctx == ParseScriptContext::TOP || ctx == ParseScriptContext::P2SH) && Func("wsh", expr)) {
-        auto descs = ParseScript(key_exp_index, expr, ParseScriptContext::P2WSH, out, error);
-        if (descs.empty() || expr.size()) return {};
+        auto result = ParseScript(state, expr, ParseScriptContext::P2WSH);
+        if (!result) return util::Unexpected{std::move(result.error())};
+        if (expr.size()) return util::Unexpected{""};
+        auto descs = std::move(*result);
         for (auto& desc : descs) {
             ret.emplace_back(std::make_unique<WSHDescriptor>(std::move(desc)));
         }
         return ret;
     } else if (Func("wsh", expr)) {
-        error = "Can only have wsh() at top level or inside sh()";
-        return {};
+        return util::Unexpected{"Can only have wsh() at top level or inside sh()"};
     }
     if (ctx == ParseScriptContext::TOP && Func("addr", expr)) {
         CTxDestination dest = DecodeDestination(std::string(expr.begin(), expr.end()));
         if (!IsValidDestination(dest)) {
-            error = "Address is not valid";
-            return {};
+            return util::Unexpected{"Address is not valid"};
         }
         ret.emplace_back(std::make_unique<AddressDescriptor>(std::move(dest)));
         return ret;
     } else if (Func("addr", expr)) {
-        error = "Can only have addr() at top level";
-        return {};
+        return util::Unexpected{"Can only have addr() at top level"};
     }
     if (ctx == ParseScriptContext::TOP && Func("tr", expr)) {
         auto arg = Expr(expr);
-        auto internal_keys = ParsePubkey(key_exp_index, arg, ParseScriptContext::P2TR, out, error);
-        if (internal_keys.empty()) {
-            error = strprintf("tr(): %s", error);
-            return {};
-        }
+        auto result = ParsePubkey(state, arg, ParseScriptContext::P2TR);
+        if (!result) return util::Unexpected{strprintf("tr(): %s", result.error())};
+        auto internal_keys = std::move(*result);
         size_t max_providers_len = internal_keys.size();
         std::vector<std::vector<std::unique_ptr<DescriptorImpl>>> subscripts; //!< list of multipath expanded script subexpressions
         std::vector<int> depths; //!< depth in the tree of each subexpression (same length subscripts)
         if (expr.size()) {
             if (!Const(",", expr)) {
-                error = strprintf("tr: expected ',', got '%c'", expr[0]);
-                return {};
+                return util::Unexpected{strprintf("tr: expected ',', got '%c'", expr[0])};
             }
             /** The path from the top of the tree to what we're currently processing.
              * branches[i] == false: left branch in the i'th step from the top; true: right branch.
@@ -2547,37 +2698,35 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
                 while (Const("{", expr)) {
                     branches.push_back(false); // new left branch
                     if (branches.size() > TAPROOT_CONTROL_MAX_NODE_COUNT) {
-                        error = strprintf("tr() supports at most %i nesting levels", TAPROOT_CONTROL_MAX_NODE_COUNT);
-                        return {};
+                        return util::Unexpected{strprintf("tr() supports at most %i nesting levels", TAPROOT_CONTROL_MAX_NODE_COUNT)};
                     }
                 }
                 // Process the actual script expression.
                 auto sarg = Expr(expr);
-                subscripts.emplace_back(ParseScript(key_exp_index, sarg, ParseScriptContext::P2TR, out, error));
-                if (subscripts.back().empty()) return {};
+                auto subscript_result = ParseScript(state, sarg, ParseScriptContext::P2TR);
+                if (!subscript_result) return util::Unexpected{std::move(subscript_result.error())};
+                auto subscript = std::move(*subscript_result);
+                subscripts.emplace_back(std::move(subscript));
                 max_providers_len = std::max(max_providers_len, subscripts.back().size());
                 depths.push_back(branches.size());
                 // Process closing braces; one is expected for every right branch we were in.
                 while (branches.size() && branches.back()) {
                     if (!Const("}", expr)) {
-                        error = strprintf("tr(): expected '}' after script expression");
-                        return {};
+                        return util::Unexpected{"tr(): expected '}' after script expression"};
                     }
                     branches.pop_back(); // move up one level after encountering '}'
                 }
                 // If after that, we're at the end of a left branch, expect a comma.
                 if (branches.size() && !branches.back()) {
                     if (!Const(",", expr)) {
-                        error = strprintf("tr(): expected ',' after script expression");
-                        return {};
+                        return util::Unexpected{"tr(): expected ',' after script expression"};
                     }
                     branches.back() = true; // And now we're in a right branch.
                 }
             } while (branches.size());
             // After we've explored a whole tree, we must be at the end of the expression.
             if (expr.size()) {
-                error = strprintf("tr(): expected ')' after script expression");
-                return {};
+                return util::Unexpected{"tr(): expected ')' after script expression"};
             }
         }
         assert(TaprootBuilder::ValidDepths(depths));
@@ -2590,14 +2739,12 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
                     vec.emplace_back(vec.at(0)->Clone());
                 }
             } else if (vec.size() != max_providers_len) {
-                error = strprintf("tr(): Multipath subscripts have mismatched lengths");
-                return {};
+                return util::Unexpected{"tr(): Multipath subscripts have mismatched lengths"};
             }
         }
 
         if (internal_keys.size() > 1 && internal_keys.size() != max_providers_len) {
-            error = strprintf("tr(): Multipath internal key mismatches multipath subscripts lengths");
-            return {};
+            return util::Unexpected{"tr(): Multipath internal key mismatches multipath subscripts lengths"};
         }
 
         while (internal_keys.size() < max_providers_len) {
@@ -2618,81 +2765,69 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
 
 
     } else if (Func("tr", expr)) {
-        error = "Can only have tr at top level";
-        return {};
+        return util::Unexpected{"Can only have tr at top level"};
     }
     if (ctx == ParseScriptContext::TOP && Func("rawtr", expr)) {
         auto arg = Expr(expr);
         if (expr.size()) {
-            error = strprintf("rawtr(): only one key expected.");
-            return {};
+            return util::Unexpected{"rawtr(): only one key expected."};
         }
-        auto output_keys = ParsePubkey(key_exp_index, arg, ParseScriptContext::P2TR, out, error);
-        if (output_keys.empty()) {
-            error = strprintf("rawtr(): %s", error);
-            return {};
-        }
-        for (auto& pubkey : output_keys) {
+        auto output_keys = ParsePubkey(state, arg, ParseScriptContext::P2TR);
+        if (!output_keys) return util::Unexpected{strprintf("rawtr(): %s", output_keys.error())};
+        for (auto& pubkey : *output_keys) {
             ret.emplace_back(std::make_unique<RawTRDescriptor>(std::move(pubkey)));
         }
         return ret;
     } else if (Func("rawtr", expr)) {
-        error = "Can only have rawtr at top level";
-        return {};
+        return util::Unexpected{"Can only have rawtr at top level"};
     }
     if (ctx == ParseScriptContext::TOP && Func("unused", expr)) {
         // Check for only one expression, should not find commas, brackets, or parentheses
         auto arg = Expr(expr);
         if (expr.size()) {
-            error = strprintf("unused(): only one key expected");
-            return {};
+            return util::Unexpected{"unused(): only one key expected"};
         }
-        auto keys = ParsePubkey(key_exp_index, arg, ctx, out, error);
-        if (keys.empty()) return {};
+        auto result = ParsePubkey(state, arg, ctx);
+        if (!result) return util::Unexpected{std::move(result.error())};
+        auto keys = std::move(*result);
         for (auto& pubkey : keys) {
             if (pubkey->IsRange()) {
-                error = "unused(): key cannot be ranged";
-                return {};
+                return util::Unexpected{"unused(): key cannot be ranged"};
             }
             ret.emplace_back(std::make_unique<UnusedDescriptor>(std::move(pubkey)));
         }
         return ret;
     } else if (Func("unused", expr)) {
-        error = "Can only have unused at top level";
-        return {};
+        return util::Unexpected{"Can only have unused at top level"};
     }
     if (ctx == ParseScriptContext::TOP && Func("raw", expr)) {
         std::string str(expr.begin(), expr.end());
         if (!IsHex(str)) {
-            error = "Raw script is not hex";
-            return {};
+            return util::Unexpected{"Raw script is not hex"};
         }
         auto bytes = ParseHex(str);
         ret.emplace_back(std::make_unique<RawDescriptor>(CScript(bytes.begin(), bytes.end())));
         return ret;
     } else if (Func("raw", expr)) {
-        error = "Can only have raw() at top level";
-        return {};
+        return util::Unexpected{"Can only have raw() at top level"};
     }
     // Process miniscript expressions.
     {
         const auto script_ctx{ctx == ParseScriptContext::P2WSH ? miniscript::MiniscriptContext::P2WSH : miniscript::MiniscriptContext::TAPSCRIPT};
-        KeyParser parser(/*out = */&out, /* in = */nullptr, /* ctx = */script_ctx, key_exp_index);
-        auto node = miniscript::FromString(std::string(expr.begin(), expr.end()), parser);
+        KeyParser parser(/*out = */&state.out, /* in = */nullptr, /* ctx = */script_ctx, state.key_exp_index, state.key_replacements, state.known_xprvs);
+        auto node = miniscript::FromString(std::string_view{expr.data(), expr.size()}, parser);
         if (parser.m_key_parsing_error != "") {
-            error = std::move(parser.m_key_parsing_error);
-            return {};
+            return util::Unexpected{std::move(parser.m_key_parsing_error)};
         }
         if (node) {
             if (ctx != ParseScriptContext::P2WSH && ctx != ParseScriptContext::P2TR) {
-                error = "Miniscript expressions can only be used in wsh or tr.";
-                return {};
+                return util::Unexpected{"Miniscript expressions can only be used in wsh or tr."};
             }
             if (!node->IsSane() || node->IsNotSatisfiable()) {
                 // Try to find the first insane sub for better error reporting.
                 const auto* insane_node = &node.value();
                 if (const auto sub = node->FindInsaneSub()) insane_node = sub;
-                error = *insane_node->ToString(parser);
+                std::string error{*insane_node->ToString(parser)};
                 if (!insane_node->IsValid()) {
                     error += " is invalid";
                 } else if (!node->IsSane()) {
@@ -2711,7 +2846,7 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
                 } else {
                     error += " is not satisfiable";
                 }
-                return {};
+                return util::Unexpected{std::move(error)};
             }
             // A signature check is required for a miniscript to be sane. Therefore no sane miniscript
             // may have an empty list of public keys.
@@ -2729,8 +2864,7 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
                         vec.emplace_back(vec.at(0)->Clone());
                     }
                 } else if (vec.size() != num_multipath) {
-                    error = strprintf("Miniscript: Multipath derivation paths have mismatched lengths");
-                    return {};
+                    return util::Unexpected{"Miniscript: Multipath derivation paths have mismatched lengths"};
                 }
             }
 
@@ -2748,14 +2882,11 @@ std::vector<std::unique_ptr<DescriptorImpl>> ParseScript(uint32_t& key_exp_index
         }
     }
     if (ctx == ParseScriptContext::P2SH) {
-        error = "A function is needed within P2SH";
-        return {};
+        return util::Unexpected{"A function is needed within P2SH"};
     } else if (ctx == ParseScriptContext::P2WSH) {
-        error = "A function is needed within P2WSH";
-        return {};
+        return util::Unexpected{"A function is needed within P2WSH"};
     }
-    error = strprintf("'%s' is not a valid descriptor function", std::string(expr.begin(), expr.end()));
-    return {};
+    return util::Unexpected{strprintf("'%s' is not a valid descriptor function", std::string(expr.begin(), expr.end()))};
 }
 
 std::unique_ptr<DescriptorImpl> InferMultiA(const CScript& script, ParseScriptContext ctx, const SigningProvider& provider)
@@ -2954,18 +3085,63 @@ bool CheckChecksum(std::span<const char>& sp, bool require_checksum, std::string
     return true;
 }
 
-std::vector<std::unique_ptr<Descriptor>> Parse(std::string_view descriptor, FlatSigningProvider& out, std::string& error, bool require_checksum)
+std::vector<std::unique_ptr<Descriptor>> Parse(std::string_view descriptor, FlatSigningProvider& out, std::string& error, bool require_checksum, std::optional<std::string>* multipath, const std::map<CExtPubKey, CExtKey>* known_xprvs)
 {
+    if (multipath) multipath->reset();
     std::span<const char> sp{descriptor};
     if (!CheckChecksum(sp, require_checksum, error)) return {};
+    const std::string_view no_checksum{sp.data(), sp.size()};
     uint32_t key_exp_index = 0;
-    auto ret = ParseScript(key_exp_index, sp, ParseScriptContext::TOP, out, error);
+    std::vector<KeyReplacement> key_replacements;
+    ParseState state{key_exp_index, out, multipath ? &key_replacements : nullptr, known_xprvs};
+    auto result = ParseScript(state, sp, ParseScriptContext::TOP);
+    if (!result) {
+        error = std::move(result.error());
+        return {};
+    }
+    auto ret = std::move(*result);
+    if (sp.empty() && ret.size() > 1 && no_checksum.find('\'') != std::string_view::npos) {
+        // The descriptors that a multipath descriptor expands to always use
+        // 'h' as hardened marker, regardless of the marker in the input. In a
+        // valid descriptor an apostrophe can only appear as a hardened marker,
+        // so replace them all and parse again.
+        std::string canonical{no_checksum};
+        std::ranges::replace(canonical, '\'', 'h');
+        std::span<const char> sp_canonical{canonical};
+        key_exp_index = 0;
+        ParseState canonical_state{key_exp_index, out, /*key_replacements=*/nullptr, known_xprvs};
+        auto canonical_result = ParseScript(canonical_state, sp_canonical, ParseScriptContext::TOP);
+        // Only the marker stored in the pubkey providers differs, so this
+        // parse cannot fail.
+        if (!Assume(canonical_result && sp_canonical.empty())) {
+            if (!canonical_result) error = std::move(canonical_result.error());
+            return {};
+        }
+        ret = std::move(*canonical_result);
+    }
     if (sp.empty() && !ret.empty()) {
         std::vector<std::unique_ptr<Descriptor>> descs;
         descs.reserve(ret.size());
         for (auto& r : ret) {
             descs.emplace_back(std::unique_ptr<Descriptor>(std::move(r)));
         }
+        const bool publicly_derivable{std::ranges::all_of(key_replacements, &KeyReplacement::publicly_derivable)};
+        if (multipath && descs.size() > 1 && publicly_derivable) {
+            // Return the normalized multipath descriptor string: the parsed
+            // string with each private key replaced by its normalized public form.
+            // Sort spans by their position in the input descriptor.
+            std::sort(key_replacements.begin(), key_replacements.end(), [](const auto& a, const auto& b) { return a.text.data() < b.text.data(); });
+            std::string multipath_str{no_checksum};
+            size_t next_pos{no_checksum.size()};
+            for (const KeyReplacement& kr : key_replacements | std::views::reverse) {
+                const size_t pos{static_cast<size_t>(kr.text.data() - no_checksum.data())};
+                Assume(pos <= next_pos);
+                Assume(kr.text.size() <= next_pos - pos);
+                multipath_str.replace(pos, kr.text.size(), kr.replacement);
+                next_pos = pos;
+            }
+            *multipath = AddChecksum(multipath_str);
+        }
         return descs;
     }
     return {};
diff --git a/src/script/descriptor.h b/src/script/descriptor.h
index 26781629cbf3..1526fd6c894c 100644
--- a/src/script/descriptor.h
+++ b/src/script/descriptor.h
@@ -11,6 +11,7 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <map>
 #include <memory>
 #include <optional>
 #include <set>
@@ -21,6 +22,7 @@
 
 class CScript;
 class SigningProvider;
+struct CExtKey;
 struct FlatSigningProvider;
 
 using ExtPubKeyMap = std::unordered_map<uint32_t, CExtPubKey>;
@@ -205,15 +207,31 @@ struct Descriptor {
     virtual size_t GetKeyCount() const = 0;
 };
 
-/** Parse a `descriptor` string. Included private keys are put in `out`.
+/** Parse a descriptor string.
  *
- * If the descriptor has a checksum, it must be valid. If `require_checksum`
- * is set, the checksum is mandatory - otherwise it is optional.
+ * If `descriptor` has a checksum, it must be valid. If `require_checksum`
+ * is set, a checksum is mandatory.
  *
- * If a parse error occurs, or the checksum is missing/invalid, or anything
- * else is wrong, an empty vector is returned.
+ * @param[in] descriptor Descriptor string to parse.
+ * @param[out] out Signing provider populated with private keys included in `descriptor`.
+ * @param[out] error Error message if parsing fails.
+ * @param[in] require_checksum Whether a checksum is required.
+ * @param[out] multipath If provided, set to the publicly derivable form of the
+ * multipath descriptor string before expansion, with a checksum. It is set to
+ * `std::nullopt` if `descriptor` is not multipath or contains a key expression
+ * that cannot be made publicly derivable. Private keys are replaced by their
+ * public forms. Private extended keys followed by a fixed hardened prefix are
+ * normalized by replacing them with their key origin and the extended public
+ * key at the last hardened step.
+ * @param[in] known_xprvs If provided, extended private keys known to the
+ * caller, by their public form, to fill in for the extended public keys of
+ * `descriptor` as if it contained them. A key expression with an explicit key
+ * origin that leads from one of these keys to its extended public key is
+ * replaced by that key and the full derivation path. The keys are put in
+ * `out`, and do not affect `multipath`.
+ * @return Parsed descriptors, or an empty vector on error.
  */
-std::vector<std::unique_ptr<Descriptor>> Parse(std::string_view descriptor, FlatSigningProvider& out, std::string& error, bool require_checksum = false);
+std::vector<std::unique_ptr<Descriptor>> Parse(std::string_view descriptor, FlatSigningProvider& out, std::string& error, bool require_checksum = false, std::optional<std::string>* multipath = nullptr, const std::map<CExtPubKey, CExtKey>* known_xprvs = nullptr);
 
 /** Get the checksum for a `descriptor`.
  *
diff --git a/src/script/miniscript.h b/src/script/miniscript.h
index ce5d2fa53237..1e8d5a39fee2 100644
--- a/src/script/miniscript.h
+++ b/src/script/miniscript.h
@@ -2682,9 +2682,9 @@ inline std::optional<Node<Key>> DecodeScript(I& in, I last, const Ctx& ctx)
 } // namespace internal
 
 template <typename Ctx>
-inline std::optional<Node<typename Ctx::Key>> FromString(const std::string& str, const Ctx& ctx)
+inline std::optional<Node<typename Ctx::Key>> FromString(std::string_view str, const Ctx& ctx)
 {
-    return internal::Parse<typename Ctx::Key>(str, ctx);
+    return internal::Parse<typename Ctx::Key>(std::span{str.data(), str.size()}, ctx);
 }
 
 template <typename Ctx>
diff --git a/src/script/sign.cpp b/src/script/sign.cpp
index efee5a35fe01..f96f86c91371 100644
--- a/src/script/sign.cpp
+++ b/src/script/sign.cpp
@@ -559,9 +559,13 @@ static bool SignTaproot(const SigningProvider& provider, const BaseSignatureCrea
 {
     TaprootSpendData spenddata;
     TaprootBuilder builder;
+    const bool taproot_keypath_only{creator.Options().taproot_keypath_only};
 
     // Gather information about this output.
     if (provider.GetTaprootSpendData(output, spenddata)) {
+        // Avoid merging newly provided script path data. Existing taproot
+        // script path fields in sigdata (e.g. from a PSBT) are left intact.
+        if (taproot_keypath_only) spenddata.scripts.clear();
         sigdata.tr_spenddata.Merge(spenddata);
     }
     if (provider.GetTaprootBuilder(output, builder)) {
@@ -613,6 +617,10 @@ static bool SignTaproot(const SigningProvider& provider, const BaseSignatureCrea
         }
     }
 
+    // Key path signing failed. In keypath-only mode, stop here instead of
+    // attempting a script path signature.
+    if (taproot_keypath_only) return false;
+
     // Try script path spending.
     std::vector<std::vector<unsigned char>> smallest_result_stack;
     for (const auto& [key, control_blocks] : sigdata.tr_spenddata.scripts) {
diff --git a/src/script/sign.h b/src/script/sign.h
index 107abb9e8492..558d7749f3f8 100644
--- a/src/script/sign.h
+++ b/src/script/sign.h
@@ -33,6 +33,7 @@ struct SignatureData;
 
 struct SignOptions {
     int sighash_type{SIGHASH_DEFAULT};
+    bool taproot_keypath_only{false};
 };
 
 /** Interface for signature creators. */
@@ -40,6 +41,7 @@ class BaseSignatureCreator {
 public:
     virtual ~BaseSignatureCreator() = default;
     virtual const BaseSignatureChecker& Checker() const =0;
+    virtual SignOptions Options() const { return {}; }
 
     /** Create a singular (non-script) signature. */
     virtual bool CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& keyid, const CScript& scriptCode, SigVersion sigversion) const =0;
@@ -65,6 +67,7 @@ class MutableTransactionSignatureCreator : public BaseSignatureCreator
     MutableTransactionSignatureCreator(const CMutableTransaction& tx LIFETIMEBOUND, unsigned int input_idx, const CAmount& amount, const SignOptions& options);
     MutableTransactionSignatureCreator(const CMutableTransaction& tx LIFETIMEBOUND, unsigned int input_idx, const CAmount& amount, const PrecomputedTransactionData* txdata, const SignOptions& options);
     const BaseSignatureChecker& Checker() const override { return checker; }
+    SignOptions Options() const override { return m_options; }
     bool CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& keyid, const CScript& scriptCode, SigVersion sigversion) const override;
     bool CreateSchnorrSig(const SigningProvider& provider, std::vector<unsigned char>& sig, const XOnlyPubKey& pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion) const override;
     std::vector<uint8_t> CreateMuSig2Nonce(const SigningProvider& provider, const CPubKey& aggregate_pubkey, const CPubKey& script_pubkey, const CPubKey& part_pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion, const SignatureData& sigdata) const override;
diff --git a/src/test/descriptor_tests.cpp b/src/test/descriptor_tests.cpp
index ed410dfbb148..ed94f64c67bf 100644
--- a/src/test/descriptor_tests.cpp
+++ b/src/test/descriptor_tests.cpp
@@ -2,6 +2,7 @@
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
+#include <key_io.h>
 #include <pubkey.h>
 #include <script/descriptor.h>
 #include <script/sign.h>
@@ -55,6 +56,8 @@ constexpr int MUSIG = 1 << 9; // This is a MuSig so key counts will have an extr
 constexpr int MUSIG_DERIVATION = 1 << 10; // MuSig with BIP 328 derivation from the aggregate key
 constexpr int MIXED_MUSIG = 1 << 11; // Both MuSig and normal key expressions are present
 constexpr int UNIQUE_XPUBS = 1 << 12; // Whether the xpub count should be of unique xpubs
+constexpr int MULTIPATH = 1 << 13; // The descriptor has multipath derivation
+constexpr int MULTIPATH_UNNORMALIZABLE = 1 << 14; // No publicly derivable multipath form exists
 
 /** Compare two descriptors. If only one of them has a checksum, the checksum is ignored. */
 bool EqualDescriptor(std::string a, std::string b)
@@ -178,6 +181,7 @@ void DoCheck(std::string prv, std::string pub, const std::string& norm_pub, int
     FlatSigningProvider keys_priv, keys_pub;
     std::set<std::vector<uint32_t>> left_paths = paths;
     std::string error;
+    std::optional<std::string> multipath_prv{"stale"}, multipath_pub{"stale"};
 
     std::vector<std::unique_ptr<Descriptor>> parse_privs;
     std::vector<std::unique_ptr<Descriptor>> parse_pubs;
@@ -185,14 +189,30 @@ void DoCheck(std::string prv, std::string pub, const std::string& norm_pub, int
     if (replace_apostrophe_with_h_in_prv) {
         prv = UseHInsteadOfApostrophe(prv);
     }
-    parse_privs = Parse(prv, keys_priv, error);
+    parse_privs = Parse(prv, keys_priv, error, /*require_checksum=*/false, &multipath_prv);
     BOOST_CHECK_MESSAGE(!parse_privs.empty(), error);
     if (replace_apostrophe_with_h_in_pub) {
         pub = UseHInsteadOfApostrophe(pub);
     }
-    parse_pubs = Parse(pub, keys_pub, error);
+    parse_pubs = Parse(pub, keys_pub, error, /*require_checksum=*/false, &multipath_pub);
     BOOST_CHECK_MESSAGE(!parse_pubs.empty(), error);
 
+    const bool is_multipath{(flags & MULTIPATH) != 0};
+    const bool expect_multipath{is_multipath && !(flags & MULTIPATH_UNNORMALIZABLE)};
+    BOOST_REQUIRE_EQUAL(parse_privs.size() > 1, is_multipath);
+    BOOST_REQUIRE_EQUAL(parse_pubs.size() > 1, is_multipath);
+    BOOST_REQUIRE_EQUAL(multipath_prv.has_value(), expect_multipath);
+    BOOST_REQUIRE_EQUAL(multipath_pub.has_value(), expect_multipath);
+
+    if (expect_multipath) {
+        // The multipath string is normalized: hardened markers in key origins
+        // always use 'h', regardless of how the input spells them.
+        const std::string norm_pub{UseHInsteadOfApostrophe(pub)};
+        const std::string expected{norm_pub + "#" + GetDescriptorChecksum(norm_pub)};
+        BOOST_CHECK_EQUAL(*multipath_prv, expected);
+        BOOST_CHECK_EQUAL(*multipath_pub, expected);
+    }
+
     auto& parse_priv = parse_privs.at(desc_index);
     auto& parse_pub = parse_pubs.at(desc_index);
 
@@ -270,8 +290,7 @@ void DoCheck(std::string prv, std::string pub, const std::string& norm_pub, int
         // If there is at least one private key, ToPrivateString() should return true and include that key
         std::string prv_str;
         BOOST_CHECK(parse_priv->ToPrivateString(keys_priv, prv_str));
-        size_t checksum_len = 9; // Including the '#' character
-        BOOST_CHECK_MESSAGE(prv == prv_str.substr(0, prv_str.length() - checksum_len), prv);
+        BOOST_CHECK_MESSAGE(EqualDescriptor(expected_prv ? *expected_prv : prv, prv_str), prv_str);
     }
 
     // Check that private can produce the normalized descriptors
@@ -523,6 +542,7 @@ void CheckMultipath(const std::string& prv,
     assert(expanded_prvs.size() == expanded_norm_pubs.size());
     assert(expanded_prvs.size() == scripts.size());
     assert(expanded_prvs.size() == paths.size());
+
     for (size_t i = 0; i < expanded_prvs.size(); ++i) {
         int flag = flags.at(0);
         if (flags.size() > 1) {
@@ -668,7 +688,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "pk(xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0)",
                 "pk(xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/1)",
             },
-           {DEFAULT},
+           {DEFAULT | MULTIPATH},
             {
                 {{"210379e45b3cf75f9c5f9befd8e9506fb962f6a9d185ac87001ec44a8d3df8d4a9e3ac"}},
                 {{"21034f8d02282ac6786737d0f37f0df7655f49daa24843bc7de3f4ea88603d26d10aac"}},
@@ -693,7 +713,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "pkh([bd16bee5/2147483647h]xpub69H7F5dQzmVd3vPuLKtcXJziMEQByuDidnX3YdwgtNsecY5HRGtAAQC5mXTt4dsv9RzyjgDjAQs9VGVV6ydYCHnprc9vvaA5YtqWyL6hyds/0)",
                 "pkh(xpub661MyMwAqRbcFW31YEwpkMuc5THy2PSt5bDMsktWQcFF8syAmRUapSCGu8ED9W6oDMSgv6Zz8idoc4a6mr8BDzTJY47LJhkJ8UB7WEGuduB/0/0)",
             },
-            {HARDENED, DEFAULT},
+            {HARDENED | MULTIPATH | MULTIPATH_UNNORMALIZABLE, DEFAULT | MULTIPATH | MULTIPATH_UNNORMALIZABLE},
             {
                 {{"76a914ebdc90806a9c4356c1c88e42216611e1cb4c1c1788ac"}},
                 {{"76a914f103317b9f0b758a62cb3879281d23e3b1deb90d88ac"}},
@@ -704,8 +724,10 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 {{0,0}},
             }
     );
-    CheckMultipath("wpkh([ffffffff/13h]xprv9vHkqa6EV4sPZHYqZznhT2NPtPCjKuDKGY38FBWLvgaDx45zo9WQRUT3dKYnjwih2yJD9mkrocEZXo1ex8G81dwSM1fwqWpWkeS3v86pgKt/<1;3>/2/*)",
-            "wpkh([ffffffff/13h]xpub69H7F5d8KSRgmmdJg2KhpAK8SR3DjMwAdkxj3ZuxV27CprR9LgpeyGmXUbC6wb7ERfvrnKZjXoUmmDznezpbZb7ap6r1D3tgFxHmwMkQTPH/<1;3>/2/*)",
+    // The multipath input is spelled with apostrophe hardened markers, while
+    // the descriptors it expands to always use 'h'
+    CheckMultipath("wpkh([FFFFFFFF/13']xprv9vHkqa6EV4sPZHYqZznhT2NPtPCjKuDKGY38FBWLvgaDx45zo9WQRUT3dKYnjwih2yJD9mkrocEZXo1ex8G81dwSM1fwqWpWkeS3v86pgKt/<1;3>/2/*)",
+            "wpkh([ffffffff/13']xpub69H7F5d8KSRgmmdJg2KhpAK8SR3DjMwAdkxj3ZuxV27CprR9LgpeyGmXUbC6wb7ERfvrnKZjXoUmmDznezpbZb7ap6r1D3tgFxHmwMkQTPH/<1;3>/2/*)",
             {
                 "wpkh([ffffffff/13h]xprv9vHkqa6EV4sPZHYqZznhT2NPtPCjKuDKGY38FBWLvgaDx45zo9WQRUT3dKYnjwih2yJD9mkrocEZXo1ex8G81dwSM1fwqWpWkeS3v86pgKt/1/2/*)",
                 "wpkh([ffffffff/13h]xprv9vHkqa6EV4sPZHYqZznhT2NPtPCjKuDKGY38FBWLvgaDx45zo9WQRUT3dKYnjwih2yJD9mkrocEZXo1ex8G81dwSM1fwqWpWkeS3v86pgKt/3/2/*)",
@@ -718,7 +740,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "wpkh([ffffffff/13h]xpub69H7F5d8KSRgmmdJg2KhpAK8SR3DjMwAdkxj3ZuxV27CprR9LgpeyGmXUbC6wb7ERfvrnKZjXoUmmDznezpbZb7ap6r1D3tgFxHmwMkQTPH/1/2/*)",
                 "wpkh([ffffffff/13h]xpub69H7F5d8KSRgmmdJg2KhpAK8SR3DjMwAdkxj3ZuxV27CprR9LgpeyGmXUbC6wb7ERfvrnKZjXoUmmDznezpbZb7ap6r1D3tgFxHmwMkQTPH/3/2/*)",
             },
-            {RANGE},
+            {RANGE | MULTIPATH},
             {
                 {{"0014326b2249e3a25d5dc60935f044ee835d090ba859"},{"0014af0bd98abc2f2cae66e36896a39ffe2d32984fb7"},{"00141fa798efd1cbf95cebf912c031b8a4a6e9fb9f27"}},
                 {{"001426183882ef9c76b9a44386e9b387f33cee7c3a2d"},{"001447c1b9dc215c3f8b47e572981eb97528768cde4e"},{"00146e92cbaa397f9caeccf9a049460258af6ccd67e2"}},
@@ -729,8 +751,11 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 {{0x8000000DUL, 3, 2, 0}, {0x8000000DUL, 3, 2, 1}, {0x8000000DUL, 3, 2, 2}},
             }
     );
-    CheckMultipath("sh(wpkh(xprv9s21ZrQH143K3QTDL4LXw2F7HEK3wJUD2nW2nRk4stbPy6cq3jPPqjiChkVvvNKmPGJxWUtg6LnF5kejMRNNU3TGtRBeJgk33yuGBxrMPHi/<10;100h>/20/30/40/*h))",
-            "sh(wpkh(xpub661MyMwAqRbcFtXgS5sYJABqqG9YLmC4Q1Rdap9gSE8NqtwybGhePY2gZ29ESFjqJoCu1Rupje8YtGqsefD265TMg7usUDFdp6W1EGMcet8/<10;100h>/20/30/40/*h))",
+    // Malformed multipath descriptors with trailing input must fail before apostrophe canonicalization
+    CheckUnparsable("tr(xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/<44;114;7'>))",
+                    "tr(xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/<44;114;7'>))", "");
+    CheckMultipath("sh(wpkh(xprv9s21ZrQH143K3QTDL4LXw2F7HEK3wJUD2nW2nRk4stbPy6cq3jPPqjiChkVvvNKmPGJxWUtg6LnF5kejMRNNU3TGtRBeJgk33yuGBxrMPHi/<10;100'>/20/30/40/*'))",
+            "sh(wpkh(xpub661MyMwAqRbcFtXgS5sYJABqqG9YLmC4Q1Rdap9gSE8NqtwybGhePY2gZ29ESFjqJoCu1Rupje8YtGqsefD265TMg7usUDFdp6W1EGMcet8/<10;100'>/20/30/40/*'))",
             {
                 "sh(wpkh(xprv9s21ZrQH143K3QTDL4LXw2F7HEK3wJUD2nW2nRk4stbPy6cq3jPPqjiChkVvvNKmPGJxWUtg6LnF5kejMRNNU3TGtRBeJgk33yuGBxrMPHi/10/20/30/40/*h))",
                 "sh(wpkh(xprv9s21ZrQH143K3QTDL4LXw2F7HEK3wJUD2nW2nRk4stbPy6cq3jPPqjiChkVvvNKmPGJxWUtg6LnF5kejMRNNU3TGtRBeJgk33yuGBxrMPHi/100h/20/30/40/*h))",
@@ -743,7 +768,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "sh(wpkh(xpub661MyMwAqRbcFtXgS5sYJABqqG9YLmC4Q1Rdap9gSE8NqtwybGhePY2gZ29ESFjqJoCu1Rupje8YtGqsefD265TMg7usUDFdp6W1EGMcet8/10/20/30/40/*h))",
                 "sh(wpkh(xpub661MyMwAqRbcFtXgS5sYJABqqG9YLmC4Q1Rdap9gSE8NqtwybGhePY2gZ29ESFjqJoCu1Rupje8YtGqsefD265TMg7usUDFdp6W1EGMcet8/100h/20/30/40/*h))",
             },
-            {RANGE | HARDENED | DERIVE_HARDENED},
+            {RANGE | HARDENED | DERIVE_HARDENED | MULTIPATH | MULTIPATH_UNNORMALIZABLE},
             {
                 {{"a9149a4d9901d6af519b2a23d4a2f51650fcba87ce7b87"},{"a914bed59fc0024fae941d6e20a3b44a109ae740129287"},{"a9148483aa1116eb9c05c482a72bada4b1db24af654387"}},
                 {{"a91470192039cb9529aadf4e53e46d9ac6a13790865787"},{"a914855859faffabf1e4ed2bb7411ab66f4599b1abd287"},{"a9148f2cfd4b486de247c44684160da164617ccf2c2687"}},
@@ -754,6 +779,33 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 {{0x80000064UL, 20, 30, 40, 0x80000000UL}, {0x80000064UL, 20, 30, 40, 0x80000001UL}, {0x80000064UL, 20, 30, 40, 0x80000002UL}},
             }
     );
+    // A hex key typed in uppercase is lowercased in the multipath descriptor
+    // string and the expanded descriptors
+    CheckMultipath("wsh(multi(1,xprv9s21ZrQH143K31xYSDQpPDxsXRTUcvj2iNHm5NUtrGiGG5e2DtALGdso3pGz6ssrdK4PFmM8NSpSBHNqPqm55Qn3LqFtT2emdEXVYsCzC2U/<0;1>,03A34B99F22C790C4E36B2B3C2C35A36DB06226E41C692FC82B8B56AC1C540C5BD))",
+            "wsh(multi(1,xpub661MyMwAqRbcFW31YEwpkMuc5THy2PSt5bDMsktWQcFF8syAmRUapSCGu8ED9W6oDMSgv6Zz8idoc4a6mr8BDzTJY47LJhkJ8UB7WEGuduB/<0;1>,03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd))",
+            {
+                "wsh(multi(1,xprv9s21ZrQH143K31xYSDQpPDxsXRTUcvj2iNHm5NUtrGiGG5e2DtALGdso3pGz6ssrdK4PFmM8NSpSBHNqPqm55Qn3LqFtT2emdEXVYsCzC2U/0,03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd))",
+                "wsh(multi(1,xprv9s21ZrQH143K31xYSDQpPDxsXRTUcvj2iNHm5NUtrGiGG5e2DtALGdso3pGz6ssrdK4PFmM8NSpSBHNqPqm55Qn3LqFtT2emdEXVYsCzC2U/1,03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd))",
+            },
+            {
+                "wsh(multi(1,xpub661MyMwAqRbcFW31YEwpkMuc5THy2PSt5bDMsktWQcFF8syAmRUapSCGu8ED9W6oDMSgv6Zz8idoc4a6mr8BDzTJY47LJhkJ8UB7WEGuduB/0,03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd))",
+                "wsh(multi(1,xpub661MyMwAqRbcFW31YEwpkMuc5THy2PSt5bDMsktWQcFF8syAmRUapSCGu8ED9W6oDMSgv6Zz8idoc4a6mr8BDzTJY47LJhkJ8UB7WEGuduB/1,03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd))",
+            },
+            {
+                "wsh(multi(1,xpub661MyMwAqRbcFW31YEwpkMuc5THy2PSt5bDMsktWQcFF8syAmRUapSCGu8ED9W6oDMSgv6Zz8idoc4a6mr8BDzTJY47LJhkJ8UB7WEGuduB/0,03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd))",
+                "wsh(multi(1,xpub661MyMwAqRbcFW31YEwpkMuc5THy2PSt5bDMsktWQcFF8syAmRUapSCGu8ED9W6oDMSgv6Zz8idoc4a6mr8BDzTJY47LJhkJ8UB7WEGuduB/1,03a34b99f22c790c4e36b2b3c2c35a36db06226e41c692fc82b8b56ac1c540c5bd))",
+            },
+            {MULTIPATH | MIXED_PUBKEYS | MISSING_PRIVKEYS},
+            {
+                {{"00204e9b38241c92a2d8605bdd19ac500cbab0970d60e3a9b4f02489263ca5c44b34"}},
+                {{"0020b2f34a669afd8c0ecd23357b7959be1870d2b5bfc8664efff7cdf97c46d0d037"}},
+            },
+            OutputType::BECH32,
+            {
+                {{0}, {}},
+                {{1}, {}},
+            }
+    );
     CheckMultipath("multi(2,xprvA1RpRA33e1JQ7ifknakTFpgNXPmW2YvmhqLQYMmrj4xJXXWYpDPS3xz7iAxn8L39njGVyuoseXzU6rcxFLJ8HFsTjSyQbLYnMpCqE2VbFWc/<1;2>/*,xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/<3;4>/0/*)",
             "multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/<1;2>/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/<3;4>/0/*)",
             {
@@ -768,7 +820,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/1/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/3/0/*)",
                 "multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/2/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/4/0/*)",
             },
-            {RANGE},
+            {RANGE | MULTIPATH},
             {
                 {{"522103095e95d8c50ae3f3fea93fa8e983f710489f60ff681a658c06eba64622c824b121020443e9e729b42628913f1a69b46b7d43ff87c46e86140e12ee420d7e2e8caf8c52ae"},{"5221027512d6bd74e24eeb1ad752d5be800adc5886ded11c5293a9a701db83658b526a2102371e912dea5fefa56158908fe4c9f66bc925a8939b10f3821e8f8be797b9ca8252ae"},{"522102cc9fd211dc0a1c8bb7a106ff831be0e253bc992f21d08fb8a6fd43fae51b9b892103e43eddc68afc9746c9d09ce0bf8067b4f2416287abbc422ed1ac300673b1104952ae"}},
                 {{"5221031c0517fff3d483f06ca769bd2326bf30aca1c4de278e676e6ef760c3301244c6210316e171ff4f82dc62ad3f0d84c97865034fc5041eaa508b48c1d7af77f301c8bd52ae"},{"52210240f010ccff4202ade2ef87756f6b9af57bbf5ebcb0393b949e6e5d45d30bff36210229057a7e03510b8cb66727fab3f47a52a02ea94eae03e7c2e81b72a26781bfde52ae"},{"5221034052522058a07b647bd08fa1a9eaedae0222eac76ddd122ff8096ec969398de721038cb8180dd4c956848bcf191e45aaf297146207559fb8737881156aadaf13704152ae"}},
@@ -796,7 +848,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "pkh(xpub661MyMwAqRbcFW31YEwpkMuc5THy2PSt5bDMsktWQcFF8syAmRUapSCGu8ED9W6oDMSgv6Zz8idoc4a6mr8BDzTJY47LJhkJ8UB7WEGuduB/1)",
                 "pkh(xpub661MyMwAqRbcFW31YEwpkMuc5THy2PSt5bDMsktWQcFF8syAmRUapSCGu8ED9W6oDMSgv6Zz8idoc4a6mr8BDzTJY47LJhkJ8UB7WEGuduB/2)",
             },
-            {DEFAULT},
+            {DEFAULT | MULTIPATH},
             {
                 {{"76a9145a61ff8eb7aaca3010db97ebda76121610b7809688ac"}},
                 {{"76a9142f792a782cf4adbb321fe646c8e220563649b8fa88ac"}},
@@ -809,24 +861,26 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 {{2}},
             }
     );
-    CheckMultipath("sh(multi(2,xprvA1RpRA33e1JQ7ifknakTFpgNXPmW2YvmhqLQYMmrj4xJXXWYpDPS3xz7iAxn8L39njGVyuoseXzU6rcxFLJ8HFsTjSyQbLYnMpCqE2VbFWc/<1;2;3>/0/*,xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/0/*,xprv9s21ZrQH143K3jUwNHoqQNrtzJnJmx4Yup8NkNLdVQCymYbPbJXnPhwkfTfxZfptcs3rLAPUXS39oDLgrNKQGwbGsEmJJ8BU3RzQuvShEG4/0/0/<3;4;5>/*))",
-            "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/<1;2;3>/0/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/<3;4;5>/*))",
-            {
-                "sh(multi(2,xprvA1RpRA33e1JQ7ifknakTFpgNXPmW2YvmhqLQYMmrj4xJXXWYpDPS3xz7iAxn8L39njGVyuoseXzU6rcxFLJ8HFsTjSyQbLYnMpCqE2VbFWc/1/0/*,xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/0/*,xprv9s21ZrQH143K3jUwNHoqQNrtzJnJmx4Yup8NkNLdVQCymYbPbJXnPhwkfTfxZfptcs3rLAPUXS39oDLgrNKQGwbGsEmJJ8BU3RzQuvShEG4/0/0/3/*))",
-                "sh(multi(2,xprvA1RpRA33e1JQ7ifknakTFpgNXPmW2YvmhqLQYMmrj4xJXXWYpDPS3xz7iAxn8L39njGVyuoseXzU6rcxFLJ8HFsTjSyQbLYnMpCqE2VbFWc/2/0/*,xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/0/*,xprv9s21ZrQH143K3jUwNHoqQNrtzJnJmx4Yup8NkNLdVQCymYbPbJXnPhwkfTfxZfptcs3rLAPUXS39oDLgrNKQGwbGsEmJJ8BU3RzQuvShEG4/0/0/4/*))",
-                "sh(multi(2,xprvA1RpRA33e1JQ7ifknakTFpgNXPmW2YvmhqLQYMmrj4xJXXWYpDPS3xz7iAxn8L39njGVyuoseXzU6rcxFLJ8HFsTjSyQbLYnMpCqE2VbFWc/3/0/*,xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/0/*,xprv9s21ZrQH143K3jUwNHoqQNrtzJnJmx4Yup8NkNLdVQCymYbPbJXnPhwkfTfxZfptcs3rLAPUXS39oDLgrNKQGwbGsEmJJ8BU3RzQuvShEG4/0/0/5/*))",
+    // The middle key has no multipath specifier of its own; its apostrophe
+    // hardened marker is still normalized to 'h' in the expanded descriptors
+    CheckMultipath("sh(multi(2,xprvA1RpRA33e1JQ7ifknakTFpgNXPmW2YvmhqLQYMmrj4xJXXWYpDPS3xz7iAxn8L39njGVyuoseXzU6rcxFLJ8HFsTjSyQbLYnMpCqE2VbFWc/<1;2;3>/0/*,[bbbbbbbb/2']xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/0/*,xprv9s21ZrQH143K3jUwNHoqQNrtzJnJmx4Yup8NkNLdVQCymYbPbJXnPhwkfTfxZfptcs3rLAPUXS39oDLgrNKQGwbGsEmJJ8BU3RzQuvShEG4/0/0/<3;4;5>/*))",
+            "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/<1;2;3>/0/*,[bbbbbbbb/2']xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/<3;4;5>/*))",
+            {
+                "sh(multi(2,xprvA1RpRA33e1JQ7ifknakTFpgNXPmW2YvmhqLQYMmrj4xJXXWYpDPS3xz7iAxn8L39njGVyuoseXzU6rcxFLJ8HFsTjSyQbLYnMpCqE2VbFWc/1/0/*,[bbbbbbbb/2h]xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/0/*,xprv9s21ZrQH143K3jUwNHoqQNrtzJnJmx4Yup8NkNLdVQCymYbPbJXnPhwkfTfxZfptcs3rLAPUXS39oDLgrNKQGwbGsEmJJ8BU3RzQuvShEG4/0/0/3/*))",
+                "sh(multi(2,xprvA1RpRA33e1JQ7ifknakTFpgNXPmW2YvmhqLQYMmrj4xJXXWYpDPS3xz7iAxn8L39njGVyuoseXzU6rcxFLJ8HFsTjSyQbLYnMpCqE2VbFWc/2/0/*,[bbbbbbbb/2h]xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/0/*,xprv9s21ZrQH143K3jUwNHoqQNrtzJnJmx4Yup8NkNLdVQCymYbPbJXnPhwkfTfxZfptcs3rLAPUXS39oDLgrNKQGwbGsEmJJ8BU3RzQuvShEG4/0/0/4/*))",
+                "sh(multi(2,xprvA1RpRA33e1JQ7ifknakTFpgNXPmW2YvmhqLQYMmrj4xJXXWYpDPS3xz7iAxn8L39njGVyuoseXzU6rcxFLJ8HFsTjSyQbLYnMpCqE2VbFWc/3/0/*,[bbbbbbbb/2h]xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/0/*,xprv9s21ZrQH143K3jUwNHoqQNrtzJnJmx4Yup8NkNLdVQCymYbPbJXnPhwkfTfxZfptcs3rLAPUXS39oDLgrNKQGwbGsEmJJ8BU3RzQuvShEG4/0/0/5/*))",
             },
             {
-                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/1/0/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/3/*))",
-                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/2/0/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/4/*))",
-                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/3/0/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/5/*))",
+                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/1/0/*,[bbbbbbbb/2h]xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/3/*))",
+                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/2/0/*,[bbbbbbbb/2h]xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/4/*))",
+                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/3/0/*,[bbbbbbbb/2h]xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/5/*))",
             },
             {
-                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/1/0/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/3/*))",
-                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/2/0/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/4/*))",
-                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/3/0/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/5/*))",
+                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/1/0/*,[bbbbbbbb/2h]xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/3/*))",
+                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/2/0/*,[bbbbbbbb/2h]xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/4/*))",
+                "sh(multi(2,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/3/0/*,[bbbbbbbb/2h]xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/5/*))",
             },
-            {RANGE},
+            {RANGE | MULTIPATH},
             {
                 {{"a914689cdf7de5836ec04fb971d128cc84858f73e11487"},{"a9142ea7dbaf0a77ee19f080cdacb3e13560e3cd9cf587"},{"a9143da854021f58f5e2d3ff6bb4fcd0ced877deb34987"}},
                 {{"a9143dd613d162e89b83369bbf08e5f1977cfdc9b02787"},{"a91449eef5d3df5c465b20a630c66058fe689082d8e187"},{"a91492be56babf54ea2109c577f799ba6d73948e8c3287"}},
@@ -834,9 +888,9 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
             },
             OutputType::LEGACY,
             {
-                {{1, 0, 0}, {1, 0, 1}, {1, 0, 2}, {0, 0}, {0, 1}, {0, 2}, {0, 0, 3, 0}, {0, 0, 3, 1}, {0, 0, 3, 2}},
-                {{2, 0, 0}, {2, 0, 1}, {2, 0, 2}, {0, 0}, {0, 1}, {0, 2}, {0, 0, 4, 0}, {0, 0, 4, 1}, {0, 0, 4, 2}},
-                {{3, 0, 0}, {3, 0, 1}, {3, 0, 2}, {0, 0}, {0, 1}, {0, 2}, {0, 0, 5, 0}, {0, 0, 5, 1}, {0, 0, 5, 2}},
+                {{1, 0, 0}, {1, 0, 1}, {1, 0, 2}, {0x80000002UL, 0, 0}, {0x80000002UL, 0, 1}, {0x80000002UL, 0, 2}, {0, 0, 3, 0}, {0, 0, 3, 1}, {0, 0, 3, 2}},
+                {{2, 0, 0}, {2, 0, 1}, {2, 0, 2}, {0x80000002UL, 0, 0}, {0x80000002UL, 0, 1}, {0x80000002UL, 0, 2}, {0, 0, 4, 0}, {0, 0, 4, 1}, {0, 0, 4, 2}},
+                {{3, 0, 0}, {3, 0, 1}, {3, 0, 2}, {0x80000002UL, 0, 0}, {0x80000002UL, 0, 1}, {0x80000002UL, 0, 2}, {0, 0, 5, 0}, {0, 0, 5, 1}, {0, 0, 5, 2}},
             }
     );
     CheckMultipath("tr(xprv9s21ZrQH143K2Zu2kTVKcQi9nKhfgJUkYqG73wXsHuhATm1wkt6kcSZeTYEw2PL7krZtJopEYDvBdYWdAai3n3TWUTCVfHvPHqTYJv7smYe/<6;7;8>/*,{pk(xprvA1RpRA33e1JQ7ifknakTFpgNXPmW2YvmhqLQYMmrj4xJXXWYpDPS3xz7iAxn8L39njGVyuoseXzU6rcxFLJ8HFsTjSyQbLYnMpCqE2VbFWc/<1;2;3>/0/*),pk(xprv9s21ZrQH143K3jUwNHoqQNrtzJnJmx4Yup8NkNLdVQCymYbPbJXnPhwkfTfxZfptcs3rLAPUXS39oDLgrNKQGwbGsEmJJ8BU3RzQuvShEG4/0/0/<3;4;5>/*)})",
@@ -856,7 +910,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "tr(xpub661MyMwAqRbcF3yVrV2KyYetLMYA5mCbv4BhrKwUrFE9LZM6JRR1AEt8Jq4V4C8LwtTke6YEEdCZqgXp85YRk2j74EfJKhe3QybQ9kcUjs4/7/*,{pk(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/2/0/*),pk(xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/4/*)})",
                 "tr(xpub661MyMwAqRbcF3yVrV2KyYetLMYA5mCbv4BhrKwUrFE9LZM6JRR1AEt8Jq4V4C8LwtTke6YEEdCZqgXp85YRk2j74EfJKhe3QybQ9kcUjs4/8/*,{pk(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/3/0/*),pk(xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/5/*)})",
             },
-            {XONLY_KEYS | RANGE},
+            {XONLY_KEYS | RANGE | MULTIPATH},
             {
                 {{"5120993e5b1d71d14cbb0a90c57ea0fed1d5bf77d5804cee206c3dbd7e4d2c67d869"},{"51207b8f629f6d406b92ffa6284f5545085eafb837c469018b715755f619b587163b"},{"512061f52925826e51e4615007557ddbea55b22c817909d7ebcfd3c454c634643ece"}},
                 {{"5120633808b2156d0a6597e8b07f59c387bb4c2d5c02c4cb98f1802748e64c6abf5f"},{"5120fc5f06ded29328c170bf7e49e71c9cc8699befa2bf0a2a80802a1f32ab72d291"},{"5120fd05e2227e0dac972dff9941e332db8461bedc320c2a74def44e469ddbad9d21"}},
@@ -886,7 +940,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "tr(xpub661MyMwAqRbcF3yVrV2KyYetLMYA5mCbv4BhrKwUrFE9LZM6JRR1AEt8Jq4V4C8LwtTke6YEEdCZqgXp85YRk2j74EfJKhe3QybQ9kcUjs4/6/*,{pk(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/2/0/*),pk(xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/4/*)})",
                 "tr(xpub661MyMwAqRbcF3yVrV2KyYetLMYA5mCbv4BhrKwUrFE9LZM6JRR1AEt8Jq4V4C8LwtTke6YEEdCZqgXp85YRk2j74EfJKhe3QybQ9kcUjs4/6/*,{pk(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/3/0/*),pk(xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/5/*)})",
             },
-            {XONLY_KEYS | RANGE},
+            {XONLY_KEYS | RANGE | MULTIPATH},
             {
                 {{"5120993e5b1d71d14cbb0a90c57ea0fed1d5bf77d5804cee206c3dbd7e4d2c67d869"},{"51207b8f629f6d406b92ffa6284f5545085eafb837c469018b715755f619b587163b"},{"512061f52925826e51e4615007557ddbea55b22c817909d7ebcfd3c454c634643ece"}},
                 {{"5120c481a8ada38d1070094f62af526d4f8aae2eb1e44d1fd961be6a25198b4da77b"},{"512034a2d31c091905e62def62b575b88beff41723d83acb02dfada2e73d9c529b40"},{"5120e0ecc278655b092962ded92a5781bd8e86e8408055de05f121e107fa211e5dfb"}},
@@ -913,7 +967,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "wsh(or_d(pk([2557c640/48h/1h/0h/2h]xpub6ArU6mnJDxmynaVKLV8FiFDaA9bVUw6efLEqt99qGK6B4QVWiNjc21JNFKkXNjgT8NCUmpFpSSBrYFtWEAqGirbqT4J1bRFpWyAnYdzmZUm/0/*),and_v(v:pkh([00aabb22/48h/1h/0h/2h]xpub6ArU6mnJDxmyogzqia2fdnD3gWHvfDtZAHdmKx4ccJwUBZd3rpgQM9qgmPAn1mqT2yh81uvGGohMkg3fNLoXZzn7sRo4a1X3KnCAVot2yuS/0/*),older(2))))",
                 "wsh(or_d(pk([2557c640/48h/1h/0h/2h]xpub6ArU6mnJDxmynaVKLV8FiFDaA9bVUw6efLEqt99qGK6B4QVWiNjc21JNFKkXNjgT8NCUmpFpSSBrYFtWEAqGirbqT4J1bRFpWyAnYdzmZUm/1/*),and_v(v:pkh([00aabb22/48h/1h/0h/2h]xpub6ArU6mnJDxmyogzqia2fdnD3gWHvfDtZAHdmKx4ccJwUBZd3rpgQM9qgmPAn1mqT2yh81uvGGohMkg3fNLoXZzn7sRo4a1X3KnCAVot2yuS/1/*),older(2))))"
             },
-            {RANGE},
+            {RANGE | MULTIPATH},
             {
                 {{"0020538436a60f2a638ea9e1e1342e9b93374aa7ec559ff0a805b3a185d4ba855d7f"},{"00203a588d107d604b6913201c7c1e1722f07a0f8fb3a382744f17b9ae5f6ccfcdd7"},{"0020d30fb375f7c491a208e77c7b5d0996ca14cf4a770c2ab5981f915c0e4565c74a"}},
                 {{"002072b5fc3a691c48fdbaf485f27e787b4094055d4b434c90c81ed1090f3d48733b"},{"0020a9ccdf4496e5d60db4704b27494d9d74f54a16c180ff954a43ce5e3aa465113a"},{"0020d17e21820a0069ca87049513eca763f08a74b586724441e7d76fc5142bcc327c"}},
@@ -938,7 +992,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
             "tr(xpub6CY33ZvKuS63kwDnpNCCo5YrrgkUXgdUKdCVhd4Dru5gCB3z8wGnqFiUP98Za5pYSYF5KmvBHTY3Ra8FAJGggzBjuHS69WzN8gscPupuZwK,l:pk(xpub6E9a95u27Qqa13XEz62FUgaFMWzHnHrb54dWfMHU7K9A33eDccvUkbu1sHYoByHAgJdR326rWqn9pGZgZHz1afDprW5gGwS4gUX8Ri6aGPZ/2))",
             "tr(xpub6CY33ZvKuS63kwDnpNCCo5YrrgkUXgdUKdCVhd4Dru5gCB3z8wGnqFiUP98Za5pYSYF5KmvBHTY3Ra8FAJGggzBjuHS69WzN8gscPupuZwK,l:pk(xpub6E9a95u27Qqa13XEz62FUgaFMWzHnHrb54dWfMHU7K9A33eDccvUkbu1sHYoByHAgJdR326rWqn9pGZgZHz1afDprW5gGwS4gUX8Ri6aGPZ/3))",
         },
-        {XONLY_KEYS},
+        {XONLY_KEYS | MULTIPATH},
         {
             {{"512094cb097990da64eebbad7b979b1326f3cbe356357abf4deb4c4ff80c7acbe902"}},
             {{"5120f091450b88c606f5cbc3f0cebe89e00bc5dd27f92e22f54da06439bc0c401f41"}},
@@ -963,7 +1017,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "tr(xpub6CY33ZvKuS63kwDnpNCCo5YrrgkUXgdUKdCVhd4Dru5gCB3z8wGnqFiUP98Za5pYSYF5KmvBHTY3Ra8FAJGggzBjuHS69WzN8gscPupuZwK/2,l:pk(xpub6E9a95u27Qqa13XEz62FUgaFMWzHnHrb54dWfMHU7K9A33eDccvUkbu1sHYoByHAgJdR326rWqn9pGZgZHz1afDprW5gGwS4gUX8Ri6aGPZ))",
                 "tr(xpub6CY33ZvKuS63kwDnpNCCo5YrrgkUXgdUKdCVhd4Dru5gCB3z8wGnqFiUP98Za5pYSYF5KmvBHTY3Ra8FAJGggzBjuHS69WzN8gscPupuZwK/3,l:pk(xpub6E9a95u27Qqa13XEz62FUgaFMWzHnHrb54dWfMHU7K9A33eDccvUkbu1sHYoByHAgJdR326rWqn9pGZgZHz1afDprW5gGwS4gUX8Ri6aGPZ))",
             },
-            {XONLY_KEYS},
+            {XONLY_KEYS | MULTIPATH},
             {
                 {{"51200e3c14456bfa30f9f0bed6e55f35e1e9ca17c835e9f71b25bac0dfaab38ff2cd"}},
                 {{"51202bdda29337ecaf8fcd5aa395febac6f99b8a866a0e8fb3f7bde2e24b1a7df2ba"}},
@@ -1205,7 +1259,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "rawtr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/2/0/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/4/*))",
                 "rawtr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/3/0/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/0/*,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t/0/0/5/*))",
             },
-            {XONLY_KEYS | RANGE | MUSIG},
+            {XONLY_KEYS | RANGE | MUSIG | MULTIPATH},
             {
                 {{"51204ba445a411bd8500476ef916e6d4dd7c137a77e0637e5b0e98339210d78d595a"},{"5120800394c4f39743734c9a15eaa171476814bed0ea19ad771037c5f1ceb20244a9"},{"512011658c4e00fae6f22b9adc2b3823ff3ec6367599783788f4aa8fe1ab3dd0a7ea"}},
                 {{"5120b977ae89f221762a61ee986fed7a493426462483afef46f7225765e015934961"},{"5120b70bf732ed38fcc2052075f83901f8588f1016f6741aaacce6e439a02235e5ed"},{"5120d7fa329159ae543b41ca81c7b0e916824ce5d13f61de5b6246dc55a3367f8596"}},
@@ -1235,7 +1289,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "rawtr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t)/4/*)",
                 "rawtr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t)/5/*)",
             },
-            {XONLY_KEYS | RANGE | MUSIG | MUSIG_DERIVATION},
+            {XONLY_KEYS | RANGE | MUSIG | MUSIG_DERIVATION | MULTIPATH},
             {
                 {{"51204a0fecdd99c67eb2afca0efa9a008c8bbc4dbb5ccb094b3eee273127b1ababee"},{"512006120155e6bfd6a3abf8a697caaf5669058395ae0052283a1c6e852d373ceccd"},{"5120d46831206710fca12ef7b562a0812250fdda110146dc1b9ac3a099c81ebcef82"}},
                 {{"5120f2b491de0be3b53482253865a5e0f2d2dbdc425d59db0c48f01c6bed9c6687c2"},{"5120601daf543e702b9c28a02f33961dfddfad666d9218b3b0b80177420b37619683"},{"512081dc64aac07811399defde8c959e3a66c56b621360e55ff01c2d43dfe7928b66"}},
@@ -1265,7 +1319,7 @@ BOOST_AUTO_TEST_CASE(descriptor_test)
                 "tr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t)/6/*,pk(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/8/*))",
                 "tr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y,xpub661MyMwAqRbcGDZQUKLqmWodYLcoBQnQH33yYkkF3jjxeLvY8qr2wWGEWkiKFaaQfJCoi3HeEq3Dc5DptfbCyjD38fNhSqtKc1UHaP4ba3t)/6/*,pk(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/9/*))",
             },
-            {XONLY_KEYS | RANGE | MUSIG | MUSIG_DERIVATION | MIXED_MUSIG},
+            {XONLY_KEYS | RANGE | MUSIG | MUSIG_DERIVATION | MIXED_MUSIG | MULTIPATH},
             {
                 {{"5120682fd07aa0f18643fd2c8a2411a0525b5391d7ad54e1904c9c0d7f524e49b39c"},{"51200410a642ea6b9ab884ba892205f484ad716cf0d8426dd739bd67d1636cdce870"},{"5120971dc3136dd90be8aa879d9b0f5c449b62e738cbf7129623098bb3b3aa57eb7d"}},
                 {{"51208e4158b3e54e32b4ad22f6dffb9f7968c92dfe96fd0b8fd3d30d3e2558a2a694"},{"512094273ac6b6f8ac060ba5681ba0906e54a51ab67fd08092e9b2af568b82aa1c7c"},{"5120ef0c7915708eb5baa95125e75417306391f339cfc533a19000ab8f2f53da78c1"}},
@@ -1311,6 +1365,15 @@ BOOST_AUTO_TEST_CASE(descriptor_literal_null_byte)
     BOOST_REQUIRE_MESSAGE(!descs.empty(), err);
 }
 
+BOOST_AUTO_TEST_CASE(descriptor_parse_clears_stale_error)
+{
+    FlatSigningProvider keys;
+    std::string error{"stale error"};
+    const auto descs{Parse("sh(wpkh(0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798),wpkh(0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798))", keys, error)};
+    BOOST_CHECK(descs.empty());
+    BOOST_CHECK(error.empty());
+}
+
 BOOST_AUTO_TEST_CASE(descriptor_older_warnings)
 {
     // A safe boundary value should yield no warnings.
@@ -1394,7 +1457,7 @@ void CheckUnused(const std::string& prv, const std::string& pub)
     // Check both only have one pubkey
     std::set<CPubKey> prv_pubkeys;
     std::set<CExtPubKey> prv_extpubs;
-    parse_pub->GetPubKeys(prv_pubkeys, prv_extpubs);
+    parse_priv->GetPubKeys(prv_pubkeys, prv_extpubs);
     BOOST_CHECK_EQUAL(prv_pubkeys.size() + prv_extpubs.size(), 1);
     std::set<CPubKey> pub_pubkeys;
     std::set<CExtPubKey> pub_extpubs;
@@ -1418,4 +1481,106 @@ BOOST_AUTO_TEST_CASE(unused_descriptor_test)
     CheckUnused("unused(xprvA1RpRA33e1JQ7ifknakTFpgNXPmW2YvmhqLQYMmrj4xJXXWYpDPS3xz7iAxn8L39njGVyuoseXzU6rcxFLJ8HFsTjSyQbLYnMpCqE2VbFWc/0h/0h/1)", "unused(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/0h/0h/1)");
 }
 
+BOOST_AUTO_TEST_CASE(parse_multipath_string_test)
+{
+    // Master extended key from BIP32 test vector 2
+    const std::string xprv{"xprv9s21ZrQH143K31xYSDQpPDxsXRTUcvj2iNHm5NUtrGiGG5e2DtALGdso3pGz6ssrdK4PFmM8NSpSBHNqPqm55Qn3LqFtT2emdEXVYsCzC2U"};
+    const CExtKey master{DecodeExtKey(xprv)};
+    const std::string xpub{EncodeExtPubKey(master.Neuter())};
+    const std::string wif{"L4rK1yDtCWekvXuE6oXD9jCYfFNV2cWRpVuPLBcCU2z8TrisoyY1"};
+    const CPubKey pubkey{DecodeSecret(wif).GetPubKey()};
+
+    // The fingerprint of xprv and its extended public keys at 84h/0h/0h and at 0h
+    const std::string fpr{HexStr(master.Neuter().id_key_fingerprint())};
+    CExtKey acc{master};
+    for (uint32_t i : {84, 0, 0}) BOOST_REQUIRE(acc.Derive(acc, i | 0x80000000));
+    const std::string acc_xpub{EncodeExtPubKey(acc.Neuter())};
+    CExtKey acc0{master};
+    BOOST_REQUIRE(acc0.Derive(acc0, 0 | 0x80000000));
+    const std::string acc0_xpub{EncodeExtPubKey(acc0.Neuter())};
+
+    // Parse a descriptor and check the multipath string reported alongside the expansion
+    const auto check{[](const std::string& desc_str, const std::string& expected_multipath, size_t num_descs) {
+        FlatSigningProvider keys;
+        std::string error;
+        std::optional<std::string> multipath;
+        auto descs = Parse(desc_str, keys, error, /*require_checksum=*/false, &multipath);
+        BOOST_REQUIRE_MESSAGE(descs.size() == num_descs, desc_str + ": " + error);
+        BOOST_REQUIRE(multipath);
+        BOOST_CHECK_EQUAL(*multipath, expected_multipath + "#" + GetDescriptorChecksum(expected_multipath));
+    }};
+
+    // Private extended keys followed by hardened derivation steps are
+    // normalized: the key origin and the extended public key at the last
+    // hardened step, merging any explicit origin; unhardened suffixes are unchanged
+    check("wpkh(" + xprv + "/84h/0h/0h/<0;1>/*)", "wpkh([" + fpr + "/84h/0h/0h]" + acc_xpub + "/<0;1>/*)", 2);
+    check("wpkh(" + xprv + "/84h/0h/0h/2/<0;1>/*)", "wpkh([" + fpr + "/84h/0h/0h]" + acc_xpub + "/2/<0;1>/*)", 2);
+    check("wpkh([deadbeef/49']" + xprv + "/0h/<0;1>/*)", "wpkh([deadbeef/49h/0h]" + acc0_xpub + "/<0;1>/*)", 2);
+    // An explicit origin is normalized even when the key has no hardened suffix
+    check("wpkh([deadbeef/49']" + xprv + "/<0;1>/*)", "wpkh([deadbeef/49h]" + xpub + "/<0;1>/*)", 2);
+    // An x-only key is replaced by its x-only public form
+    check("tr(" + wif + ",pk(" + xprv + "/<0;1>/*))", "tr(" + HexStr(XOnlyPubKey{pubkey}) + ",pk(" + xpub + "/<0;1>/*))", 2);
+    // Also within miniscript
+    check("wsh(or_b(pk(" + wif + "),s:pk(" + xprv + "/<0;1>/*)))", "wsh(or_b(pk(" + HexStr(pubkey) + "),s:pk(" + xpub + "/<0;1>/*)))", 2);
+}
+
+BOOST_AUTO_TEST_CASE(descriptor_known_keys)
+{
+    // BIP 32 test vector 1: master key with fingerprint 3442193e, and m/0h
+    const std::string xprv{"xprv9s21ZrQH143K3QTDL4LXw2F7HEK3wJUD2nW2nRk4stbPy6cq3jPPqjiChkVvvNKmPGJxWUtg6LnF5kejMRNNU3TGtRBeJgk33yuGBxrMPHi"};
+    const std::string xpub{"xpub661MyMwAqRbcFtXgS5sYJABqqG9YLmC4Q1Rdap9gSE8NqtwybGhePY2gZ29ESFjqJoCu1Rupje8YtGqsefD265TMg7usUDFdp6W1EGMcet8"};
+    const std::string xpub_0h{"xpub68Gmy5EdvgibQVfPdqkBBCHxA5htiqg55crXYuXoQRKfDBFA1WEjWgP6LHhwBZeNK1VTsfTFUHCdrfp1bgwQ9xv5ski8PX9rL2dZXvgGDnw"};
+
+    std::map<CExtPubKey, CExtKey> known;
+    const CExtKey ext_key{DecodeExtKey(xprv)};
+    known.emplace(ext_key.Neuter(), ext_key);
+
+    const auto with_checksum = [](const std::string& desc) { return desc + "#" + GetDescriptorChecksum(desc); };
+    // Parse desc with the known keys and check its public form, and its
+    // private form if expected.
+    const auto check = [&](const std::string& desc, const std::string& expected_pub, const std::string& expected_priv, const std::map<CExtPubKey, CExtKey>* known_xprvs) {
+        FlatSigningProvider keys;
+        std::string error;
+        const auto parsed{Parse(desc, keys, error, /*require_checksum=*/false, /*multipath=*/nullptr, known_xprvs)};
+        BOOST_REQUIRE_MESSAGE(parsed.size() == 1, error);
+        BOOST_CHECK_EQUAL(parsed[0]->ToString(), with_checksum(expected_pub));
+        std::string priv;
+        if (expected_priv.empty()) {
+            BOOST_CHECK(!parsed[0]->ToPrivateString(keys, priv));
+        } else {
+            BOOST_REQUIRE(parsed[0]->ToPrivateString(keys, priv));
+            BOOST_CHECK_EQUAL(priv, with_checksum(expected_priv));
+        }
+    };
+
+    // The origin and the key derived from it are replaced by the known key and the full path
+    check("pkh([3442193e/0h]" + xpub_0h + "/1/*)", "pkh(" + xpub + "/0h/1/*)", "pkh(" + xprv + "/0h/1/*)", &known);
+    // The hardened marker of the origin is kept
+    check("pkh([3442193e/0']" + xpub_0h + "/1/*)", "pkh(" + xpub + "/0'/1/*)", "pkh(" + xprv + "/0'/1/*)", &known);
+    // A known extended key is filled in as is
+    check("pkh(" + xpub + "/0h/1/*)", "pkh(" + xpub + "/0h/1/*)", "pkh(" + xprv + "/0h/1/*)", &known);
+    // Inside miniscript and musig
+    check("wsh(pk([3442193e/0h]" + xpub_0h + "/1/*))", "wsh(pk(" + xpub + "/0h/1/*))", "wsh(pk(" + xprv + "/0h/1/*))", &known);
+    check("tr(musig([3442193e/0h]" + xpub_0h + "," + xpub + ")/1/*)", "tr(musig(" + xpub + "/0h," + xpub + ")/1/*)", "tr(musig(" + xprv + "/0h," + xprv + ")/1/*)", &known);
+    // A mismatched fingerprint or path leaves the descriptor unchanged
+    check("pkh([deadbeef/0h]" + xpub_0h + "/1/*)", "pkh([deadbeef/0h]" + xpub_0h + "/1/*)", "", &known);
+    check("pkh([3442193e/1h]" + xpub_0h + "/1/*)", "pkh([3442193e/1h]" + xpub_0h + "/1/*)", "", &known);
+    // Without known keys, nothing is filled in
+    check("pkh([3442193e/0h]" + xpub_0h + "/1/*)", "pkh([3442193e/0h]" + xpub_0h + "/1/*)", "", nullptr);
+
+    // A multipath descriptor expands with the known key, including when its
+    // apostrophe hardened markers make it parse a second time
+    {
+        FlatSigningProvider keys;
+        std::string error;
+        const auto parsed{Parse("pkh([3442193e/0']" + xpub_0h + "/<0;1>/*)", keys, error, /*require_checksum=*/false, /*multipath=*/nullptr, &known)};
+        BOOST_REQUIRE_MESSAGE(parsed.size() == 2, error);
+        for (size_t i{0}; i < parsed.size(); ++i) {
+            std::string priv;
+            BOOST_REQUIRE(parsed[i]->ToPrivateString(keys, priv));
+            BOOST_CHECK_EQUAL(priv, with_checksum("pkh(" + xprv + "/0h/" + util::ToString(i) + "/*)"));
+        }
+    }
+}
+
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/wallet/export.cpp b/src/wallet/export.cpp
index 9f9a9486db88..4c893e6f941f 100644
--- a/src/wallet/export.cpp
+++ b/src/wallet/export.cpp
@@ -33,6 +33,8 @@ util::Expected<std::vector<WalletDescInfo>, std::string> ExportDescriptors(const
         const bool is_range = wallet_descriptor.descriptor->IsRange();
         wallet_descriptors.emplace_back(
             descriptor,
+            wallet_descriptor.id,
+            wallet.GetMultipathDescriptor(wallet_descriptor.id),
             wallet_descriptor.creation_time,
             wallet.IsActiveScriptPubKeyMan(*desc_spk_man),
             wallet.IsInternalScriptPubKeyMan(desc_spk_man),
@@ -86,6 +88,11 @@ util::Result<std::string> ExportWatchOnlyWallet(const CWallet& wallet, const fs:
     {
         LOCK(watchonly_wallet->cs_wallet);
 
+        // Map from the descriptor IDs in this wallet to those in the watchonly
+        // wallet. They can differ because the exported descriptor string is
+        // normalized.
+        std::map<uint256, uint256> desc_id_map;
+
         // Parse the descriptors and add them to the new wallet
         for (const WalletDescInfo& desc_info : *Assert(exported)) {
             // Parse the descriptor
@@ -105,6 +112,8 @@ util::Result<std::string> ExportWatchOnlyWallet(const CWallet& wallet, const fs:
 
             WalletDescriptor w_desc(std::move(descs.at(0)), desc_info.creation_time, range_start, range_end, desc_info.next_index);
 
+            desc_id_map.emplace(desc_info.desc_id, w_desc.id);
+
             // For descriptors that cannot self expand (i.e. needs private keys or cache), retrieve the cache
             uint256 desc_id = w_desc.id;
             if (!w_desc.descriptor->CanSelfExpand()) {
@@ -142,6 +151,20 @@ util::Result<std::string> ExportWatchOnlyWallet(const CWallet& wallet, const fs:
                 return util::Error{strprintf(_("Error: database transaction cannot be executed for new watchonly wallet %s"), watchonly_wallet->GetName())};
             }
 
+            // Copy the multipath descriptor records, with the descriptor IDs
+            // translated to those of the watchonly wallet
+            for (const auto& [id, multipath_desc] : wallet.GetMultipathDescriptors()) {
+                std::vector<uint256> watchonly_desc_ids;
+                watchonly_desc_ids.reserve(multipath_desc.desc_ids.size());
+                for (const uint256& desc_id : multipath_desc.desc_ids) {
+                    watchonly_desc_ids.push_back(desc_id_map.at(desc_id));
+                }
+                MultipathDescriptorRecord watchonly_record{multipath_desc.descriptor, std::move(watchonly_desc_ids)};
+                if (!watchonly_wallet->AddMultipathDescriptor(watchonly_batch, std::move(watchonly_record))) {
+                    return util::Error{_("Error: Unable to write multipath descriptor record to watchonly wallet")};
+                }
+            }
+
             // Copy orderPosNext
             watchonly_batch.WriteOrderPosNext(wallet.nOrderPosNext);
 
diff --git a/src/wallet/export.h b/src/wallet/export.h
index 5f2289302ccb..82c818101ce6 100644
--- a/src/wallet/export.h
+++ b/src/wallet/export.h
@@ -14,10 +14,14 @@
 
 namespace wallet {
 // Struct containing all of the info from WalletDescriptor, except with the descriptor as a string,
-// and without its ID or cache.
+// and without its cache.
 // Used when exporting descriptors from the wallet.
 struct WalletDescInfo {
     std::string descriptor;
+    //! The descriptor's ID in the wallet it was exported from
+    uint256 desc_id;
+    //! The multipath descriptor that this descriptor was expanded from, if any
+    std::optional<std::string> multipath;
     uint64_t creation_time;
     bool active;
     std::optional<bool> internal;
diff --git a/src/wallet/external_signer_scriptpubkeyman.cpp b/src/wallet/external_signer_scriptpubkeyman.cpp
index 758be582ac4a..96aca3c25c13 100644
--- a/src/wallet/external_signer_scriptpubkeyman.cpp
+++ b/src/wallet/external_signer_scriptpubkeyman.cpp
@@ -7,6 +7,7 @@
 #include <common/system.h>
 #include <external_signer.h>
 #include <node/types.h>
+#include <util/strencodings.h>
 #include <wallet/external_signer_scriptpubkeyman.h>
 
 #include <iostream>
@@ -26,6 +27,15 @@ std::unique_ptr<ExternalSignerScriptPubKeyMan> ExternalSignerScriptPubKeyMan::Lo
     return std::unique_ptr<ExternalSignerScriptPubKeyMan>(new ExternalSignerScriptPubKeyMan(storage, descriptor, keypool_size, keys, ckeys));
 }
 
+std::unique_ptr<ExternalSignerScriptPubKeyMan> ExternalSignerScriptPubKeyMan::CreateFromImport(WalletStorage& storage, WalletDescriptor& descriptor, int64_t keypool_size, const FlatSigningProvider& provider)
+{
+    auto spkm = std::unique_ptr<ExternalSignerScriptPubKeyMan>(new ExternalSignerScriptPubKeyMan(storage, descriptor, keypool_size));
+    if (auto res = spkm->UpdateWalletDescriptor(descriptor, provider); !res) {
+        throw std::runtime_error(util::ErrorString(res).original);
+    }
+    return spkm;
+}
+
 std::unique_ptr<ExternalSignerScriptPubKeyMan> ExternalSignerScriptPubKeyMan::CreateNew(WalletStorage& storage, WalletBatch& batch, int64_t keypool_size, std::unique_ptr<Descriptor> desc)
 {
     auto spkm = std::unique_ptr<ExternalSignerScriptPubKeyMan>(new ExternalSignerScriptPubKeyMan(storage, keypool_size));
@@ -52,15 +62,21 @@ std::unique_ptr<ExternalSignerScriptPubKeyMan> ExternalSignerScriptPubKeyMan::Cr
     return spkm;
 }
 
- util::Result<ExternalSigner> ExternalSignerScriptPubKeyMan::GetExternalSigner() {
+util::Result<std::vector<ExternalSigner>> ExternalSignerScriptPubKeyMan::GetExternalSigners() {
     const std::string command = gArgs.GetArg("-signer", "");
     if (command == "") return util::Error{Untranslated("restart bitcoind with -signer=<cmd>")};
     std::vector<ExternalSigner> signers;
     ExternalSigner::Enumerate(command, signers, Params().GetChainTypeString());
     if (signers.empty()) return util::Error{Untranslated("No external signers found")};
+    return signers;
+}
+
+util::Result<ExternalSigner> ExternalSignerScriptPubKeyMan::GetExternalSigner() {
+    auto signers{GetExternalSigners()};
+    if (!signers) return util::Error{util::ErrorString(signers)};
     // TODO: add fingerprint argument instead of failing in case of multiple signers.
-    if (signers.size() > 1) return util::Error{Untranslated("More than one external signer found. Please connect only one at a time.")};
-    return signers[0];
+    if (signers->size() > 1) return util::Error{Untranslated("More than one external signer found. Please connect only one at a time.")};
+    return std::move(signers->front());
 }
 
 util::Result<void> ExternalSignerScriptPubKeyMan::DisplayAddress(const CTxDestination& dest, const ExternalSigner &signer) const
@@ -85,16 +101,65 @@ util::Result<void> ExternalSignerScriptPubKeyMan::DisplayAddress(const CTxDestin
     return util::Result<void>();
 }
 
+util::Result<void> ExternalSignerScriptPubKeyMan::DisplayAddressRegistered(const CTxDestination& dest,
+                                                                           const ExternalSigner& signer,
+                                                                           const std::string& registration,
+                                                                           bool change,
+                                                                           uint32_t index) const
+{
+    const UniValue& result{signer.DisplayAddressRegistered(registration, change, index)};
+
+    const UniValue& error = result.find_value("error");
+    if (error.isStr()) return util::Error{strprintf(_("Signer returned error: %s"), error.getValStr())};
+
+    const UniValue& ret_address = result.find_value("address");
+    if (!ret_address.isStr()) return util::Error{_("Signer did not echo address")};
+
+    // Compare the echoed address by witness program rather than by string.
+    // The Ledger Bitcoin app, for instance, encodes addresses with the
+    // testnet "tb1..." HRP even when -chain=regtest is in effect, so a
+    // strict EncodeDestination comparison would spuriously fail. Try each
+    // known chain's params and accept the echo if any of them decodes to
+    // the same scriptPubKey as the requested destination.
+    const CScript expected_script{GetScriptForDestination(dest)};
+    bool address_matches{false};
+    for (const ChainType chain : {ChainType::MAIN, ChainType::TESTNET, ChainType::TESTNET4, ChainType::SIGNET, ChainType::REGTEST}) {
+        std::unique_ptr<const CChainParams> cp = CreateChainParams(gArgs, chain);
+        std::string err;
+        const CTxDestination cand = DecodeDestination(ret_address.getValStr(), *cp, err);
+        if (IsValidDestination(cand) && GetScriptForDestination(cand) == expected_script) {
+            address_matches = true;
+            break;
+        }
+    }
+    if (!address_matches) {
+        return util::Error{strprintf(_("Signer echoed unexpected address %s"), ret_address.getValStr())};
+    }
+
+    return util::Result<void>();
+}
+
 // If sign is true, transaction must previously have been filled
 std::optional<PSBTError> ExternalSignerScriptPubKeyMan::FillPSBT(PartiallySignedTransaction& psbt, const PrecomputedTransactionData& txdata, const common::PSBTFillOptions& options, int* n_signed) const
 {
-    if (!options.sign) {
-        return DescriptorScriptPubKeyMan::FillPSBT(psbt, txdata, options, n_signed);
-    }
+    // Fill in metadata. The base class only signs if options.sign is set, and
+    // only with keys we hold ourselves.
+    if (auto err = DescriptorScriptPubKeyMan::FillPSBT(psbt, txdata, options, n_signed)) return err;
+    if (!options.sign) return {};
 
-    // Already complete if every input is now signed
+    // No need for an external signer roundtrip if we already have all the
+    // signatures we need.
     bool complete = true;
     for (const auto& input : psbt.inputs) {
+        CTxOut utxo;
+        // An externally created PSBT may not include the UTXO for inputs we
+        // don't know, in which case we can't tell whether it's ours. Leave it
+        // to the signer.
+        if (input.GetUTXO(utxo)) {
+            // Only consider inputs that belong to this descriptor; the wallet
+            // may hold the private key for the other inputs.
+            if (!IsMine(utxo.scriptPubKey)) continue;
+        }
         complete &= PSBTInputSigned(input);
     }
     if (complete) return {};
@@ -113,4 +178,116 @@ std::optional<PSBTError> ExternalSignerScriptPubKeyMan::FillPSBT(PartiallySigned
     if (options.finalize) FinalizePSBT(psbt); // This won't work in a multisig setup
     return {};
 }
+
+std::optional<PSBTError> ExternalSignerScriptPubKeyMan::FillPSBTRegistered(PartiallySignedTransaction& psbt,
+                                                                           const PrecomputedTransactionData& txdata,
+                                                                           common::PSBTFillOptions options,
+                                                                           int* n_signed,
+                                                                           ExternalSigner& signer,
+                                                                           const std::string& registration) const
+{
+    if (!options.sign) {
+        return DescriptorScriptPubKeyMan::FillPSBT(psbt, txdata, options, n_signed);
+    }
+
+    // First let the local descriptor signer contribute (e.g. for a
+    // MuSig2 cosigner whose xprv lives in this wallet). It will add
+    // its own pub-nonce in round 1 and its partial signature in round
+    // 2; in single-sig mode it'll just sign with the local xprv. The
+    // signer below works around the Ledger app's quirk of refusing to
+    // run a round when another participant's data is already in the
+    // input, by stashing those entries in HWI before talking to the
+    // device.
+    //
+    // Snapshot the per-input MuSig2 nonce + partial-sig counts before
+    // the local pass so the soft-fail path below can tell whether this
+    // call actually advanced the PSBT (round-1 pubnonce or round-2
+    // partial sig from a hot cosigner) or was a no-op replay.
+    auto musig2_contribution_count = [](const PartiallySignedTransaction& p) {
+        size_t n = 0;
+        for (const auto& input : p.inputs) {
+            for (const auto& [_, nonces] : input.m_musig2_pubnonces) n += nonces.size();
+            for (const auto& [_, sigs] : input.m_musig2_partial_sigs) n += sigs.size();
+        }
+        return n;
+    };
+    const size_t musig2_count_before = musig2_contribution_count(psbt);
+    common::PSBTFillOptions local_options{options};
+    local_options.finalize = false;
+    if (auto err = DescriptorScriptPubKeyMan::FillPSBT(psbt, txdata, local_options, n_signed)) {
+        return err;
+    }
+    const bool local_added_musig2 = musig2_contribution_count(psbt) > musig2_count_before;
+
+    // Already complete if every input is now signed.
+    bool complete = true;
+    for (const auto& input : psbt.inputs) {
+        complete &= PSBTInputSigned(input);
+    }
+    if (complete) return {};
+
+    std::string failure_reason;
+    bool signer_ok;
+    try {
+        signer_ok = signer.SignTransactionRegistered(psbt, registration, failure_reason);
+    } catch (const std::runtime_error& e) {
+        // The signer subprocess exited non-zero (e.g. device unplugged
+        // mid-flow, or HWI reporting a transport error). Treat it
+        // the same as a structured `{"error":...}` response so the
+        // caller sees a uniform EXTERNAL_SIGNER_FAILED instead of an
+        // uncaught exception bubbling up through the RPC layer.
+        signer_ok = false;
+        failure_reason = e.what();
+    }
+    if (!signer_ok) {
+        LogWarning("Failed to sign with registered descriptor: %s\n", failure_reason);
+        // Soft-fail for multi-round MuSig2 flows, but only when the
+        // local pass above actually added a new MuSig2 contribution
+        // (round 1 pubnonce or round 2 partial signature) on this
+        // call. Surfacing the device error as a hard PSBTError would
+        // discard that fresh contribution and force the caller to
+        // start over once the device is back; instead we keep the
+        // partial PSBT and let the outer FillPSBT report
+        // complete=false so a follow-up walletprocesspsbt can drive
+        // the device round. If the local pass was a no-op (single-
+        // round flow, or a replay where the hot cosigner has already
+        // contributed everything it can in a previous call) we hard-
+        // fail, so callers see a clear EXTERNAL_SIGNER_FAILED instead
+        // of an unchanged PSBT being silently returned as "fine".
+        if (!local_added_musig2) {
+            return PSBTError::EXTERNAL_SIGNER_FAILED;
+        }
+        return {};
+    }
+    // For multi-round flows like MuSig2, the local signer above may have
+    // contributed its share (round 1 pubnonce, round 2 partial signature)
+    // before the external signer added its own. After round 2 both
+    // cosigners' partial signatures are present in the PSBT, but neither
+    // FillPSBT call attempted aggregation -- the local one ran before the
+    // external signer's partial sig was available, and the external signer
+    // doesn't aggregate on its own. When the caller asked for finalization,
+    // run FinalizePSBT to aggregate any complete MuSig2 sessions into a
+    // Schnorr key-path signature. Round 1 (only nonces) is a no-op.
+    if (options.finalize) {
+        FinalizePSBT(psbt);
+    }
+    return {};
+}
+
+util::Result<std::string> ExternalSignerScriptPubKeyMan::RegisterDescriptor(const ExternalSigner& signer,
+                                                                            const std::string& name,
+                                                                            const std::string& descriptor) const
+{
+    const UniValue& result{signer.RegisterDescriptor(name, descriptor)};
+
+    const UniValue& error = result.find_value("error");
+    if (error.isStr()) return util::Error{strprintf(_("Signer returned error: %s"), error.getValStr())};
+
+    const UniValue& registration = result.find_value("registration");
+    if (!registration.isStr() || registration.getValStr().empty()) {
+        return util::Error{_("Signer returned invalid registration field")};
+    }
+    return registration.getValStr();
+}
+
 } // namespace wallet
diff --git a/src/wallet/external_signer_scriptpubkeyman.h b/src/wallet/external_signer_scriptpubkeyman.h
index 8a3ae3df7a2b..d3b780913501 100644
--- a/src/wallet/external_signer_scriptpubkeyman.h
+++ b/src/wallet/external_signer_scriptpubkeyman.h
@@ -8,6 +8,7 @@
 #include <wallet/scriptpubkeyman.h>
 
 #include <memory>
+#include <optional>
 #include <util/result.h>
 
 struct bilingual_str;
@@ -21,14 +22,29 @@ class ExternalSignerScriptPubKeyMan : public DescriptorScriptPubKeyMan
         : DescriptorScriptPubKeyMan(storage, descriptor, keypool_size, keys, ckeys)
     {}
 
+    ExternalSignerScriptPubKeyMan(WalletStorage& storage, WalletDescriptor& descriptor, int64_t keypool_size)
+        : DescriptorScriptPubKeyMan(storage, descriptor, keypool_size)
+    {}
+
     ExternalSignerScriptPubKeyMan(WalletStorage& storage, int64_t keypool_size)
         : DescriptorScriptPubKeyMan(storage, keypool_size)
     {}
 
 public:
     static std::unique_ptr<ExternalSignerScriptPubKeyMan> LoadFromStorage(WalletStorage& storage, WalletDescriptor& descriptor, int64_t keypool_size, const KeyMap& keys, const CryptedKeyMap& ckeys);
+    static std::unique_ptr<ExternalSignerScriptPubKeyMan> CreateFromImport(WalletStorage& storage, WalletDescriptor& descriptor, int64_t keypool_size, const FlatSigningProvider& provider);
     static std::unique_ptr<ExternalSignerScriptPubKeyMan> CreateNew(WalletStorage& storage, WalletBatch& batch, int64_t keypool_size, std::unique_ptr<Descriptor> desc);
 
+  /** Enumerate all external signers reachable through the configured
+   *  -signer command. Returns the full set so callers (e.g. multi-signer
+   *  MuSig2 wallets) can fan a single RPC out to every connected device.
+   */
+  static util::Result<std::vector<ExternalSigner>> GetExternalSigners();
+
+  /** Convenience wrapper that returns the single signer when exactly one
+   *  is connected. Errors out for the multi-signer case so callers that
+   *  haven't been taught to fan out keep their old behaviour.
+   */
   static util::Result<ExternalSigner> GetExternalSigner();
 
   /**
@@ -37,7 +53,48 @@ class ExternalSignerScriptPubKeyMan : public DescriptorScriptPubKeyMan
   */
  util::Result<void> DisplayAddress(const CTxDestination& dest, const ExternalSigner& signer) const;
 
+  /**
+   * Display an address belonging to a registered descriptor and verify the
+   * device echoes the same address.
+   * @param[in] dest          expected destination
+   * @param[in] signer        external signer to talk to
+   * @param[in] registration  opaque value returned by `registerdescriptor`
+   * @param[in] change        whether `dest` lives on the change chain
+   * @param[in] index         address index within the chain
+   */
+  util::Result<void> DisplayAddressRegistered(const CTxDestination& dest,
+                                              const ExternalSigner& signer,
+                                              const std::string& registration,
+                                              bool change,
+                                              uint32_t index) const;
+
   std::optional<common::PSBTError> FillPSBT(PartiallySignedTransaction& psbt, const PrecomputedTransactionData& txdata, const common::PSBTFillOptions& options, int* n_signed = nullptr) const override;
+
+  /**
+   * Sign a PSBT through an external signer using a registered descriptor.
+   * @param[in,out] psbt          PSBT to fill / sign
+   * @param[in]     txdata        precomputed sighash data
+   * @param[in]     options       how to fill the PSBT (sign, finalize, sighash_type, ...)
+   * @param[out]    n_signed      number of inputs signed by this SPKM
+   * @param[in]     signer        external signer to talk to
+   * @param[in]     registration  opaque value returned by `registerdescriptor`
+   */
+  std::optional<common::PSBTError> FillPSBTRegistered(PartiallySignedTransaction& psbt,
+                                                      const PrecomputedTransactionData& txdata,
+                                                      common::PSBTFillOptions options,
+                                                      int* n_signed,
+                                                      ExternalSigner& signer,
+                                                      const std::string& registration) const;
+
+  /**
+   * Register a descriptor with an external signer.
+   * @param[in] name        descriptor name to display on the signer
+   * @param[in] descriptor  combined multipath descriptor
+   * @returns opaque registration or an error message
+   */
+  util::Result<std::string> RegisterDescriptor(const ExternalSigner& signer,
+                                               const std::string& name,
+                                               const std::string& descriptor) const;
 };
 } // namespace wallet
 #endif // BITCOIN_WALLET_EXTERNAL_SIGNER_SCRIPTPUBKEYMAN_H
diff --git a/src/wallet/rpc/addresses.cpp b/src/wallet/rpc/addresses.cpp
index 805a79ba643f..d941c7950882 100644
--- a/src/wallet/rpc/addresses.cpp
+++ b/src/wallet/rpc/addresses.cpp
@@ -429,6 +429,7 @@ RPCMethod getaddressinfo()
                         {RPCResult::Type::BOOL, "solvable", "If we know how to spend coins sent to this address, ignoring the possible lack of private keys."},
                         {RPCResult::Type::STR, "desc", /*optional=*/true, "A descriptor for spending coins sent to this address (only when solvable)."},
                         {RPCResult::Type::STR, "parent_desc", /*optional=*/true, "The descriptor used to derive this address if this is a descriptor wallet"},
+                        {RPCResult::Type::STR, "multipath", /*optional=*/true, "The public multipath descriptor that the parent descriptor was expanded from when it was imported or created, if any"},
                         {RPCResult::Type::BOOL, "isscript", /*optional=*/true, "If the key is a script."},
                         {RPCResult::Type::BOOL, "ischange", "If the address was used for change output."},
                         {RPCResult::Type::BOOL, "iswitness", "If the address is a witness address."},
@@ -520,6 +521,9 @@ RPCMethod getaddressinfo()
         if (desc_spk_man->GetDescriptorString(desc_str, /*priv=*/false)) {
             ret.pushKV("parent_desc", desc_str);
         }
+        if (std::optional<std::string> multipath_desc{pwallet->GetMultipathDescriptor(desc_spk_man->GetID())}) {
+            ret.pushKV("multipath", *multipath_desc);
+        }
     }
 
     ret.pushKV("iswatchonly", false);
diff --git a/src/wallet/rpc/backup.cpp b/src/wallet/rpc/backup.cpp
index f785a603cc90..cb9db30c21bd 100644
--- a/src/wallet/rpc/backup.cpp
+++ b/src/wallet/rpc/backup.cpp
@@ -158,10 +158,15 @@ static UniValue ProcessDescriptorImport(CWallet& wallet, const UniValue& data, c
         const bool active = data.exists("active") ? data["active"].get_bool() : false;
         const std::string label{LabelFromValue(data["label"])};
 
-        // Parse descriptor string
+        // Parse descriptor string, filling in the wallet's HD private keys
         FlatSigningProvider keys;
         std::string error;
-        auto parsed_descs = Parse(descriptor, keys, error, /* require_checksum = */ true);
+        std::optional<std::string> multipath_normalized;
+        std::map<CExtPubKey, CExtKey> known_xprvs;
+        for (const auto& [xpub, spkms] : wallet.GetHDPubKeys(CWallet::HDKeyFilter::All)) {
+            if (std::optional<CExtKey> xprv{wallet.GetExtKey(xpub)}) known_xprvs.emplace(xpub, *xprv);
+        }
+        auto parsed_descs = Parse(descriptor, keys, error, /* require_checksum = */ true, &multipath_normalized, &known_xprvs);
         if (parsed_descs.empty()) {
             throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, error);
         }
@@ -231,6 +236,24 @@ static UniValue ProcessDescriptorImport(CWallet& wallet, const UniValue& data, c
             throw JSONRPCError(RPC_WALLET_ERROR, "Cannot import private keys to a wallet with private keys disabled");
         }
 
+        // Refuse an import whose expanded descriptors are already part of a
+        // different multipath descriptor: it would make the multipath
+        // attribution of the shared descriptors ambiguous, and such overlap is
+        // almost certainly an accident. Re-importing the same multipath
+        // descriptor is fine.
+        if (multipath_normalized) {
+            for (const auto& parsed_desc : parsed_descs) {
+                const uint256 desc_id{DescriptorID(*parsed_desc)};
+                for (const auto& [id, record] : wallet.GetMultipathDescriptors()) {
+                    if (record.descriptor != *multipath_normalized &&
+                        std::find(record.desc_ids.begin(), record.desc_ids.end(), desc_id) != record.desc_ids.end()) {
+                        throw JSONRPCError(RPC_WALLET_ERROR, strprintf("A descriptor expanded from this multipath descriptor is already part of the multipath descriptor '%s'", record.descriptor));
+                    }
+                }
+            }
+        }
+
+        std::vector<uint256> desc_ids;
         for (size_t j = 0; j < parsed_descs.size(); ++j) {
             auto parsed_desc = std::move(parsed_descs[j]);
             if (parsed_descs.size() == 2) {
@@ -289,6 +312,7 @@ static UniValue ProcessDescriptorImport(CWallet& wallet, const UniValue& data, c
             }
 
             auto& spk_manager = spk_manager_res.value().get();
+            desc_ids.push_back(spk_manager.GetID());
 
             // Set descriptor as active if necessary
             if (active) {
@@ -304,6 +328,15 @@ static UniValue ProcessDescriptorImport(CWallet& wallet, const UniValue& data, c
             }
         }
 
+        // For a multipath descriptor, store a record tying the expanded
+        // descriptors back to the original multipath form.
+        if (multipath_normalized) {
+            WalletBatch batch(wallet.GetDatabase());
+            if (auto res{wallet.AddMultipathDescriptor(batch, MultipathDescriptorRecord(std::move(*multipath_normalized), std::move(desc_ids)))}; !res) {
+                warnings.push_back(strprintf("Multipath descriptor record not stored: %s", util::ErrorString(res).original));
+            }
+        }
+
         result.pushKV("success", UniValue(true));
     } catch (const UniValue& e) {
         result.pushKV("success", UniValue(false));
@@ -327,7 +360,7 @@ RPCMethod importdescriptors()
                         {
                             {"", RPCArg::Type::OBJ, RPCArg::Optional::OMITTED, "",
                                 {
-                                    {"desc", RPCArg::Type::STR, RPCArg::Optional::NO, "Descriptor to import."},
+                                    {"desc", RPCArg::Type::STR, RPCArg::Optional::NO, "Descriptor to import. HD keys of the wallet, given as their extended public key or an origin from it, are imported with their private key."},
                                     {"active", RPCArg::Type::BOOL, RPCArg::Default{false}, "Set this descriptor to be the active descriptor for the corresponding output type/externality"},
                                     {"range", RPCArg::Type::RANGE, RPCArg::Optional::OMITTED, "If a ranged descriptor is used, this specifies the end or the range (in the form [begin,end]) to import"},
                                     {"next_index", RPCArg::Type::NUM, RPCArg::Optional::OMITTED, "If a ranged descriptor is set to active, this specifies the next index to generate addresses from"},
@@ -490,6 +523,7 @@ RPCMethod listdescriptors()
             {
                 {RPCResult::Type::OBJ, "", "", {
                     {RPCResult::Type::STR, "desc", "Descriptor string representation"},
+                    {RPCResult::Type::STR, "multipath", /*optional=*/true, "The public multipath descriptor that this descriptor was expanded from when it was imported or created, if any"},
                     {RPCResult::Type::NUM, "timestamp", "The creation time of the descriptor"},
                     {RPCResult::Type::BOOL, "active", "Whether this descriptor is currently used to generate new addresses"},
                     {RPCResult::Type::BOOL, "internal", /*optional=*/true, "True if this descriptor is used to generate change addresses. False if this descriptor is used to generate receiving addresses; defined only for active descriptors"},
@@ -534,6 +568,9 @@ RPCMethod listdescriptors()
     for (const WalletDescInfo& info : wallet_descriptors) {
         UniValue spk(UniValue::VOBJ);
         spk.pushKV("desc", info.descriptor);
+        if (info.multipath.has_value()) {
+            spk.pushKV("multipath", info.multipath.value());
+        }
         spk.pushKV("timestamp", info.creation_time);
         spk.pushKV("active", info.active);
         if (info.internal.has_value()) {
diff --git a/src/wallet/rpc/spend.cpp b/src/wallet/rpc/spend.cpp
index 1cc5e0445cb2..71db26c38f20 100644
--- a/src/wallet/rpc/spend.cpp
+++ b/src/wallet/rpc/spend.cpp
@@ -111,11 +111,13 @@ static UniValue FinishTransaction(const std::shared_ptr<CWallet> pwallet, const
     // Make a blank psbt
     PartiallySignedTransaction psbtx(rawTx, /*version=*/2);
 
+    bool keypath_only{options.exists("keypath_only") ? options["keypath_only"].get_bool() : DEFAULT_SIGN_TAPROOT_KEYPATH_ONLY};
+
     // First fill transaction with our data without signing,
     // so external signers are not asked to sign more than once.
     bool complete;
-    pwallet->FillPSBT(psbtx, {.sign = false, .bip32_derivs = true}, complete);
-    const auto err{pwallet->FillPSBT(psbtx, {.sign = true, .bip32_derivs = false}, complete)};
+    pwallet->FillPSBT(psbtx, {.sign = false, .bip32_derivs = true, .taproot_keypath_only = keypath_only}, complete);
+    const auto err{pwallet->FillPSBT(psbtx, {.sign = true, .bip32_derivs = false, .taproot_keypath_only = keypath_only}, complete)};
     if (err) {
         throw JSONRPCPSBTError(*err);
     }
@@ -499,6 +501,7 @@ CreatedTransactionResult FundTransaction(CWallet& wallet, const CMutableTransact
                     {"includeWatching", UniValueType(UniValue::VBOOL)},
                     {"include_watching", UniValueType(UniValue::VBOOL)},
                     {"inputs", UniValueType(UniValue::VARR)},
+                    {"keypath_only", UniValueType(UniValue::VBOOL)},
                     {"lockUnspents", UniValueType(UniValue::VBOOL)},
                     {"lock_unspents", UniValueType(UniValue::VBOOL)},
                     {"locktime", UniValueType(UniValue::VNUM)},
@@ -811,6 +814,9 @@ RPCMethod fundrawtransaction()
         throw JSONRPCError(RPC_DESERIALIZATION_ERROR, "TX decode failed");
     }
     UniValue options = request.params[1];
+    if (options.exists("keypath_only")) {
+        throw JSONRPCError(RPC_TYPE_ERROR, "Unexpected key keypath_only");
+    }
     std::vector<std::pair<CTxDestination, CAmount>> destinations;
     for (const auto& tx_out : tx.vout) {
         CTxDestination dest;
@@ -1222,6 +1228,7 @@ RPCMethod send()
                           }},
                         },
                     },
+                    {"keypath_only", RPCArg::Type::BOOL, RPCArg::Default{DEFAULT_SIGN_TAPROOT_KEYPATH_ONLY}, "Only add Taproot key-path data, and only sign and finalize Taproot inputs using the key path. Existing script-path data is not signed or finalized."},
                     {"locktime", RPCArg::Type::NUM, RPCArg::DefaultHint{"locktime close to block height to prevent fee sniping"}, "Raw locktime. Non-0 value also locktime-activates inputs"},
                     {"lock_unspents", RPCArg::Type::BOOL, RPCArg::Default{false}, "Lock selected unspent outputs"},
                     {"psbt", RPCArg::Type::BOOL,  RPCArg::DefaultHint{"automatic"}, "Always return a PSBT, implies add_to_wallet=false."},
@@ -1346,6 +1353,7 @@ RPCMethod sendall()
                         {"send_max", RPCArg::Type::BOOL, RPCArg::Default{false}, "When true, only use UTXOs that can pay for their own fees to maximize the output amount. When 'false' (default), no UTXO is left behind. send_max is incompatible with providing specific inputs."},
                         {"minconf", RPCArg::Type::NUM, RPCArg::Default{0}, "Require inputs with at least this many confirmations."},
                         {"maxconf", RPCArg::Type::NUM, RPCArg::Optional::OMITTED, "Require inputs with at most this many confirmations."},
+                        {"keypath_only", RPCArg::Type::BOOL, RPCArg::Default{DEFAULT_SIGN_TAPROOT_KEYPATH_ONLY}, "Only add Taproot key-path data, and only sign and finalize Taproot inputs using the key path. Existing script-path data is not signed or finalized."},
                         {"version", RPCArg::Type::NUM, RPCArg::Default{DEFAULT_WALLET_TX_VERSION}, "Transaction version"},
                     },
                     FundTxDoc()
@@ -1607,6 +1615,7 @@ RPCMethod walletprocesspsbt()
             "       \"SINGLE|ANYONECANPAY\""},
                     {"bip32derivs", RPCArg::Type::BOOL, RPCArg::Default{true}, "Include BIP 32 derivation paths for public keys if we know them"},
                     {"finalize", RPCArg::Type::BOOL, RPCArg::Default{true}, "Also finalize inputs if possible"},
+                    {"keypath_only", RPCArg::Type::BOOL, RPCArg::Default{DEFAULT_SIGN_TAPROOT_KEYPATH_ONLY}, "Only add Taproot key-path data, and only sign and finalize Taproot inputs using the key path. Existing script-path data is not signed or finalized."},
                 },
                 RPCResult{
                     RPCResult::Type::OBJ, "", "",
@@ -1621,10 +1630,10 @@ RPCMethod walletprocesspsbt()
                 },
         [](const RPCMethod& self, const JSONRPCRequest& request) -> UniValue
 {
-    const std::shared_ptr<const CWallet> pwallet = GetWalletForJSONRPCRequest(request);
+    const std::shared_ptr<CWallet> pwallet = GetWalletForJSONRPCRequest(request);
     if (!pwallet) return UniValue::VNULL;
 
-    const CWallet& wallet{*pwallet};
+    CWallet& wallet{*pwallet};
     // Make sure the results are valid at least up to the most recent block
     // the user could have gotten from another RPC command prior to now
     wallet.BlockUntilSyncedToCurrentChain();
@@ -1643,11 +1652,13 @@ RPCMethod walletprocesspsbt()
     bool sign = request.params[1].isNull() ? true : request.params[1].get_bool();
     bool bip32derivs = request.params[3].isNull() ? true : request.params[3].get_bool();
     bool finalize = request.params[4].isNull() ? true : request.params[4].get_bool();
+    bool keypath_only{request.params[5].isNull() ? DEFAULT_SIGN_TAPROOT_KEYPATH_ONLY : request.params[5].get_bool()};
+
     bool complete = true;
 
     if (sign) EnsureWalletIsUnlocked(*pwallet);
 
-    const auto err{wallet.FillPSBT(psbtx, {.sign = sign, .sighash_type = nHashType, .finalize = finalize, .bip32_derivs = bip32derivs}, complete)};
+    const auto err{wallet.FillPSBT(psbtx, {.sign = sign, .sighash_type = nHashType, .finalize = finalize, .bip32_derivs = bip32derivs, .taproot_keypath_only = keypath_only}, complete)};
     if (err) {
         throw JSONRPCPSBTError(*err);
     }
@@ -1717,6 +1728,7 @@ RPCMethod walletcreatefundedpsbt()
                             {"changePosition", RPCArg::Type::NUM, RPCArg::DefaultHint{"random"}, "The index of the change output"},
                             {"change_type", RPCArg::Type::STR, RPCArg::DefaultHint{"set by -changetype"}, "The output type to use. Only valid if changeAddress is not specified. Options are " + FormatAllOutputTypes() + "."},
                             {"includeWatching", RPCArg::Type::BOOL, RPCArg::Default{false}, "(DEPRECATED) No longer used"},
+                            {"keypath_only", RPCArg::Type::BOOL, RPCArg::Default{DEFAULT_SIGN_TAPROOT_KEYPATH_ONLY}, "Only add Taproot key-path data to the PSBT. Script-path data is not added."},
                             {"lockUnspents", RPCArg::Type::BOOL, RPCArg::Default{false}, "Lock selected unspent outputs"},
                             {"fee_rate", RPCArg::Type::AMOUNT, RPCArg::DefaultHint{"not set, fall back to wallet fee estimation"}, "Specify a fee rate in " + CURRENCY_ATOM + "/vB."},
                             {"feeRate", RPCArg::Type::AMOUNT, RPCArg::DefaultHint{"not set, fall back to wallet fee estimation"}, "Specify a fee rate in " + CURRENCY_UNIT + "/kvB."},
@@ -1797,8 +1809,9 @@ RPCMethod walletcreatefundedpsbt()
 
     // Fill transaction with out data but don't sign
     bool bip32derivs = request.params[4].isNull() ? true : request.params[4].get_bool();
+    bool keypath_only{options.exists("keypath_only") ? options["keypath_only"].get_bool() : DEFAULT_SIGN_TAPROOT_KEYPATH_ONLY};
     bool complete = true;
-    const auto err{wallet.FillPSBT(psbtx, {.sign = false, .bip32_derivs = bip32derivs}, complete)};
+    const auto err{wallet.FillPSBT(psbtx, {.sign = false, .bip32_derivs = bip32derivs, .taproot_keypath_only = keypath_only}, complete)};
     if (err) {
         throw JSONRPCPSBTError(*err);
     }
diff --git a/src/wallet/rpc/wallet.cpp b/src/wallet/rpc/wallet.cpp
index f605c6c1f772..aadbd483489e 100644
--- a/src/wallet/rpc/wallet.cpp
+++ b/src/wallet/rpc/wallet.cpp
@@ -15,6 +15,7 @@
 #include <rpc/util.h>
 #include <univalue.h>
 #include <util/bip32.h>
+#include <util/string.h>
 #include <util/translation.h>
 #include <wallet/context.h>
 #include <wallet/export.h>
@@ -24,6 +25,7 @@
 #include <wallet/walletutil.h>
 
 #include <algorithm>
+#include <memory>
 #include <optional>
 #include <string_view>
 
@@ -65,6 +67,14 @@ static RPCMethod getwalletinfo()
                         }, {.skip_type_check=true}, },
                         {RPCResult::Type::BOOL, "descriptors", "whether this wallet uses descriptors for output script management"},
                         {RPCResult::Type::BOOL, "external_signer", "whether this wallet is configured to use an external signer such as a hardware wallet"},
+                        {RPCResult::Type::ARR, "external_signer_registrations", /*optional=*/true, "Descriptor registrations provided by external signers",
+                        {
+                            {RPCResult::Type::OBJ, "registration", "A descriptor registration for an external signer",
+                            {
+                                {RPCResult::Type::STR, "fingerprint", "the fingerprint of the external signer"},
+                                {RPCResult::Type::STR, "registration", "the opaque registration returned by the external signer"},
+                            },
+                        }}},
                         {RPCResult::Type::BOOL, "blank", "Whether this wallet intentionally does not contain any keys, scripts, or descriptors"},
                         {RPCResult::Type::NUM_TIME, "birthtime", /*optional=*/true, "The start time for blocks scanning. It could be modified by (re)importing any descriptor with an earlier timestamp."},
                         {RPCResult::Type::ARR, "flags", "The flags currently set on the wallet",
@@ -116,6 +126,16 @@ static RPCMethod getwalletinfo()
     }
     obj.pushKV("descriptors", pwallet->IsWalletFlagSet(WALLET_FLAG_DESCRIPTORS));
     obj.pushKV("external_signer", pwallet->IsWalletFlagSet(WALLET_FLAG_EXTERNAL_SIGNER));
+    if (pwallet->IsWalletFlagSet(WALLET_FLAG_EXTERNAL_SIGNER)) {
+        UniValue registrations(UniValue::VARR);
+        for (const wallet::ExternalSignerRegistration& entry : pwallet->GetExternalSignerRegistrations()) {
+            UniValue registration(UniValue::VOBJ);
+            registration.pushKV("fingerprint", entry.fingerprint);
+            registration.pushKV("registration", entry.registration);
+            registrations.push_back(std::move(registration));
+        }
+        obj.pushKV("external_signer_registrations", registrations);
+    }
     obj.pushKV("blank", pwallet->IsWalletFlagSet(WALLET_FLAG_BLANK_WALLET));
     if (int64_t birthtime = pwallet->GetBirthTime(); birthtime != UNKNOWN_TIME) {
         obj.pushKV("birthtime", birthtime);
@@ -219,6 +239,62 @@ static RPCMethod listwallets()
     };
 }
 
+struct WalletLoadResult {
+    std::shared_ptr<CWallet> wallet;
+    std::vector<bilingual_str> warnings;
+};
+
+static WalletLoadResult LoadWalletForRPC(WalletContext& context, const std::string& name, std::optional<bool> load_on_start)
+{
+    DatabaseOptions options;
+    DatabaseStatus status;
+    ReadDatabaseArgs(*context.args, options);
+    options.require_existing = true;
+    bilingual_str error;
+    std::vector<bilingual_str> warnings;
+
+    {
+        LOCK(context.wallets_mutex);
+        if (std::any_of(context.wallets.begin(), context.wallets.end(), [&name](const auto& wallet) { return wallet->GetName() == name; })) {
+            throw JSONRPCError(RPC_WALLET_ALREADY_LOADED, "Wallet \"" + name + "\" is already loaded.");
+        }
+    }
+
+    std::shared_ptr<CWallet> wallet{LoadWallet(context, name, load_on_start, options, status, error, warnings)};
+    HandleWalletError(wallet, status, error);
+    return {std::move(wallet), std::move(warnings)};
+}
+
+static std::vector<bilingual_str> UnloadWallet(WalletContext& context, std::shared_ptr<CWallet> wallet, std::optional<bool> load_on_start, std::unique_ptr<WalletRescanReserver> reserver = nullptr)
+{
+    if (!reserver) {
+        reserver = std::make_unique<WalletRescanReserver>(*wallet);
+        if (!reserver->reserve()) {
+            throw JSONRPCError(RPC_WALLET_ERROR, "Wallet is currently rescanning. Abort existing rescan or wait.");
+        }
+    } else {
+        CHECK_NONFATAL(reserver->isReserved());
+    }
+
+    std::vector<bilingual_str> warnings;
+    if (!RemoveWallet(context, wallet, load_on_start, warnings)) {
+        throw JSONRPCError(RPC_MISC_ERROR, "Requested wallet already unloaded");
+    }
+
+    reserver.reset();
+    WaitForDeleteWallet(std::move(wallet));
+    return warnings;
+}
+
+static std::vector<bilingual_str> ReloadWallet(WalletContext& context, std::shared_ptr<CWallet> wallet, std::unique_ptr<WalletRescanReserver> reserver)
+{
+    const std::string wallet_name{wallet->GetName()};
+    std::vector<bilingual_str> warnings{UnloadWallet(context, std::move(wallet), /*load_on_start=*/std::nullopt, std::move(reserver))};
+    WalletLoadResult load_result{LoadWalletForRPC(context, wallet_name, /*load_on_start=*/std::nullopt)};
+    warnings.insert(warnings.end(), load_result.warnings.begin(), load_result.warnings.end());
+    return warnings;
+}
+
 static RPCMethod loadwallet()
 {
     return RPCMethod{
@@ -256,28 +332,12 @@ static RPCMethod loadwallet()
     WalletContext& context = EnsureWalletContext(request.context);
     const std::string name(request.params[0].get_str());
 
-    DatabaseOptions options;
-    DatabaseStatus status;
-    ReadDatabaseArgs(*context.args, options);
-    options.require_existing = true;
-    bilingual_str error;
-    std::vector<bilingual_str> warnings;
     std::optional<bool> load_on_start = request.params[1].isNull() ? std::nullopt : std::optional<bool>(request.params[1].get_bool());
-
-    {
-        LOCK(context.wallets_mutex);
-        if (std::any_of(context.wallets.begin(), context.wallets.end(), [&name](const auto& wallet) { return wallet->GetName() == name; })) {
-            throw JSONRPCError(RPC_WALLET_ALREADY_LOADED, "Wallet \"" + name + "\" is already loaded.");
-        }
-    }
-
-    std::shared_ptr<CWallet> const wallet = LoadWallet(context, name, load_on_start, options, status, error, warnings);
-
-    HandleWalletError(wallet, status, error);
+    WalletLoadResult load_result{LoadWalletForRPC(context, name, load_on_start)};
 
     UniValue obj(UniValue::VOBJ);
-    obj.pushKV("name", wallet->GetName());
-    PushWarnings(warnings, obj);
+    obj.pushKV("name", load_result.wallet->GetName());
+    PushWarnings(load_result.warnings, obj);
 
     return obj;
 },
@@ -291,9 +351,16 @@ static RPCMethod setwalletflag()
                 if (it.second & MUTABLE_WALLET_FLAGS)
                     flags += (flags == "" ? "" : ", ") + it.first;
 
+            std::string reload_flags;
+            for (auto& it : STRING_TO_WALLET_FLAG)
+                if (it.second & WALLET_FLAGS_REQUIRING_RELOAD)
+                    reload_flags += (reload_flags == "" ? "" : ", ") + it.first;
+
     return RPCMethod{
         "setwalletflag",
-        "Change the state of the given wallet flag for a wallet.\n",
+        "Change the state of the given wallet flag for a wallet.\n"
+        "The following flags trigger a wallet reload: " + reload_flags + ".\n"
+        "Make sure no other RPC clients are using the wallet when changing these flags.\n",
                 {
                     {"flag", RPCArg::Type::STR, RPCArg::Optional::NO, "The name of the flag to change. Current available flags: " + flags},
                     {"value", RPCArg::Type::BOOL, RPCArg::Default{true}, "The new state."},
@@ -312,7 +379,7 @@ static RPCMethod setwalletflag()
                 },
         [](const RPCMethod& self, const JSONRPCRequest& request) -> UniValue
 {
-    std::shared_ptr<CWallet> const pwallet = GetWalletForJSONRPCRequest(request);
+    std::shared_ptr<CWallet> pwallet = GetWalletForJSONRPCRequest(request);
     if (!pwallet) return UniValue::VNULL;
 
     std::string flag_str = request.params[0].get_str();
@@ -328,24 +395,47 @@ static RPCMethod setwalletflag()
         throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("Wallet flag is immutable: %s", flag_str));
     }
 
+#ifndef ENABLE_EXTERNAL_SIGNER
+    if (flag == WALLET_FLAG_EXTERNAL_SIGNER && value) {
+        throw JSONRPCError(RPC_WALLET_ERROR, "Compiled without external signing support (required for external signing)");
+    }
+#endif
+
     UniValue res(UniValue::VOBJ);
 
     if (pwallet->IsWalletFlagSet(flag) == value) {
         throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("Wallet flag is already set to %s: %s", value ? "true" : "false", flag_str));
     }
 
+    std::unique_ptr<WalletRescanReserver> rescan_reserver;
+    if (flag & WALLET_FLAGS_REQUIRING_RELOAD) {
+        rescan_reserver = std::make_unique<WalletRescanReserver>(*pwallet);
+        if (!rescan_reserver->reserve()) {
+            throw JSONRPCError(RPC_WALLET_ERROR, "Wallet is currently rescanning. Abort existing rescan or wait.");
+        }
+    }
+
     res.pushKV("flag_name", flag_str);
     res.pushKV("flag_state", value);
 
+    bool reload_wallet;
     if (value) {
-        pwallet->SetWalletFlag(flag);
+        reload_wallet = pwallet->SetWalletFlag(flag);
     } else {
-        pwallet->UnsetWalletFlag(flag);
+        reload_wallet = pwallet->UnsetWalletFlag(flag);
     }
 
+    std::vector<std::string> warnings;
     if (flag && value && WALLET_FLAG_CAVEATS.contains(flag)) {
-        res.pushKV("warnings", WALLET_FLAG_CAVEATS.at(flag));
+        warnings.push_back(WALLET_FLAG_CAVEATS.at(flag));
+    }
+    if (reload_wallet) {
+        WalletContext& context{EnsureWalletContext(request.context)};
+        for (const bilingual_str& reload_warning : ReloadWallet(context, std::move(pwallet), std::move(rescan_reserver))) {
+            warnings.push_back(reload_warning.original);
+        }
     }
+    if (!warnings.empty()) res.pushKV("warnings", util::Join(warnings, "\n"));
 
     return res;
 },
@@ -359,13 +449,13 @@ static RPCMethod createwallet()
         "Creates and loads a new wallet.\n",
         {
             {"wallet_name", RPCArg::Type::STR, RPCArg::Optional::NO, "The name for the new wallet. If this is a path, the wallet will be created at the path location."},
-            {"disable_private_keys", RPCArg::Type::BOOL, RPCArg::Default{false}, "Disable the possibility of private keys (only watchonlys are possible in this mode)."},
+            {"disable_private_keys", RPCArg::Type::BOOL, RPCArg::DefaultHint{"false unless external_signer is set"}, "Disable the possibility of private keys (only watchonlys are possible in this mode)."},
             {"blank", RPCArg::Type::BOOL, RPCArg::Default{false}, "Create a blank wallet. A blank wallet has no keys."},
             {"passphrase", RPCArg::Type::STR, RPCArg::Optional::OMITTED, "Encrypt the wallet with this passphrase."},
             {"avoid_reuse", RPCArg::Type::BOOL, RPCArg::Default{false}, "Keep track of coin reuse, and treat dirty and clean coins differently with privacy considerations in mind."},
             {"descriptors", RPCArg::Type::BOOL, RPCArg::Default{true}, "If set, must be \"true\""},
             {"load_on_startup", RPCArg::Type::BOOL, RPCArg::Optional::OMITTED, "Save wallet name to persistent settings and load on startup. True to add wallet to startup list, false to remove, null to leave unchanged."},
-            {"external_signer", RPCArg::Type::BOOL, RPCArg::Default{false}, "Use an external signer such as a hardware wallet. Requires -signer to be configured. Wallet creation will fail if keys cannot be fetched. Requires disable_private_keys and descriptors set to true."},
+            {"external_signer", RPCArg::Type::BOOL, RPCArg::Default{false}, "Use an external signer such as a hardware wallet. Requires -signer to be configured. Wallet creation will fail if keys cannot be fetched."},
         },
         RPCResult{
             RPCResult::Type::OBJ, "", "",
@@ -387,9 +477,8 @@ static RPCMethod createwallet()
 {
     WalletContext& context = EnsureWalletContext(request.context);
     uint64_t flags = 0;
-    if (!request.params[1].isNull() && request.params[1].get_bool()) {
-        flags |= WALLET_FLAG_DISABLE_PRIVATE_KEYS;
-    }
+
+    std::optional<bool> disable_private_keys{self.MaybeArg<bool>("disable_private_keys")};
 
     if (!request.params[2].isNull() && request.params[2].get_bool()) {
         flags |= WALLET_FLAG_BLANK_WALLET;
@@ -415,11 +504,21 @@ static RPCMethod createwallet()
     if (!request.params[7].isNull() && request.params[7].get_bool()) {
 #ifdef ENABLE_EXTERNAL_SIGNER
         flags |= WALLET_FLAG_EXTERNAL_SIGNER;
+        if (!disable_private_keys.has_value()) {
+            // In the basic use case all keys will be on the external signer
+            // device and the wallet should be watch-only. Makes this the
+            // default.
+            disable_private_keys = true;
+        }
 #else
         throw JSONRPCError(RPC_WALLET_ERROR, "Compiled without external signing support (required for external signing)");
 #endif
     }
 
+    if (disable_private_keys.value_or(false)) {
+        flags |= WALLET_FLAG_DISABLE_PRIVATE_KEYS;
+    }
+
     DatabaseOptions options;
     DatabaseStatus status;
     ReadDatabaseArgs(*context.args, options);
@@ -469,23 +568,11 @@ static RPCMethod unloadwallet()
         throw JSONRPCError(RPC_WALLET_NOT_FOUND, "Requested wallet does not exist or is not loaded");
     }
 
-    std::vector<bilingual_str> warnings;
-    {
-        WalletRescanReserver reserver(*wallet);
-        if (!reserver.reserve()) {
-            throw JSONRPCError(RPC_WALLET_ERROR, "Wallet is currently rescanning. Abort existing rescan or wait.");
-        }
-
-        // Release the "main" shared pointer and prevent further notifications.
-        // Note that any attempt to load the same wallet would fail until the wallet
-        // is destroyed (see CheckUniqueFileid).
-        std::optional<bool> load_on_start{self.MaybeArg<bool>("load_on_startup")};
-        if (!RemoveWallet(context, wallet, load_on_start, warnings)) {
-            throw JSONRPCError(RPC_MISC_ERROR, "Requested wallet already unloaded");
-        }
-    }
-
-    WaitForDeleteWallet(std::move(wallet));
+    // Release the "main" shared pointer and prevent further notifications.
+    // Note that any attempt to load the same wallet would fail until the wallet
+    // is destroyed (see CheckUniqueFileid).
+    std::optional<bool> load_on_start{self.MaybeArg<bool>("load_on_startup")};
+    std::vector<bilingual_str> warnings{UnloadWallet(context, std::move(wallet), load_on_start)};
 
     UniValue result(UniValue::VOBJ);
     PushWarnings(warnings, result);
@@ -748,7 +835,7 @@ static RPCMethod createwalletdescriptor()
             {"type", RPCArg::Type::STR, RPCArg::Optional::NO, "The address type the descriptor will produce. Options are " + FormatAllOutputTypes() + "."},
             {"options", RPCArg::Type::OBJ_NAMED_PARAMS, RPCArg::Optional::OMITTED, "", {
                 {"internal", RPCArg::Type::BOOL, RPCArg::DefaultHint{"Both external and internal will be generated unless this parameter is specified"}, "Whether to only make one descriptor that is internal (if parameter is true) or external (if parameter is false)"},
-                {"hdkey", RPCArg::Type::STR, RPCArg::DefaultHint{"The HD key used by all other active descriptors"}, "The HD key that the wallet knows the private key of, listed using 'gethdkeys', to use for this descriptor's key"},
+                {"hdkey", RPCArg::Type::STR, RPCArg::DefaultHint{"The HD key used by all other active descriptors, or, if there are none, the HD key of an unused(KEY) descriptor."}, "The HD key that the wallet knows the private key of, listed using 'gethdkeys', to use for this descriptor's key"},
             }},
         },
         RPCResult{
@@ -777,24 +864,29 @@ static RPCMethod createwalletdescriptor()
             UniValue internal_only{options["internal"]};
             UniValue hdkey{options["hdkey"]};
 
-            std::vector<bool> internals;
-            if (internal_only.isNull()) {
-                internals.push_back(false);
-                internals.push_back(true);
-            } else {
-                internals.push_back(internal_only.get_bool());
-            }
-
             LOCK(pwallet->cs_wallet);
             EnsureWalletIsUnlocked(*pwallet);
 
             CExtPubKey xpub;
             if (hdkey.isNull()) {
+                // First consider the HD key from active descriptors
                 HDPubKeyMap active_xpubs = pwallet->GetHDPubKeys(HDKeyFilter::Active);
-                if (active_xpubs.size() != 1) {
+                if (active_xpubs.size() == 1) {
+                    xpub = active_xpubs.begin()->first;
+                } else if (active_xpubs.size() > 1) {
                     throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, "Unable to determine which HD key to use from active descriptors. Please specify with 'hdkey'");
+                } else {
+                    // Look for an unused(KEY) descriptor
+                    HDPubKeyMap wallet_xpubs{pwallet->GetHDPubKeys(HDKeyFilter::UnusedKey)};
+
+                    if (wallet_xpubs.empty()) {
+                        throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, "No HD key found. Please generate one with 'addhdkey' or import an active descriptor.");
+                    } else if (wallet_xpubs.size() > 1) {
+                        throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, "Unable to determine which HD key to use. Please specify with 'hdkey'");
+                    }
+
+                    xpub = wallet_xpubs.begin()->first;
                 }
-                xpub = active_xpubs.begin()->first;
             } else {
                 xpub = DecodeExtPubKey(hdkey.get_str());
                 if (!xpub.pubkey.IsValid()) {
@@ -808,26 +900,19 @@ static RPCMethod createwalletdescriptor()
             }
             CExtKey active_hdkey(xpub, *key);
 
-            std::vector<std::reference_wrapper<DescriptorScriptPubKeyMan>> spkms;
             WalletBatch batch{pwallet->GetDatabase()};
-            for (bool internal : internals) {
-                WalletDescriptor w_desc = GenerateWalletDescriptor(xpub, *output_type, internal);
-                uint256 w_id = DescriptorID(*w_desc.descriptor);
-                if (!pwallet->GetScriptPubKeyMan(w_id)) {
-                    spkms.emplace_back(pwallet->SetupDescriptorScriptPubKeyMan(batch, active_hdkey, *output_type, internal));
-                }
-            }
-            if (spkms.empty()) {
+            // Without the internal option, create both the receive and change
+            // descriptor; with it, only the requested one
+            const bool receive{internal_only.isNull() || !internal_only.get_bool()};
+            const bool change{internal_only.isNull() || internal_only.get_bool()};
+            auto new_descs{pwallet->SetupDescriptorScriptPubKeyManPair(batch, active_hdkey, *output_type, receive, change)};
+            if (new_descs.empty()) {
                 throw JSONRPCError(RPC_WALLET_ERROR, "Descriptor already exists");
             }
 
-            // Fetch each descspkm from the wallet in order to get the descriptor strings
             UniValue descs{UniValue::VARR};
-            for (const auto& spkm : spkms) {
-                std::string desc_str;
-                bool ok = spkm.get().GetDescriptorString(desc_str, false);
-                CHECK_NONFATAL(ok);
-                descs.push_back(desc_str);
+            for (const std::string& desc : new_descs) {
+                descs.push_back(desc);
             }
             UniValue out{UniValue::VOBJ};
             out.pushKV("descs", std::move(descs));
@@ -858,6 +943,7 @@ RPCMethod addhdkey()
             std::shared_ptr<CWallet> const wallet = GetWalletForJSONRPCRequest(request);
             if (!wallet) return UniValue::VNULL;
 
+
             if (wallet->IsWalletFlagSet(WALLET_FLAG_DISABLE_PRIVATE_KEYS)) {
                 throw JSONRPCError(RPC_WALLET_ERROR, "addhdkey is not available for wallets without private keys");
             }
@@ -882,6 +968,10 @@ RPCMethod addhdkey()
             }
 
             LOCK(wallet->cs_wallet);
+            if (wallet->GetKey(hdkey.Neuter().pubkey.GetID())) {
+                throw JSONRPCError(RPC_WALLET_ERROR, "HD key already exists");
+            }
+
             std::string desc_str = "unused(" + EncodeExtKey(hdkey) + ")";
             FlatSigningProvider keys;
             std::string error;
@@ -1073,6 +1163,57 @@ RPCMethod derivehdkey()
     };
 }
 
+#ifdef ENABLE_EXTERNAL_SIGNER
+RPCMethod registerdescriptor()
+{
+    return RPCMethod{
+        "registerdescriptor",
+        "Register the wallet's multipath descriptor on all connected external signers and store the results.",
+        {
+            {"name", RPCArg::Type::STR, RPCArg::DefaultHint{"wallet name"}, "Descriptor name to display on the device"},
+        },
+        RPCResult{
+            RPCResult::Type::OBJ,"","",
+            {
+                {RPCResult::Type::ARR, "registrations", "Registrations stored in the wallet", {
+                    {RPCResult::Type::OBJ, "", "", {
+                        {RPCResult::Type::STR, "fingerprint", "The fingerprint of the external signer"},
+                        {RPCResult::Type::STR, "registration", "The opaque registration returned by the external signer"},
+                    }},
+                }},
+            }
+        },
+        RPCExamples{HelpExampleCli("registerdescriptor", "\"MuSig wallet\"")},
+        [&](const RPCMethod& self, const JSONRPCRequest& request) -> UniValue
+        {
+            std::shared_ptr<CWallet> const wallet = GetWalletForJSONRPCRequest(request);
+            if (!wallet) return UniValue::VNULL;
+            CWallet* const pwallet = wallet.get();
+
+            LOCK(pwallet->cs_wallet);
+
+            std::optional<std::string> descriptor_name;
+            if (!request.params[0].isNull()) {
+                descriptor_name = request.params[0].get_str();
+            }
+            util::Result<std::vector<ExternalSignerRegistration>> res = pwallet->RegisterDescriptor(descriptor_name);
+            if (!res) throw JSONRPCError(RPC_MISC_ERROR, util::ErrorString(res).original);
+
+            UniValue result(UniValue::VOBJ);
+            UniValue registrations(UniValue::VARR);
+            for (const auto& entry : *res) {
+                UniValue registration(UniValue::VOBJ);
+                registration.pushKV("fingerprint", entry.fingerprint);
+                registration.pushKV("registration", entry.registration);
+                registrations.push_back(std::move(registration));
+            }
+            result.pushKV("registrations", registrations);
+            return result;
+        }
+    };
+}
+#endif // ENABLE_EXTERNAL_SIGNER
+
 // addresses
 RPCMethod getaddressinfo();
 RPCMethod getnewaddress();
@@ -1192,6 +1333,7 @@ std::span<const CRPCCommand> GetWalletRPCCommands()
         {"wallet", &unloadwallet},
         {"wallet", &walletcreatefundedpsbt},
 #ifdef ENABLE_EXTERNAL_SIGNER
+        {"wallet", &registerdescriptor},
         {"wallet", &walletdisplayaddress},
 #endif // ENABLE_EXTERNAL_SIGNER
         {"wallet", &walletlock},
diff --git a/src/wallet/scriptpubkeyman.cpp b/src/wallet/scriptpubkeyman.cpp
index 30742753602e..75dfa73d3266 100644
--- a/src/wallet/scriptpubkeyman.cpp
+++ b/src/wallet/scriptpubkeyman.cpp
@@ -864,10 +864,10 @@ std::unique_ptr<DescriptorScriptPubKeyMan> DescriptorScriptPubKeyMan::LoadFromSt
     return std::unique_ptr<DescriptorScriptPubKeyMan>(new DescriptorScriptPubKeyMan(storage, descriptor, keypool_size, keys, ckeys));
 }
 
-std::unique_ptr<DescriptorScriptPubKeyMan> DescriptorScriptPubKeyMan::GenerateNewSingleSig(WalletStorage& storage, WalletBatch& batch, int64_t keypool_size, const CExtKey& master_key, OutputType addr_type, bool internal)
+std::unique_ptr<DescriptorScriptPubKeyMan> DescriptorScriptPubKeyMan::GenerateNewSingleSig(WalletStorage& storage, WalletBatch& batch, int64_t keypool_size, const CExtKey& master_key, WalletDescriptor w_desc)
 {
     auto spkm = std::unique_ptr<DescriptorScriptPubKeyMan>(new DescriptorScriptPubKeyMan(storage, keypool_size));
-    spkm->SetupDescriptorGeneration(batch, master_key, addr_type, internal);
+    spkm->SetupDescriptorGeneration(batch, master_key, std::move(w_desc));
     return spkm;
 }
 
@@ -1214,13 +1214,13 @@ bool DescriptorScriptPubKeyMan::AddDescriptorKeyWithDB(WalletBatch& batch, const
     }
 }
 
-void DescriptorScriptPubKeyMan::SetupDescriptorGeneration(WalletBatch& batch, const CExtKey& master_key, OutputType addr_type, bool internal)
+void DescriptorScriptPubKeyMan::SetupDescriptorGeneration(WalletBatch& batch, const CExtKey& master_key, WalletDescriptor w_desc)
 {
     LOCK(cs_desc_man);
     Assert(m_storage.IsWalletFlagSet(WALLET_FLAG_DESCRIPTORS));
     Assert(!m_wallet_descriptor.descriptor);
 
-    m_wallet_descriptor = GenerateWalletDescriptor(master_key.Neuter(), addr_type, internal);
+    m_wallet_descriptor = std::move(w_desc);
 
     // Store the master private key, and descriptor
     if (!AddDescriptorKeyWithDB(batch, master_key.key, master_key.key.GetPubKey())) {
@@ -1582,6 +1582,14 @@ int32_t DescriptorScriptPubKeyMan::GetEndRange() const
     return m_max_cached_index + 1;
 }
 
+std::optional<int32_t> DescriptorScriptPubKeyMan::GetScriptPubKeyIndex(const CScript& script) const
+{
+    LOCK(cs_desc_man);
+    auto it = m_map_script_pub_keys.find(script);
+    if (it == m_map_script_pub_keys.end()) return std::nullopt;
+    return it->second;
+}
+
 bool DescriptorScriptPubKeyMan::GetDescriptorString(std::string& out, const bool priv) const
 {
     LOCK(cs_desc_man);
diff --git a/src/wallet/scriptpubkeyman.h b/src/wallet/scriptpubkeyman.h
index 5c977b12d404..d90d704c2851 100644
--- a/src/wallet/scriptpubkeyman.h
+++ b/src/wallet/scriptpubkeyman.h
@@ -301,13 +301,6 @@ class DescriptorScriptPubKeyMan : public ScriptPubKeyMan
      */
     mutable std::map<uint256, MuSig2SecNonce> m_musig2_secnonces;
 
-    //! Create a new DescriptorScriptPubKeyMan from an existing descriptor (i.e. from an import)
-    DescriptorScriptPubKeyMan(WalletStorage& storage, WalletDescriptor& descriptor, int64_t keypool_size)
-        : ScriptPubKeyMan(storage),
-        m_keypool_size(keypool_size),
-        m_wallet_descriptor(descriptor)
-    {}
-
     bool AddDescriptorKeyWithDB(WalletBatch& batch, const CKey& key, const CPubKey &pubkey) EXCLUSIVE_LOCKS_REQUIRED(cs_desc_man);
 
     KeyMap GetKeys() const EXCLUSIVE_LOCKS_REQUIRED(cs_desc_man);
@@ -324,10 +317,17 @@ class DescriptorScriptPubKeyMan : public ScriptPubKeyMan
     void AddDescriptorKey(const CKey& key, const CPubKey &pubkey);
     void UpdateWithSigningProvider(WalletBatch& batch, const FlatSigningProvider& signing_provider) EXCLUSIVE_LOCKS_REQUIRED(cs_desc_man);
 
-    //! Setup descriptors based on the given CExtKey
-    void SetupDescriptorGeneration(WalletBatch& batch, const CExtKey& master_key, OutputType addr_type, bool internal);
+    //! Setup with the given descriptor, storing the given master key
+    void SetupDescriptorGeneration(WalletBatch& batch, const CExtKey& master_key, WalletDescriptor w_desc);
 
 protected:
+    //! Create a new DescriptorScriptPubKeyMan from an existing descriptor (i.e. from an import)
+    DescriptorScriptPubKeyMan(WalletStorage& storage, WalletDescriptor& descriptor, int64_t keypool_size)
+        : ScriptPubKeyMan(storage),
+        m_keypool_size(keypool_size),
+        m_wallet_descriptor(descriptor)
+    {}
+
     //! Create a DescriptorScriptPubKeyMan from existing data (i.e. during loading)
     DescriptorScriptPubKeyMan(WalletStorage& storage, WalletDescriptor& descriptor, int64_t keypool_size, const KeyMap& keys, const CryptedKeyMap& ckeys);
 
@@ -348,7 +348,7 @@ class DescriptorScriptPubKeyMan : public ScriptPubKeyMan
     static std::unique_ptr<DescriptorScriptPubKeyMan> LoadFromStorage(WalletStorage& storage, WalletDescriptor& descriptor, int64_t keypool_size, const KeyMap& keys, const CryptedKeyMap& ckeys);
     static std::unique_ptr<DescriptorScriptPubKeyMan> CreateFromImport(WalletStorage& storage, WalletDescriptor& descriptor, int64_t keypool_size, const FlatSigningProvider& provider);
     static std::unique_ptr<DescriptorScriptPubKeyMan> CreateFromMigration(WalletStorage& storage, WalletBatch& batch, WalletDescriptor& descriptor, int64_t keypool_size, const FlatSigningProvider& provider);
-    static std::unique_ptr<DescriptorScriptPubKeyMan> GenerateNewSingleSig(WalletStorage& storage, WalletBatch& batch, int64_t keypool_size, const CExtKey& master_key, OutputType addr_type, bool internal);
+    static std::unique_ptr<DescriptorScriptPubKeyMan> GenerateNewSingleSig(WalletStorage& storage, WalletBatch& batch, int64_t keypool_size, const CExtKey& master_key, WalletDescriptor w_desc);
 
     mutable RecursiveMutex cs_desc_man;
 
@@ -408,6 +408,9 @@ class DescriptorScriptPubKeyMan : public ScriptPubKeyMan
     std::unordered_set<CScript, SaltedSipHasher> GetScriptPubKeys(int32_t minimum_index) const;
     int32_t GetEndRange() const;
 
+    //! Look up the descriptor range index that produced `script`, if any.
+    std::optional<int32_t> GetScriptPubKeyIndex(const CScript& script) const;
+
     [[nodiscard]] bool GetDescriptorString(std::string& out, bool priv) const;
 
     void UpgradeDescriptorCache();
diff --git a/src/wallet/test/walletload_tests.cpp b/src/wallet/test/walletload_tests.cpp
index 66a34deed72c..c971c1a54bb6 100644
--- a/src/wallet/test/walletload_tests.cpp
+++ b/src/wallet/test/walletload_tests.cpp
@@ -92,5 +92,66 @@ BOOST_FIXTURE_TEST_CASE(wallet_load_descriptors, TestingSetup)
     }
 }
 
+BOOST_FIXTURE_TEST_CASE(wallet_load_multipath_descriptors, TestingSetup)
+{
+    bilingual_str error;
+    std::vector<bilingual_str> warnings;
+    std::unique_ptr<WalletDatabase> database = CreateMockableWalletDatabase();
+
+    const std::string multipath_desc{"wpkh(xpub661MyMwAqRbcFW31YEwpkMuc5THy2PSt5bDMsktWQcFF8syAmRUapSCGu8ED9W6oDMSgv6Zz8idoc4a6mr8BDzTJY47LJhkJ8UB7WEGuduB/<0;1;2>/*)"};
+    FlatSigningProvider keys;
+    std::string parse_error;
+    auto parsed_descs = Parse(multipath_desc, keys, parse_error, /*require_checksum=*/false);
+    BOOST_REQUIRE_EQUAL(parsed_descs.size(), 3);
+    std::vector<WalletDescriptor> wallet_descriptors;
+    std::vector<uint256> desc_ids;
+    for (auto& parsed_desc : parsed_descs) {
+        wallet_descriptors.emplace_back(std::move(parsed_desc), /*creation_time=*/0, /*range_start=*/0, /*range_end=*/0, /*next_index=*/0);
+        desc_ids.push_back(wallet_descriptors.back().id);
+    }
+
+    // A record referencing only known descriptors is loaded
+    const MultipathDescriptorRecord record(multipath_desc, desc_ids);
+    {
+        WalletBatch batch(*database);
+        for (size_t i{0}; i < record.desc_ids.size(); ++i) {
+            BOOST_CHECK(batch.WriteDescriptor(desc_ids[i], wallet_descriptors[i]));
+        }
+        BOOST_CHECK(batch.WriteMultipathDescriptor(record));
+    }
+    {
+        const std::shared_ptr<CWallet> wallet(new CWallet(m_node.chain.get(), "", std::move(database)));
+        BOOST_CHECK_EQUAL(wallet->PopulateWalletFromDB(error, warnings), DBErrors::LOAD_OK);
+        LOCK(wallet->cs_wallet);
+        const auto& multipath_descs = wallet->GetMultipathDescriptors();
+        BOOST_CHECK_EQUAL(multipath_descs.size(), 1);
+        BOOST_REQUIRE(multipath_descs.count(record.GetID()));
+        const auto& loaded_record{multipath_descs.at(record.GetID())};
+        BOOST_CHECK_EQUAL(loaded_record.descriptor, record.descriptor);
+        BOOST_CHECK_EQUAL_COLLECTIONS(loaded_record.desc_ids.begin(), loaded_record.desc_ids.end(), record.desc_ids.begin(), record.desc_ids.end());
+    }
+
+    // Wallet descriptors cannot be deleted, so a record referencing an
+    // unknown descriptor means the database is corrupted
+    database = CreateMockableWalletDatabase();
+    {
+        WalletBatch batch(*database);
+        for (size_t i{0}; i < record.desc_ids.size(); ++i) {
+            BOOST_CHECK(batch.WriteDescriptor(desc_ids[i], wallet_descriptors[i]));
+        }
+        BOOST_CHECK(batch.WriteMultipathDescriptor(MultipathDescriptorRecord("wpkh(bad/<0;1>/*)", {desc_ids[0], uint256::ONE})));
+    }
+    {
+        bool found = false;
+        DebugLogHelper log_helper("references unknown descriptor id", [&](const std::string* s) {
+            found = true;
+            return false;
+        });
+        const std::shared_ptr<CWallet> wallet(new CWallet(m_node.chain.get(), "", std::move(database)));
+        BOOST_CHECK_EQUAL(wallet->PopulateWalletFromDB(error, warnings), DBErrors::CORRUPT);
+        BOOST_CHECK(found); // The error must be logged
+    }
+}
+
 BOOST_AUTO_TEST_SUITE_END()
 } // namespace wallet
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index 310e9ea07a1b..48cb40295204 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -37,6 +37,7 @@
 #include <pubkey.h>
 #include <random.h>
 #include <script/descriptor.h>
+#include <script/parsing.h>
 #include <script/interpreter.h>
 #include <script/script.h>
 #include <script/sign.h>
@@ -402,13 +403,6 @@ std::shared_ptr<CWallet> CreateWallet(WalletContext& context, const std::string&
     options.require_format = DatabaseFormat::SQLITE;
 
 
-    // Private keys must be disabled for an external signer wallet
-    if ((wallet_creation_flags & WALLET_FLAG_EXTERNAL_SIGNER) && !(wallet_creation_flags & WALLET_FLAG_DISABLE_PRIVATE_KEYS)) {
-        error = Untranslated("Private keys must be disabled when using an external signer");
-        status = DatabaseStatus::FAILED_CREATE;
-        return nullptr;
-    }
-
     // Do not allow a passphrase when private keys are disabled
     if (born_encrypted && (wallet_creation_flags & WALLET_FLAG_DISABLE_PRIVATE_KEYS)) {
         error = Untranslated("Passphrase provided but private keys are disabled. A passphrase is only used to encrypt private keys, so cannot be used for wallets with private keys disabled.");
@@ -1744,32 +1738,36 @@ bool CWallet::CanGetAddresses(bool internal) const
     return false;
 }
 
-void CWallet::SetWalletFlag(uint64_t flags)
+bool CWallet::SetWalletFlag(uint64_t flags)
 {
     WalletBatch batch(GetDatabase());
     return SetWalletFlagWithDB(batch, flags);
 }
 
-void CWallet::SetWalletFlagWithDB(WalletBatch& batch, uint64_t flags)
+bool CWallet::SetWalletFlagWithDB(WalletBatch& batch, uint64_t flags)
 {
     LOCK(cs_wallet);
+    const uint64_t flags_before{m_wallet_flags};
     m_wallet_flags |= flags;
     if (!batch.WriteWalletFlags(m_wallet_flags))
         throw std::runtime_error(std::string(__func__) + ": writing wallet flags failed");
+    return ((flags_before ^ m_wallet_flags) & WALLET_FLAGS_REQUIRING_RELOAD) != 0;
 }
 
-void CWallet::UnsetWalletFlag(uint64_t flag)
+bool CWallet::UnsetWalletFlag(uint64_t flag)
 {
     WalletBatch batch(GetDatabase());
-    UnsetWalletFlagWithDB(batch, flag);
+    return UnsetWalletFlagWithDB(batch, flag);
 }
 
-void CWallet::UnsetWalletFlagWithDB(WalletBatch& batch, uint64_t flag)
+bool CWallet::UnsetWalletFlagWithDB(WalletBatch& batch, uint64_t flag)
 {
     LOCK(cs_wallet);
+    const uint64_t flags_before{m_wallet_flags};
     m_wallet_flags &= ~flag;
     if (!batch.WriteWalletFlags(m_wallet_flags))
         throw std::runtime_error(std::string(__func__) + ": writing wallet flags failed");
+    return ((flags_before ^ m_wallet_flags) & WALLET_FLAGS_REQUIRING_RELOAD) != 0;
 }
 
 void CWallet::UnsetBlankWalletFlag(WalletBatch& batch)
@@ -1815,6 +1813,17 @@ uint64_t CWallet::GetWalletFlags() const
     return m_wallet_flags;
 }
 
+void CWallet::LoadExternalSignerRegistration(const std::string& fingerprint, const std::string& registration)
+{
+    for (auto& entry : m_external_signer_registrations) {
+        if (entry.fingerprint == fingerprint) {
+            entry.registration = registration;
+            return;
+        }
+    }
+    m_external_signer_registrations.emplace_back(ExternalSignerRegistration{fingerprint, registration});
+}
+
 void CWallet::MaybeUpdateBirthTime(int64_t time)
 {
     int64_t birthtime = m_birth_time.load();
@@ -2202,7 +2211,7 @@ bool CWallet::SignTransaction(CMutableTransaction& tx, const std::map<COutPoint,
     return false;
 }
 
-std::optional<PSBTError> CWallet::FillPSBT(PartiallySignedTransaction& psbtx, const common::PSBTFillOptions& options, bool& complete, size_t* n_signed) const
+std::optional<PSBTError> CWallet::FillPSBT(PartiallySignedTransaction& psbtx, const common::PSBTFillOptions& options, bool& complete, size_t* n_signed)
 {
     if (n_signed) {
         *n_signed = 0;
@@ -2233,25 +2242,171 @@ std::optional<PSBTError> CWallet::FillPSBT(PartiallySignedTransaction& psbtx, co
     }
     const PrecomputedTransactionData& txdata = *txdata_res;
 
-    // Fill in information from ScriptPubKeyMans
-    for (ScriptPubKeyMan* spk_man : GetAllScriptPubKeyMans()) {
-        int n_signed_this_spkm = 0;
-        const auto error{spk_man->FillPSBT(psbtx, txdata, options, &n_signed_this_spkm)};
-        if (error) {
-            return error;
+    // One signing pass: dispatch any registered descriptor first
+    // (covers all of this wallet's related descriptors at once), then
+    // every remaining ScriptPubKeyMan. Returns either a PSBTError or
+    // `complete` set to whether every input is now signed.
+    auto fill_pass = [&](PartiallySignedTransaction& target) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet) -> std::optional<PSBTError> {
+        // If a descriptor is registered with the external signer, dispatch
+        // the registered signing path once. Mirrors the registration
+        // detection block in CWallet::DisplayAddress, but
+        // hoisted out of the per-SPKM loop so we don't shell out to
+        // the device once per SPKM.
+        bool registration_dispatched = false;
+        if (options.sign && !m_external_signer_registrations.empty()) {
+            ExternalSignerScriptPubKeyMan* registration_spk_man = nullptr;
+            for (ScriptPubKeyMan* spk_man : GetAllScriptPubKeyMans()) {
+                auto* candidate = dynamic_cast<ExternalSignerScriptPubKeyMan*>(spk_man);
+                if (candidate && IsCandidateForDescriptorRegistration(*candidate)) {
+                    registration_spk_man = candidate;
+                    break;
+                }
+            }
+            if (registration_spk_man) {
+                // Fan out to every connected external signer that has a
+                // descriptor registered with this wallet (e.g. a
+                // 3-of-3 MuSig2 split across two HW wallets and a hot
+                // cosigner). FillPSBTRegistered itself absorbs the local
+                // descriptor signer's contribution on each call, so we
+                // ask the first matching signer to do the local pass +
+                // its device round, then ask each subsequent signer to
+                // do only its device round.
+                auto signers{ExternalSignerScriptPubKeyMan::GetExternalSigners()};
+                if (signers) {
+                    bool any_dispatched{false};
+                    for (auto& signer : *signers) {
+                        const ExternalSignerRegistration* matching_registration{nullptr};
+                        for (const auto& entry : m_external_signer_registrations) {
+                            if (entry.fingerprint == signer.m_fingerprint) {
+                                matching_registration = &entry;
+                                break;
+                            }
+                        }
+                        if (!matching_registration) continue;
+                        int n_signed_registered = 0;
+                        auto registration_err = registration_spk_man->FillPSBTRegistered(target, txdata,
+                                                                                          options,
+                                                                                          &n_signed_registered,
+                                                                                          signer,
+                                                                                          matching_registration->registration);
+                        if (registration_err) {
+                            return registration_err;
+                        }
+                        if (n_signed) {
+                            (*n_signed) += n_signed_registered;
+                        }
+                        any_dispatched = true;
+                    }
+                    registration_dispatched = any_dispatched;
+                }
+            }
         }
 
-        if (n_signed) {
-            (*n_signed) += n_signed_this_spkm;
+        // Fill in information from ScriptPubKeyMans
+        for (ScriptPubKeyMan* spk_man : GetAllScriptPubKeyMans()) {
+            int n_signed_this_spkm = 0;
+            // If we already dispatched the registered descriptor above, skip
+            // every ExternalSignerScriptPubKeyMan in this loop: the
+            // registration call covered the registered descriptor's SPKMs, and
+            // the device would reject anything else.
+            if (options.sign && registration_dispatched && dynamic_cast<ExternalSignerScriptPubKeyMan*>(spk_man) != nullptr) {
+                continue;
+            }
+
+            const auto error{spk_man->FillPSBT(target, txdata, options, &n_signed_this_spkm)};
+            if (error) {
+                return error;
+            }
+
+            if (n_signed) {
+                (*n_signed) += n_signed_this_spkm;
+            }
         }
-    }
 
-    RemoveUnnecessaryTransactions(psbtx);
+        RemoveUnnecessaryTransactions(target);
 
-    // Complete if every input is now signed
-    complete = true;
-    for (size_t i = 0; i < psbtx.inputs.size(); ++i) {
-        complete &= PSBTInputSignedAndVerified(psbtx, i, &txdata);
+        // Complete if every input is now signed
+        complete = true;
+        for (size_t i = 0; i < target.inputs.size(); ++i) {
+            complete &= PSBTInputSignedAndVerified(target, i, &txdata);
+        }
+        return {};
+    };
+
+    if (auto err = fill_pass(psbtx)) {
+        return err;
+    }
+
+    // Multi-round signing flows (e.g. MuSig2) need a second sign pass:
+    // the first only exchanged pub nonces, so the PSBT isn't complete
+    // yet. Only retry when round 2 is actually feasible -- i.e. every
+    // input that participates in a MuSig2 session has a complete set
+    // of pub nonces from every expected participant. If some cosigner
+    // is offline (no nonces yet), there's nothing the device can do
+    // in round 2 and we shouldn't waste a confirmation prompt; just
+    // hand back the round-1 PSBT for out-of-band exchange. Likewise
+    // for non-MuSig2 flows we skip the retry: there's no known one-
+    // pass-incomplete case there.
+    //
+    // We can't pair PSBT_IN_MUSIG2_PARTICIPANT_PUBKEYS entries to
+    // PSBT_IN_MUSIG2_PUB_NONCE entries by aggregate pubkey: the former
+    // stores the pre-tweak aggregate while the latter stores the
+    // post-tweak one (after BIP32 derivations and the BIP86 taproot
+    // tweak). Use a structural check instead: per input, require at
+    // least one pubnonces group per participants entry, and each
+    // group to have at least as many nonces as the largest
+    // participants list.
+    auto musig2_round2_ready = [](const PartiallySignedTransaction& p) {
+        bool any_musig2{false};
+        for (const auto& input : p.inputs) {
+            if (input.m_musig2_participants.empty()) continue;
+            any_musig2 = true;
+            if (input.m_musig2_pubnonces.size() < input.m_musig2_participants.size()) return false;
+            size_t max_participants{0};
+            for (const auto& [_, parts] : input.m_musig2_participants) {
+                max_participants = std::max(max_participants, parts.size());
+            }
+            for (const auto& [_, nonces] : input.m_musig2_pubnonces) {
+                if (nonces.size() < max_participants) return false;
+            }
+        }
+        return any_musig2;
+    };
+    if (options.sign && !complete && musig2_round2_ready(psbtx)) {
+        PartiallySignedTransaction probe = psbtx;
+        bool probe_complete = complete;
+        std::optional<PSBTError> probe_err;
+        try {
+            probe_err = fill_pass(probe);
+        } catch (...) {
+            // Swallow: any error in the optional second round just
+            // means we hand back the round-1 PSBT.
+        }
+        // fill_pass writes through to outer `complete`. When the
+        // round-2 attempt errored, preserve the round-1 PSBT and the
+        // round-1 `complete` flag. Otherwise keep the probe even if
+        // the PSBT isn't yet complete: any partial-signature or
+        // pubnonce contribution that round 2 produced is real signing
+        // work, and discarding it would orphan the corresponding
+        // single-use MuSig2 secnonce that fill_pass already consumed
+        // out of m_musig2_secnonces.
+        //
+        // BIP327 safety: this is not a secnonce-reuse risk. The
+        // wallet's m_musig2_secnonces map is held by reference inside
+        // the FlatSigningProvider, so DeleteMuSig2Session in
+        // CreateMuSig2PartialSig mutates the wallet state regardless
+        // of whether we keep or discard the probe PSBT. The deletion
+        // happens exactly once per (script_pubkey, part_pubkey,
+        // sighash) session and SetMuSig2SecNonce asserts on duplicate
+        // inserts, so the wallet cannot regenerate a secnonce for a
+        // session it has already signed. Preserving the probe's psig
+        // just lets a subsequent FillPSBT call observe the work
+        // instead of silently losing it.
+        if (!probe_err) {
+            psbtx = std::move(probe);
+        } else {
+            complete = probe_complete;
+        }
     }
 
     return {};
@@ -2733,17 +2888,157 @@ util::Result<void> CWallet::DisplayAddress(const CTxDestination& dest)
 {
     CScript scriptPubKey = GetScriptForDestination(dest);
     for (const auto& spk_man : GetScriptPubKeyMans(scriptPubKey)) {
-        auto signer_spk_man = dynamic_cast<ExternalSignerScriptPubKeyMan *>(spk_man);
+        auto signer_spk_man = dynamic_cast<ExternalSignerScriptPubKeyMan*>(spk_man);
         if (signer_spk_man == nullptr) {
             continue;
         }
-        auto signer{ExternalSignerScriptPubKeyMan::GetExternalSigner()};
-        if (!signer) throw std::runtime_error(util::ErrorString(signer).original);
-        return signer_spk_man->DisplayAddress(dest, *signer);
+        auto signers{ExternalSignerScriptPubKeyMan::GetExternalSigners()};
+        if (!signers) throw std::runtime_error(util::ErrorString(signers).original);
+
+        // If the matched SPKM is part of a registered descriptor, ask the
+        // first connected device whose fingerprint matches a registration
+        // to display the address using that registration. For multi-signer
+        // wallets (e.g. 3-of-3 MuSig2) any one of the cosigner devices is
+        // sufficient -- they all encode the same address from the same
+        // descriptor, and the user only needs one device to confirm visually.
+        if (IsCandidateForDescriptorRegistration(*signer_spk_man)) {
+            ExternalSigner* matching_signer{nullptr};
+            const ExternalSignerRegistration* matching_registration{nullptr};
+            for (auto& signer : *signers) {
+                for (const auto& entry : m_external_signer_registrations) {
+                    if (entry.fingerprint == signer.m_fingerprint) {
+                        matching_signer = &signer;
+                        matching_registration = &entry;
+                        break;
+                    }
+                }
+                if (matching_signer) break;
+            }
+            if (matching_signer) {
+                const auto index{signer_spk_man->GetScriptPubKeyIndex(scriptPubKey)};
+                if (!index) return util::Error{_("Could not locate address in script pub key map")};
+                const std::optional<bool> internal{IsInternalScriptPubKeyMan(signer_spk_man)};
+                if (!internal) return util::Error{_("Could not determine receive/change chain for address")};
+                return signer_spk_man->DisplayAddressRegistered(dest, *matching_signer,
+                                                                matching_registration->registration,
+                                                                *internal,
+                                                                static_cast<uint32_t>(*index));
+            }
+        }
+
+        // Non-registered single-sig fallback: only meaningful when one signer
+        // is connected. Multi-signer setups always go through the registered
+        // path above.
+        if (signers->size() != 1) {
+            return util::Error{_("Multiple external signers connected; address display requires a registered descriptor")};
+        }
+        return signer_spk_man->DisplayAddress(dest, signers->front());
     }
     return util::Error{_("There is no ScriptPubKeyManager for this address")};
 }
 
+bool CWallet::IsCandidateForDescriptorRegistration(DescriptorScriptPubKeyMan& spkm)
+{
+    std::string desc;
+    if (!Assume(spkm.GetDescriptorString(desc, /*priv=*/false))) return false;
+
+    std::span<const char> sp{desc};
+
+    if (!(script::Const("tr(", sp, /*skip=*/true) || script::Const("wsh(", sp, /*skip=*/true))) return false;
+    // Must be MuSig2, have a leaf script or segwit multisig
+    if (desc.find(',') == std::string::npos) return false;
+
+    return true;
+}
+
+util::Result<std::string> CWallet::GetRegistrationDescriptor(const std::optional<std::pair<DescriptorScriptPubKeyMan&, DescriptorScriptPubKeyMan&>>& spk_pair)
+{
+    DescriptorScriptPubKeyMan* receive{nullptr};
+    DescriptorScriptPubKeyMan* change{nullptr};
+
+    if (spk_pair) {
+        if (!IsCandidateForDescriptorRegistration(spk_pair->first) || !IsCandidateForDescriptorRegistration(spk_pair->second)) {
+            return util::Error{_("Provided descriptors are not suitable for registration")};
+        }
+        receive = &spk_pair->first;
+        change = &spk_pair->second;
+    } else {
+        for (bool internal : {false, true}) {
+            // TODO: support P2SH.
+            for (const OutputType type : {OutputType::BECH32M, OutputType::BECH32}) {
+                // Only look for a single candidate
+                if (!internal && receive) continue;
+                if (internal && change) continue;
+
+                auto spk_man = GetScriptPubKeyMan(type, internal);
+                if (!spk_man) continue;
+                auto desc_spk_man = dynamic_cast<DescriptorScriptPubKeyMan*>(spk_man);
+                if (!desc_spk_man) continue;
+
+                if (!IsCandidateForDescriptorRegistration(*desc_spk_man)) continue;
+
+                if (internal) {
+                    change = desc_spk_man;
+                } else {
+                    receive = desc_spk_man;
+                }
+            }
+        }
+    }
+
+    if (!receive || !change) {
+        return util::Error{_("No suitable receive and change descriptors found for registration")};
+    }
+
+    for (const auto& [_, multipath_desc] : m_multipath_descriptors) {
+        if (multipath_desc.desc_ids.size() == 2 &&
+            multipath_desc.desc_ids[0] == receive->GetID() &&
+            multipath_desc.desc_ids[1] == change->GetID()) {
+            return multipath_desc.descriptor;
+        }
+    }
+
+    return util::Error{_("No stored multipath descriptor found for registration")};
+}
+
+util::Result<std::vector<ExternalSignerRegistration>> CWallet::RegisterDescriptor(const std::optional<std::string>& name)
+{
+    const std::string descriptor_name{name.value_or(m_name)};
+
+    // A wallet with multiple complex descriptor pairs could have multiple
+    // registrations, but selecting a specific pair is currently unsupported.
+    const auto descriptor{GetRegistrationDescriptor(/*spk_pair=*/std::nullopt)};
+    if (!descriptor) return util::Error{util::ErrorString(descriptor)};
+
+    for (const auto& spk_man : GetActiveScriptPubKeyMans()) {
+        auto signer_spk_man = dynamic_cast<ExternalSignerScriptPubKeyMan *>(spk_man);
+        if (signer_spk_man == nullptr) {
+            continue;
+        }
+        auto signers{ExternalSignerScriptPubKeyMan::GetExternalSigners()};
+        if (!signers) return util::Error{util::ErrorString(signers)};
+
+        // Fan out registration to every connected signer. For multi-signer
+        // wallets (e.g. MuSig2 split across two HW devices) each device
+        // prompts independently and returns its own opaque registration.
+        std::vector<ExternalSignerRegistration> registrations;
+        for (auto& signer : *signers) {
+            util::Result<std::string> res{signer_spk_man->RegisterDescriptor(signer, descriptor_name, *descriptor)};
+            if (!res) return util::Error{util::ErrorString(res)};
+
+            WalletBatch batch(GetDatabase());
+            if (!batch.WriteExternalSignerRegistration(signer.m_fingerprint, *res)) {
+                return util::Error{_("Failed to store external signer descriptor registration in wallet database.")};
+            }
+            LoadExternalSignerRegistration(signer.m_fingerprint, *res);
+            registrations.emplace_back(ExternalSignerRegistration{signer.m_fingerprint, *res});
+        }
+
+        return registrations;
+    }
+    return util::Error{_("Could not find ExternalSignerScriptPubKeyManager")};
+}
+
 void CWallet::LoadLockedCoin(const COutPoint& coin, bool persistent)
 {
     AssertLockHeld(cs_wallet);
@@ -3610,27 +3905,60 @@ void CWallet::LoadDescriptorScriptPubKeyMan(uint256 id, WalletDescriptor& desc,
     AddScriptPubKeyMan(id, std::move(spk_manager));
 }
 
-DescriptorScriptPubKeyMan& CWallet::SetupDescriptorScriptPubKeyMan(WalletBatch& batch, const CExtKey& master_key, const OutputType& output_type, bool internal)
+std::vector<std::string> CWallet::SetupDescriptorScriptPubKeyManPair(WalletBatch& batch, const CExtKey& master_key, OutputType output_type, bool receive, bool change)
 {
     AssertLockHeld(cs_wallet);
     if (IsLocked()) {
         throw std::runtime_error(std::string(__func__) + ": Wallet is locked, cannot setup new descriptors");
     }
-    auto spk_manager = DescriptorScriptPubKeyMan::GenerateNewSingleSig(*this, batch, m_keypool_size, master_key, output_type, internal);
-    DescriptorScriptPubKeyMan* out = spk_manager.get();
-    uint256 id = spk_manager->GetID();
-    AddScriptPubKeyMan(id, std::move(spk_manager));
-    AddActiveScriptPubKeyManWithDb(batch, id, output_type, internal);
-    return *out;
+    // Both the receive and change descriptor derive from a single multipath
+    // descriptor, which Parse below expands and returns in normalized form
+    // (which requires the master xprv).
+    const std::string multipath_desc{GenerateMultipathDescriptorString(EncodeExtKey(master_key), output_type)};
+    FlatSigningProvider keys;
+    std::string error;
+    std::optional<std::string> multipath_normalized;
+    auto descs{Parse(multipath_desc, keys, error, /*require_checksum=*/false, /*multipath=*/&multipath_normalized)};
+    Assert(descs.size() == 2 && multipath_normalized);
+
+    // The expanded descriptors are ordered by chain: receive, then change
+    // Take their IDs before they are moved below.
+    const uint256 receive_id{DescriptorID(*descs.at(0))};
+    const uint256 change_id{DescriptorID(*descs.at(1))};
+
+    std::vector<std::pair<std::unique_ptr<Descriptor>, /*internal=*/bool>> requested_descs;
+    if (receive) requested_descs.emplace_back(std::move(descs.at(0)), false);
+    if (change) requested_descs.emplace_back(std::move(descs.at(1)), true);
+
+    std::vector<std::string> new_descs;
+    for (auto& [desc, internal] : requested_descs) {
+        if (GetScriptPubKeyMan(DescriptorID(*desc))) continue;
+        WalletDescriptor w_desc(std::move(desc), GetTime(), /*range_start=*/0, /*range_end=*/0, /*next_index=*/0);
+        auto spk_manager = DescriptorScriptPubKeyMan::GenerateNewSingleSig(*this, batch, m_keypool_size, master_key, std::move(w_desc));
+        uint256 id = spk_manager->GetID();
+        std::string desc_str;
+        Assert(spk_manager->GetDescriptorString(desc_str, /*priv=*/false));
+        new_descs.push_back(std::move(desc_str));
+        AddScriptPubKeyMan(id, std::move(spk_manager));
+        AddActiveScriptPubKeyManWithDb(batch, id, output_type, internal);
+    }
+
+    // Store a record with the multipath descriptor, once the whole pair
+    // exists and if this call created at least one of its members
+    const bool pair_complete{GetScriptPubKeyMan(receive_id) && GetScriptPubKeyMan(change_id)};
+    if (!new_descs.empty() && pair_complete) {
+        if (auto res{AddMultipathDescriptor(batch, MultipathDescriptorRecord(std::move(*multipath_normalized), {receive_id, change_id}))}; !res) {
+            throw std::runtime_error(strprintf("%s: Failed to store multipath descriptor record: %s", __func__, util::ErrorString(res).original));
+        }
+    }
+    return new_descs;
 }
 
 void CWallet::SetupDescriptorScriptPubKeyMans(WalletBatch& batch, const CExtKey& master_key)
 {
     AssertLockHeld(cs_wallet);
-    for (bool internal : {false, true}) {
-        for (OutputType t : OUTPUT_TYPES) {
-            SetupDescriptorScriptPubKeyMan(batch, master_key, t, internal);
-        }
+    for (OutputType t : OUTPUT_TYPES) {
+        SetupDescriptorScriptPubKeyManPair(batch, master_key, t);
     }
 }
 
@@ -3703,10 +4031,10 @@ void CWallet::SetupDescriptorScriptPubKeyMans()
 void CWallet::SetupWalletGeneration()
 {
     AssertLockHeld(cs_wallet);
-    // Skip setup for non-external-signer wallets that are either blank
-    // or have private keys disabled (not having private keys implies blank).
-    if (!IsWalletFlagSet(WALLET_FLAG_EXTERNAL_SIGNER) &&
-        (IsWalletFlagSet(WALLET_FLAG_BLANK_WALLET) || IsWalletFlagSet(WALLET_FLAG_DISABLE_PRIVATE_KEYS))) {
+    // Skip setup for blank wallets. Non-external-signer wallets with disabled
+    // private keys also skip setup (not having private keys implies blank).
+    if (IsWalletFlagSet(WALLET_FLAG_BLANK_WALLET) ||
+        (!IsWalletFlagSet(WALLET_FLAG_EXTERNAL_SIGNER) && IsWalletFlagSet(WALLET_FLAG_DISABLE_PRIVATE_KEYS))) {
         return;
     }
     SetupDescriptorScriptPubKeyMans();
@@ -3810,7 +4138,12 @@ util::Result<std::reference_wrapper<DescriptorScriptPubKeyMan>> CWallet::AddWall
             return util::Error{util::ErrorString(spkm_res)};
         }
     } else {
-        auto new_spk_man = DescriptorScriptPubKeyMan::CreateFromImport(*this, desc, m_keypool_size, signing_provider);
+        std::unique_ptr<DescriptorScriptPubKeyMan> new_spk_man;
+        if (IsWalletFlagSet(WALLET_FLAG_EXTERNAL_SIGNER)) {
+            new_spk_man = ExternalSignerScriptPubKeyMan::CreateFromImport(*this, desc, m_keypool_size, signing_provider);
+        } else {
+            new_spk_man = DescriptorScriptPubKeyMan::CreateFromImport(*this, desc, m_keypool_size, signing_provider);
+        }
         spk_man = new_spk_man.get();
 
         // Save the descriptor to memory
@@ -3851,6 +4184,47 @@ util::Result<std::reference_wrapper<DescriptorScriptPubKeyMan>> CWallet::AddWall
     return std::reference_wrapper(*spk_man);
 }
 
+void CWallet::LoadMultipathDescriptor(MultipathDescriptorRecord multipath_desc)
+{
+    AssertLockHeld(cs_wallet);
+    uint256 id = multipath_desc.GetID();
+    m_multipath_descriptors[id] = std::move(multipath_desc);
+}
+
+std::optional<std::string> CWallet::GetMultipathDescriptor(const uint256& desc_id) const
+{
+    AssertLockHeld(cs_wallet);
+    for (const auto& [id, multipath_desc] : m_multipath_descriptors) {
+        if (std::find(multipath_desc.desc_ids.begin(), multipath_desc.desc_ids.end(), desc_id) != multipath_desc.desc_ids.end()) {
+            return multipath_desc.descriptor;
+        }
+    }
+    return std::nullopt;
+}
+
+util::Result<void> CWallet::AddMultipathDescriptor(WalletBatch& batch, MultipathDescriptorRecord multipath_desc)
+{
+    AssertLockHeld(cs_wallet);
+    for (const uint256& desc_id : multipath_desc.desc_ids) {
+        if (!GetScriptPubKeyMan(desc_id)) return util::Error{Untranslated("Multipath descriptor record references an unknown descriptor")};
+    }
+    // Refuse a record that shares a descriptor with a different existing
+    // record: it would make the multipath attribution of the shared
+    // descriptor ambiguous, and such overlap is almost certainly an accident.
+    const uint256 id{multipath_desc.GetID()};
+    for (const auto& [existing_id, existing] : m_multipath_descriptors) {
+        if (existing_id == id) continue;
+        for (const uint256& desc_id : multipath_desc.desc_ids) {
+            if (std::find(existing.desc_ids.begin(), existing.desc_ids.end(), desc_id) != existing.desc_ids.end()) {
+                return util::Error{Untranslated(strprintf("A descriptor is already part of the multipath descriptor '%s'", existing.descriptor))};
+            }
+        }
+    }
+    if (!batch.WriteMultipathDescriptor(multipath_desc)) return util::Error{Untranslated("Error writing multipath descriptor record to database")};
+    LoadMultipathDescriptor(std::move(multipath_desc));
+    return {};
+}
+
 bool CWallet::MigrateToSQLite(bilingual_str& error)
 {
     AssertLockHeld(cs_wallet);
diff --git a/src/wallet/wallet.h b/src/wallet/wallet.h
index 61ba2dea2634..6f678124052a 100644
--- a/src/wallet/wallet.h
+++ b/src/wallet/wallet.h
@@ -133,6 +133,7 @@ inline constexpr bool DEFAULT_WALLET_RBF = true;
 inline constexpr bool DEFAULT_WALLETBROADCAST = true;
 inline constexpr bool DEFAULT_DISABLE_WALLET = false;
 inline constexpr bool DEFAULT_WALLETCROSSCHAIN = false;
+inline constexpr bool DEFAULT_SIGN_TAPROOT_KEYPATH_ONLY{false};
 //! -maxtxfee default
 inline constexpr CAmount DEFAULT_TRANSACTION_MAXFEE{COIN / 10};
 //! Discourage users to set fees higher than this amount (in satoshis) per kB
@@ -157,7 +158,11 @@ inline constexpr uint64_t KNOWN_WALLET_FLAGS =
     |   WALLET_FLAG_EXTERNAL_SIGNER;
 
 inline constexpr uint64_t MUTABLE_WALLET_FLAGS =
-        WALLET_FLAG_AVOID_REUSE;
+        WALLET_FLAG_AVOID_REUSE
+    |   WALLET_FLAG_EXTERNAL_SIGNER;
+
+inline constexpr uint64_t WALLET_FLAGS_REQUIRING_RELOAD =
+        WALLET_FLAG_EXTERNAL_SIGNER;
 
 inline const std::map<WalletFlags, std::string> WALLET_FLAG_TO_STRING{
     {WALLET_FLAG_AVOID_REUSE, "avoid_reuse"},
@@ -302,6 +307,12 @@ struct CRecipient
     bool fSubtractFeeFromAmount;
 };
 
+/** Opaque descriptor registration returned by an external signer. */
+struct ExternalSignerRegistration {
+    std::string fingerprint;
+    std::string registration;
+};
+
 class WalletRescanReserver; //forward declarations for ScanForWalletTransactions/RescanFromTime
 /**
  * A CWallet maintains a set of transactions and balances, and provides the ability to create new transactions.
@@ -380,10 +391,12 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     /** WalletFlags set on this wallet. */
     std::atomic<uint64_t> m_wallet_flags{0};
 
+    std::vector<ExternalSignerRegistration> m_external_signer_registrations;
+
     bool SetAddressBookWithDB(WalletBatch& batch, const CTxDestination& address, const std::string& strName, const std::optional<AddressPurpose>& strPurpose);
 
     //! Unsets a wallet flag and saves it to disk
-    void UnsetWalletFlagWithDB(WalletBatch& batch, uint64_t flag);
+    bool UnsetWalletFlagWithDB(WalletBatch& batch, uint64_t flag);
 
     //! Unset the blank wallet flag and saves it to disk
     void UnsetBlankWalletFlag(WalletBatch& batch) override;
@@ -420,6 +433,10 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     // ScriptPubKeyMan::GetID. In many cases it will be the hash of an internal structure
     std::map<uint256, std::unique_ptr<ScriptPubKeyMan>> m_spk_managers;
 
+    // Records tying together the descriptors that were expanded from a
+    // multipath descriptor, indexed by MultipathDescriptorRecord::GetID.
+    std::map<uint256, MultipathDescriptorRecord> m_multipath_descriptors GUARDED_BY(cs_wallet);
+
     // Appends spk managers into the main 'm_spk_managers'.
     // Must be the only method adding data to it.
     void AddScriptPubKeyMan(const uint256& id, std::unique_ptr<ScriptPubKeyMan> spkm_man);
@@ -428,7 +445,7 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     void AddActiveScriptPubKeyManWithDb(WalletBatch& batch, uint256 id, OutputType type, bool internal);
 
     /** Store wallet flags */
-    void SetWalletFlagWithDB(WalletBatch& batch, uint64_t flags);
+    bool SetWalletFlagWithDB(WalletBatch& batch, uint64_t flags);
 
     //! Cache of descriptor ScriptPubKeys used for IsMine. Maps ScriptPubKey to set of spkms
     std::unordered_map<CScript, std::vector<ScriptPubKeyMan*>, SaltedSipHasher> m_cached_spks;
@@ -569,6 +586,27 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     /** Display address on an external signer. */
     util::Result<void> DisplayAddress(const CTxDestination& dest) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
 
+    /** Determine if the SPKM contains a descriptor that may need device registration. */
+    bool IsCandidateForDescriptorRegistration(DescriptorScriptPubKeyMan& spkm) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+
+    /**
+     * Retrieve the stored multipath descriptor for a receive/change pair.
+     *
+     * Ignores trivial single sig policies: pkh(KEY), wpkh(KEY), sh(wpkh(KEY))
+     * and tr(KEY)
+     *
+     * If no SKPM pair is provided, look for the first suitable pair.
+     *
+     * @param[in] spk_pair The receive and change SKPM to use.
+     *
+     * @return the stored multipath descriptor, or an error if no suitable
+     *         descriptors or matching multipath record were found.
+     */
+    util::Result<std::string> GetRegistrationDescriptor(const std::optional<std::pair<DescriptorScriptPubKeyMan&, DescriptorScriptPubKeyMan&>>& spk_pair) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+
+    /** Register a descriptor on all connected external signers and persist the results. */
+    util::Result<std::vector<ExternalSignerRegistration>> RegisterDescriptor(const std::optional<std::string>& name) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+
     bool IsLockedCoin(const COutPoint& output) const EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
     void LoadLockedCoin(const COutPoint& coin, bool persistent) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
     bool LockCoin(const COutPoint& output, bool persist) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
@@ -683,7 +721,7 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     std::optional<common::PSBTError> FillPSBT(PartiallySignedTransaction& psbtx,
                   const common::PSBTFillOptions& options,
                   bool& complete,
-                  size_t* n_signed = nullptr) const;
+                  size_t* n_signed = nullptr);
 
     /**
      * Submit the transaction to the node's mempool and then relay to peers.
@@ -910,11 +948,11 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
      */
     void BlockUntilSyncedToCurrentChain() const LOCKS_EXCLUDED(::cs_main) EXCLUSIVE_LOCKS_REQUIRED(!cs_wallet);
 
-    /** set a single wallet flag */
-    void SetWalletFlag(uint64_t flags);
+    /** Set wallet flags. Returns whether the wallet needs to be reloaded. */
+    bool SetWalletFlag(uint64_t flags);
 
-    /** Unsets a single wallet flag */
-    void UnsetWalletFlag(uint64_t flag);
+    /** Unset wallet flags. Returns whether the wallet needs to be reloaded. */
+    bool UnsetWalletFlag(uint64_t flag);
 
     /** check if a certain wallet flag is set */
     bool IsWalletFlagSet(uint64_t flag) const override;
@@ -928,6 +966,11 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     //! Retrieve all of the wallet's flags
     uint64_t GetWalletFlags() const;
 
+    const std::vector<ExternalSignerRegistration>& GetExternalSignerRegistrations() const { return m_external_signer_registrations; }
+
+    //! Load an opaque descriptor registration returned by an external signer.
+    void LoadExternalSignerRegistration(const std::string& fingerprint, const std::string& registration);
+
     /** Return wallet name for use in logs, will return "default wallet" if the wallet has no name. */
     std::string LogName() const override
     {
@@ -1033,8 +1076,16 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     //! @param[in] internal Whether this ScriptPubKeyMan provides change addresses
     void DeactivateScriptPubKeyMan(uint256 id, OutputType type, bool internal);
 
-    //! Create new DescriptorScriptPubKeyMan and add it to the wallet
-    DescriptorScriptPubKeyMan& SetupDescriptorScriptPubKeyMan(WalletBatch& batch, const CExtKey& master_key, const OutputType& output_type, bool internal) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+    //! Create the receive and change DescriptorScriptPubKeyMan if they don't
+    //! exist yet. A record of the multipath descriptor is stored by the call
+    //! that completes the pair.
+    //! @param[in] batch Batch to write the new descriptors with
+    //! @param[in] master_key Master key to derive the descriptors from
+    //! @param[in] output_type The OutputType of the descriptor pair
+    //! @param[in] receive Whether to create the receive descriptor
+    //! @param[in] change Whether to create the change descriptor
+    //! @return The public descriptor strings of the newly created descriptors
+    std::vector<std::string> SetupDescriptorScriptPubKeyManPair(WalletBatch& batch, const CExtKey& master_key, OutputType output_type, bool receive = true, bool change = true) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
     //! Create new DescriptorScriptPubKeyMans and add them to the wallet
     void SetupDescriptorScriptPubKeyMans(WalletBatch& batch, const CExtKey& master_key) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
     void SetupDescriptorScriptPubKeyMans() EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
@@ -1056,6 +1107,19 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     //! Add a descriptor to the wallet, return a ScriptPubKeyMan & associated output type
     util::Result<std::reference_wrapper<DescriptorScriptPubKeyMan>> AddWalletDescriptor(WalletDescriptor& desc, const FlatSigningProvider& signing_provider, const std::string& label, bool internal) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
 
+    //! Load a multipath descriptor record into memory (used by LoadWallet)
+    void LoadMultipathDescriptor(MultipathDescriptorRecord multipath_desc) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+
+    //! Add a multipath descriptor record to the wallet, and write it to the wallet database
+    [[nodiscard]] util::Result<void> AddMultipathDescriptor(WalletBatch& batch, MultipathDescriptorRecord multipath_desc) EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+
+    //! Get all multipath descriptor records, by record ID
+    const std::map<uint256, MultipathDescriptorRecord>& GetMultipathDescriptors() const EXCLUSIVE_LOCKS_REQUIRED(cs_wallet) { return m_multipath_descriptors; }
+
+    //! Get the multipath descriptor that the given wallet descriptor was
+    //! expanded from, if any
+    std::optional<std::string> GetMultipathDescriptor(const uint256& desc_id) const EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+
     /** Move all records from the BDB database to a new SQLite database for storage.
      * The original BDB file will be deleted and replaced with a new SQLite file.
      * A backup is not created.
diff --git a/src/wallet/walletdb.cpp b/src/wallet/walletdb.cpp
index 1a9ebaa3549e..17cb808f65fa 100644
--- a/src/wallet/walletdb.cpp
+++ b/src/wallet/walletdb.cpp
@@ -33,6 +33,7 @@ const std::string ACENTRY{"acentry"};
 const std::string ACTIVEEXTERNALSPK{"activeexternalspk"};
 const std::string ACTIVEINTERNALSPK{"activeinternalspk"};
 const std::string BESTBLOCK_NOMERKLE{"bestblock_nomerkle"};
+const std::string EXTERNAL_SIGNER_REGISTRATION{"external_signer_registration"};
 const std::string BESTBLOCK{"bestblock"};
 const std::string CRYPTED_KEY{"ckey"};
 const std::string CSCRIPT{"cscript"};
@@ -45,6 +46,7 @@ const std::string KEY{"key"};
 const std::string LOCKED_UTXO{"lockedutxo"};
 const std::string MASTER_KEY{"mkey"};
 const std::string MINVERSION{"minversion"};
+const std::string MULTIPATHDESCRIPTOR{"multipathdescriptor"};
 const std::string NAME{"name"};
 const std::string OLD_KEY{"wkey"};
 const std::string ORDERPOSNEXT{"orderposnext"};
@@ -241,6 +243,11 @@ bool WalletBatch::WriteDescriptor(const uint256& desc_id, const WalletDescriptor
     return WriteIC(make_pair(DBKeys::WALLETDESCRIPTOR, desc_id), descriptor);
 }
 
+bool WalletBatch::WriteMultipathDescriptor(const MultipathDescriptorRecord& multipath_desc)
+{
+    return WriteIC(std::make_pair(DBKeys::MULTIPATHDESCRIPTOR, multipath_desc.GetID()), multipath_desc);
+}
+
 bool WalletBatch::WriteDescriptorDerivedCache(const CExtPubKey& xpub, const uint256& desc_id, uint32_t key_exp_index, uint32_t der_index)
 {
     std::vector<unsigned char> ser_xpub(BIP32_EXTKEY_SIZE);
@@ -921,9 +928,61 @@ static DBErrors LoadDescriptorWalletRecords(CWallet* pwallet, DatabaseBatch& bat
                desc_res.m_records, num_keys, num_ckeys, num_keys + num_ckeys);
     }
 
-    return desc_res.m_result;
+    // Load multipath descriptor records. These must be loaded after the
+    // descriptor records so that the descriptors they reference are known.
+    LoadResult multipath_res = LoadRecords(pwallet, batch, DBKeys::MULTIPATHDESCRIPTOR,
+        [] (CWallet* pwallet, DataStream& key, DataStream& value, std::string& strErr) EXCLUSIVE_LOCKS_REQUIRED(pwallet->cs_wallet) {
+        uint256 id;
+        key >> id;
+        MultipathDescriptorRecord multipath_desc;
+        try {
+            value >> multipath_desc;
+        } catch (const std::ios_base::failure&) {
+            strErr = strprintf("Error: Unrecognized multipath descriptor record found in wallet %s.", pwallet->GetName());
+            return DBErrors::CORRUPT;
+        }
+        if (id != multipath_desc.GetID()) {
+            strErr = "The multipath descriptor ID calculated by the wallet differs from the one in DB";
+            return DBErrors::CORRUPT;
+        }
+        // Wallet descriptors cannot be deleted, so a record referencing an
+        // unknown descriptor means the database is corrupted.
+        for (const uint256& desc_id : multipath_desc.desc_ids) {
+            if (!pwallet->GetScriptPubKeyMan(desc_id)) {
+                strErr = strprintf("Error: Multipath descriptor record references unknown descriptor id '%s' in wallet %s.", desc_id.ToString(), pwallet->GetName());
+                return DBErrors::CORRUPT;
+            }
+        }
+        pwallet->LoadMultipathDescriptor(std::move(multipath_desc));
+        return DBErrors::LOAD_OK;
+    });
+
+    return std::max(desc_res.m_result, multipath_res.m_result);
 }
 
+static DBErrors LoadExternalSignerRegistrationRecords(CWallet* pwallet, DatabaseBatch& batch) EXCLUSIVE_LOCKS_REQUIRED(pwallet->cs_wallet)
+{
+    AssertLockHeld(pwallet->cs_wallet);
+
+    LoadResult res = LoadRecords(pwallet, batch, DBKeys::EXTERNAL_SIGNER_REGISTRATION,
+        [] (CWallet* pwallet, DataStream& key, DataStream& value, std::string& err) EXCLUSIVE_LOCKS_REQUIRED(pwallet->cs_wallet) {
+        std::string fingerprint;
+        std::string registration;
+        key >> fingerprint;
+        value >> registration;
+        pwallet->LoadExternalSignerRegistration(fingerprint, registration);
+        return DBErrors::LOAD_OK;
+    });
+
+    if (res.m_result <= DBErrors::NONCRITICAL_ERROR) {
+        // Only log if there are no critical errors
+        pwallet->WalletLogPrintf("Loaded external signer descriptor registrations: %u\n", res.m_records);
+    }
+
+    return res.m_result;
+}
+
+
 static DBErrors LoadAddressBookRecords(CWallet* pwallet, DatabaseBatch& batch) EXCLUSIVE_LOCKS_REQUIRED(pwallet->cs_wallet)
 {
     AssertLockHeld(pwallet->cs_wallet);
@@ -1165,6 +1224,9 @@ DBErrors WalletBatch::LoadWallet(CWallet* pwallet)
         // when in reality the wallet is simply too new.
         if (result == DBErrors::UNKNOWN_DESCRIPTOR) return result;
 
+        // Load external signer descriptor registrations
+        result = std::max(LoadExternalSignerRegistrationRecords(pwallet, *m_batch), result);
+
         // Load address book
         result = std::max(LoadAddressBookRecords(pwallet, *m_batch), result);
 
@@ -1282,6 +1344,11 @@ bool WalletBatch::WriteWalletFlags(const uint64_t flags)
     return WriteIC(DBKeys::FLAGS, flags);
 }
 
+bool WalletBatch::WriteExternalSignerRegistration(const std::string& fingerprint, const std::string& registration)
+{
+    return WriteIC(std::make_pair(DBKeys::EXTERNAL_SIGNER_REGISTRATION, fingerprint), registration);
+}
+
 bool WalletBatch::EraseRecords(const std::unordered_set<std::string>& types)
 {
     return std::all_of(types.begin(), types.end(), [&](const std::string& type) {
diff --git a/src/wallet/walletdb.h b/src/wallet/walletdb.h
index c9b974bdcffa..1a315fd84666 100644
--- a/src/wallet/walletdb.h
+++ b/src/wallet/walletdb.h
@@ -14,6 +14,7 @@
 #include <wallet/walletutil.h>
 
 #include <cstdint>
+#include <optional>
 #include <string>
 #include <unordered_set>
 #include <vector>
@@ -62,6 +63,7 @@ extern const std::string ACTIVEEXTERNALSPK;
 extern const std::string ACTIVEINTERNALSPK;
 extern const std::string BESTBLOCK;
 extern const std::string BESTBLOCK_NOMERKLE;
+extern const std::string EXTERNAL_SIGNER_REGISTRATION;
 extern const std::string CRYPTED_KEY;
 extern const std::string CSCRIPT;
 extern const std::string DEFAULTKEY;
@@ -73,6 +75,7 @@ extern const std::string KEYMETA;
 extern const std::string LOCKED_UTXO;
 extern const std::string MASTER_KEY;
 extern const std::string MINVERSION;
+extern const std::string MULTIPATHDESCRIPTOR;
 extern const std::string NAME;
 extern const std::string OLD_KEY;
 extern const std::string ORDERPOSNEXT;
@@ -253,6 +256,7 @@ class WalletBatch
     bool WriteDescriptorKey(const uint256& desc_id, const CPubKey& pubkey, const CPrivKey& privkey);
     bool WriteCryptedDescriptorKey(const uint256& desc_id, const CPubKey& pubkey, const std::vector<unsigned char>& secret);
     bool WriteDescriptor(const uint256& desc_id, const WalletDescriptor& descriptor);
+    bool WriteMultipathDescriptor(const MultipathDescriptorRecord& multipath_desc);
     bool WriteDescriptorDerivedCache(const CExtPubKey& xpub, const uint256& desc_id, uint32_t key_exp_index, uint32_t der_index);
     bool WriteDescriptorParentCache(const CExtPubKey& xpub, const uint256& desc_id, uint32_t key_exp_index);
     bool WriteDescriptorLastHardenedCache(const CExtPubKey& xpub, const uint256& desc_id, uint32_t key_exp_index);
@@ -284,6 +288,10 @@ class WalletBatch
     bool EraseRecords(const std::unordered_set<std::string>& types);
 
     bool WriteWalletFlags(uint64_t flags);
+
+    //! Write an opaque descriptor registration for the signer identified by fingerprint.
+    bool WriteExternalSignerRegistration(const std::string& fingerprint, const std::string& registration);
+
     //! Begin a new transaction
     bool TxnBegin();
     //! Commit current transaction
diff --git a/src/wallet/walletutil.cpp b/src/wallet/walletutil.cpp
index 85249f63275b..d2155b28d23e 100644
--- a/src/wallet/walletutil.cpp
+++ b/src/wallet/walletutil.cpp
@@ -32,31 +32,28 @@ fs::path GetWalletDir()
     return path;
 }
 
-WalletDescriptor GenerateWalletDescriptor(const CExtPubKey& master_key, const OutputType& addr_type, bool internal)
+std::string GenerateMultipathDescriptorString(const std::string& key, OutputType addr_type)
 {
-    int64_t creation_time = GetTime();
-
-    std::string xpub = EncodeExtPubKey(master_key);
 
     // Build descriptor string
     std::string desc_prefix;
     std::string desc_suffix = "/*)";
     switch (addr_type) {
     case OutputType::LEGACY: {
-        desc_prefix = "pkh(" + xpub + "/44h";
+        desc_prefix = "pkh(" + key + "/44h";
         break;
     }
     case OutputType::P2SH_SEGWIT: {
-        desc_prefix = "sh(wpkh(" + xpub + "/49h";
+        desc_prefix = "sh(wpkh(" + key + "/49h";
         desc_suffix += ")";
         break;
     }
     case OutputType::BECH32: {
-        desc_prefix = "wpkh(" + xpub + "/84h";
+        desc_prefix = "wpkh(" + key + "/84h";
         break;
     }
     case OutputType::BECH32M: {
-        desc_prefix = "tr(" + xpub + "/86h";
+        desc_prefix = "tr(" + key + "/86h";
         break;
     }
     case OutputType::UNKNOWN: {
@@ -74,15 +71,7 @@ WalletDescriptor GenerateWalletDescriptor(const CExtPubKey& master_key, const Ou
         desc_prefix += "/0h";
     }
 
-    std::string internal_path = internal ? "/1" : "/0";
-    std::string desc_str = desc_prefix + "/0h" + internal_path + desc_suffix;
-
-    // Make the descriptor
-    FlatSigningProvider keys;
-    std::string error;
-    std::vector<std::unique_ptr<Descriptor>> desc = Parse(desc_str, keys, error, false);
-    WalletDescriptor w_desc(std::move(desc.at(0)), creation_time, 0, 0, 0);
-    return w_desc;
+    return desc_prefix + "/0h/<0;1>" + desc_suffix;
 }
 
 } // namespace wallet
diff --git a/src/wallet/walletutil.h b/src/wallet/walletutil.h
index a85a339a2da9..807c8ffd3971 100644
--- a/src/wallet/walletutil.h
+++ b/src/wallet/walletutil.h
@@ -5,9 +5,13 @@
 #ifndef BITCOIN_WALLET_WALLETUTIL_H
 #define BITCOIN_WALLET_WALLETUTIL_H
 
+#include <crypto/sha256.h>
 #include <script/descriptor.h>
+#include <serialize.h>
+#include <span.h>
 #include <util/fs.h>
 
+#include <string>
 #include <vector>
 
 namespace wallet {
@@ -130,7 +134,41 @@ class WalletDescriptor
       creation_time(creation_time) {}
 };
 
-WalletDescriptor GenerateWalletDescriptor(const CExtPubKey& master_key, const OutputType& output_type, bool internal);
+//! Build the multipath descriptor string, with a /<0;1> element covering
+//! the receive and change chain.
+//! @param[in] key       encoded master key, private or public
+//! @param[in] addr_type output type of the descriptor
+std::string GenerateMultipathDescriptorString(const std::string& key, OutputType addr_type);
+
+/** Record tying together the single-path wallet descriptors that a multipath
+ *  descriptor was expanded to, so that the original multipath form can be
+ *  reported back to the user. */
+class MultipathDescriptorRecord
+{
+public:
+    //! The multipath descriptor string, in public form and with checksum
+    std::string descriptor;
+    //! IDs of the wallet descriptors this multipath descriptor expands to, in
+    //! multipath order.
+    std::vector<uint256> desc_ids;
+
+    MultipathDescriptorRecord() = default;
+    MultipathDescriptorRecord(std::string descriptor, std::vector<uint256> desc_ids)
+        : descriptor(std::move(descriptor)), desc_ids(std::move(desc_ids)) {}
+
+    //! ID of this record, derived from the descriptor string.
+    uint256 GetID() const
+    {
+        uint256 id;
+        CSHA256().Write(UCharCast(descriptor.data()), descriptor.size()).Finalize(id.begin());
+        return id;
+    }
+
+    SERIALIZE_METHODS(MultipathDescriptorRecord, obj)
+    {
+        READWRITE(obj.descriptor, obj.desc_ids);
+    }
+};
 } // namespace wallet
 
 #endif // BITCOIN_WALLET_WALLETUTIL_H
diff --git a/test/functional/mocks/signer.py b/test/functional/mocks/signer.py
index a13c97d1216f..fd76f9f00d69 100755
--- a/test/functional/mocks/signer.py
+++ b/test/functional/mocks/signer.py
@@ -3,10 +3,54 @@
 # Distributed under the MIT software license, see the accompanying
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
-import os
-import sys
 import argparse
+import base64
 import json
+import os
+import sys
+import urllib.parse
+
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.realpath(__file__))))
+
+from test_framework.authproxy import AuthServiceProxy, JSONRPCException
+from test_framework.psbt import (
+    PSBT,
+    PSBT_IN_PARTIAL_SIG,
+    PSBT_IN_SIGHASH_TYPE,
+    PSBT_IN_TAP_KEY_SIG,
+    PSBT_OUT_AMOUNT,
+    PSBT_OUT_SCRIPT,
+)
+
+# Master private key for the tpub in getdescriptors below. Used by signtx,
+# which imports the keys into a wallet on the offline node provided by the
+# test and lets it do the actual signing.
+tprv = "tprv8ZgxMBicQKsPd7Uf69XL1XwhmjHopUGep8GuEiJDZmbQz6o58LninorQAfcKZWARbtRtfnLcJ5MQ2AtHcQJCCRUcMRvmDUjyEmNUWwx8UbK"
+
+MOCK_WALLET = "mock"
+DEFAULT_FINGERPRINT = "00000001"
+DEFAULT_REGISTRATION = "cmRlc2MBBHRlc3Q="
+
+
+def get_mock_signers():
+    """Return the mock fingerprint-to-wallet mapping.
+
+    Tests that need more than the default signer write this mapping to the
+    node's working directory. Each wallet is hosted by the dedicated offline
+    mock node referenced by mock_rpc_url.
+    """
+    path = os.path.join(os.getcwd(), "mock_signers")
+    if not os.path.isfile(path):
+        return {DEFAULT_FINGERPRINT: MOCK_WALLET}
+    with open(path, "r", encoding="utf8") as f:
+        return json.load(f)
+
+
+def validate_fingerprint(args):
+    if args.fingerprint not in get_mock_signers():
+        sys.stdout.write(json.dumps({"error": "Unexpected fingerprint", "fingerprint": args.fingerprint}))
+        return False
+    return True
 
 def perform_pre_checks():
     mock_result_path = os.path.join(os.getcwd(), "mock_result")
@@ -18,7 +62,10 @@ def perform_pre_checks():
             sys.exit(int(mock_result[0]))
 
 def enumerate(args):
-    sys.stdout.write(json.dumps([{"fingerprint": "00000001", "type": "trezor", "model": "trezor_t"}]))
+    sys.stdout.write(json.dumps([
+        {"fingerprint": fingerprint, "type": "trezor", "model": "trezor_t"}
+        for fingerprint in get_mock_signers()
+    ]))
 
 def getdescriptors(args):
     xpub = "tpubD6NzVbkrYhZ4WaWSyoBvQwbpLkojyoTZPRsgXELWz3Popb3qkjcJyJUGLnL4qHHoQvao8ESaAstxYSnhyswJ76uZPStJRJCTKvosUCJZL5B"
@@ -41,8 +88,23 @@ def getdescriptors(args):
 
 
 def displayaddress(args):
-    if args.fingerprint != "00000001":
-        return sys.stdout.write(json.dumps({"error": "Unexpected fingerprint", "fingerprint": args.fingerprint}))
+    if not validate_fingerprint(args):
+        return
+
+    if args.registration is not None and not validate_registration(args):
+        return
+
+    address_path = os.path.join(os.getcwd(), f"mock_displayaddress_{args.fingerprint}")
+    if not os.path.isfile(address_path):
+        address_path = os.path.join(os.getcwd(), "mock_displayaddress")
+    if os.path.isfile(address_path):
+        with open(address_path, "r", encoding="utf8") as f:
+            return sys.stdout.write(json.dumps({"address": f.read().strip()}))
+    if args.registration is not None:
+        return sys.stdout.write(json.dumps({"error": "mock_displayaddress not set"}))
+
+    if args.fingerprint != DEFAULT_FINGERPRINT:
+        return sys.stdout.write(json.dumps({"error": "Unexpected descriptor signer"}))
 
     expected_desc = {
         "wpkh([00000001/84h/1h/0h/0/0]02c97dc3f4420402e01a113984311bf4a1b8de376cac0bdcfaf1b3ac81f13433c7)#3te6hhy7": "bcrt1qm90ugl4d48jv8n6e5t9ln6t9zlpm5th68x4f8g",
@@ -56,20 +118,142 @@ def displayaddress(args):
 
     return sys.stdout.write(json.dumps({"address": expected_desc[args.desc]}))
 
-def signtx(args):
-    if args.fingerprint != "00000001":
-        return sys.stdout.write(json.dumps({"error": "Unexpected fingerprint", "fingerprint": args.fingerprint}))
+def get_mock_wallet(fingerprint):
+    """RPC connection to the wallet holding our private keys, created on
+    first use. The test provides a dedicated offline node for it and passes
+    the node's RPC URL via a file in our working directory."""
+    with open(os.path.join(os.getcwd(), "mock_rpc_url"), "r", encoding="utf8") as f:
+        node_url = f.read().strip()
+    wallet_name = get_mock_signers()[fingerprint]
+    node = AuthServiceProxy(node_url)
+    wallet = AuthServiceProxy(f"{node_url}/wallet/{urllib.parse.quote(wallet_name)}")
+    try:
+        node.loadwallet(filename=wallet_name)
+        return wallet
+    except JSONRPCException as e:
+        if e.error["code"] == -35:  # RPC_WALLET_ALREADY_LOADED
+            return wallet
+        if e.error["code"] != -18:  # RPC_WALLET_NOT_FOUND
+            raise
+    if fingerprint != DEFAULT_FINGERPRINT or wallet_name != MOCK_WALLET:
+        raise RuntimeError(f"Mock signer wallet {wallet_name} not found")
+    node.createwallet(wallet_name=wallet_name, blank=True)
+    requests = []
+    for desc in [f"pkh({tprv}/<0;1>/*)", f"sh(wpkh({tprv}/<0;1>/*))", f"wpkh({tprv}/<0;1>/*)", f"tr({tprv}/<0;1>/*)"]:
+        checksum = node.getdescriptorinfo(descriptor=desc)["checksum"]
+        requests.append({"desc": f"{desc}#{checksum}", "timestamp": "now", "range": [0, 99]})
+    result = wallet.importdescriptors(requests=requests)
+    assert all(r["success"] for r in result)
+    return wallet
 
-    with open(os.path.join(os.getcwd(), "mock_psbt"), "r") as f:
-        mock_psbt = f.read()
+def tamper(psbt_b64, mode):
+    """Alter the transaction described by the (version 2) PSBT before signing
+    it, like a rogue or broken signer might."""
+    psbt = PSBT.from_base64(psbt_b64)
+    if mode == "change_amount":
+        # Steal from the output by redirecting the value to fees
+        amount = int.from_bytes(psbt.o[0].map[PSBT_OUT_AMOUNT], "little", signed=True)
+        psbt.o[0].map[PSBT_OUT_AMOUNT] = (amount - 1).to_bytes(8, "little", signed=True)
+    elif mode == "change_script":
+        psbt.o[0].map[PSBT_OUT_SCRIPT] = bytes([0x51])  # OP_TRUE
+    elif mode == "remove_output":
+        psbt.o.pop()
+    return psbt.to_base64()
 
-    if args.fingerprint == "00000001" :
-        sys.stdout.write(json.dumps({
-            "psbt": mock_psbt,
-            "complete": True
-        }))
+def registerdescriptor(args):
+    if not validate_fingerprint(args):
+        return
+
+    if "/<0;1>/*" not in args.descriptor:
+        return sys.stdout.write(json.dumps({"error": "Expected multipath descriptor", "descriptor": args.descriptor}))
+    if args.fingerprint == DEFAULT_FINGERPRINT and not os.path.isfile(os.path.join(os.getcwd(), "mock_signers")):
+        registration = DEFAULT_REGISTRATION
     else:
-        sys.stdout.write(json.dumps({"psbt": args.psbt}))
+        registration = base64.b64encode(json.dumps({
+            "descriptor": args.descriptor,
+            "fingerprint": args.fingerprint,
+            "name": args.name,
+        }, sort_keys=True).encode()).decode()
+    return sys.stdout.write(json.dumps({"registration": registration}))
+
+
+def validate_registration(args):
+    if args.fingerprint == DEFAULT_FINGERPRINT and args.registration == DEFAULT_REGISTRATION:
+        return True
+    try:
+        registration = json.loads(base64.b64decode(args.registration))
+    except Exception:
+        sys.stdout.write(json.dumps({"error": "Invalid registration"}))
+        return False
+    if registration.get("fingerprint") != args.fingerprint:
+        sys.stdout.write(json.dumps({"error": "Registration fingerprint mismatch"}))
+        return False
+    return True
+
+def signtx(args):
+    if not validate_fingerprint(args):
+        return
+
+    if os.path.isfile(os.path.join(os.getcwd(), "mock_signtx_crash")):
+        sys.stderr.write("mock signer crashed\n")
+        sys.exit(1)
+
+    error_path = os.path.join(os.getcwd(), "mock_signtx_error")
+    if os.path.isfile(error_path):
+        with open(error_path, "r", encoding="utf8") as f:
+            return sys.stdout.write(json.dumps({"error": f.read().strip()}))
+
+    if args.registration is not None and not validate_registration(args):
+        return
+
+    # The test can instruct us to sign in a specific, possibly misbehaving, way
+    mode = None
+    sign_mode_path = os.path.join(os.getcwd(), "mock_sign_mode")
+    if os.path.isfile(sign_mode_path):
+        with open(sign_mode_path, "r", encoding="utf8") as f:
+            mode = f.read().strip()
+
+    psbt = args.psbt
+    if mode in ("change_amount", "change_script", "remove_output"):
+        psbt = tamper(psbt, mode)
+
+    sign_options = {}
+    if mode in ("sighash_none", "sighash_none_hidden"):
+        sign_options["sighashtype"] = "NONE"
+    elif mode == "sighash_all_anyonecanpay":
+        sign_options["sighashtype"] = "ALL|ANYONECANPAY"
+
+    result = get_mock_wallet(args.fingerprint).walletprocesspsbt(psbt=psbt, sign=True, bip32derivs=False, finalize=False, **sign_options)
+    reply = result["psbt"]
+
+    counter_path = os.path.join(os.getcwd(), f"mock_signtx_{args.fingerprint}_counter")
+    counter = 1
+    if os.path.isfile(counter_path):
+        with open(counter_path, "r", encoding="utf8") as f:
+            counter = int(f.read().strip()) + 1
+    with open(counter_path, "w", encoding="utf8") as f:
+        f.write(str(counter))
+
+    if mode == "sighash_none_hidden":
+        # Drop the declared sighash type, leaving only the signatures
+        # themselves to reveal it
+        signed = PSBT.from_base64(reply)
+        for psbt_in in signed.i:
+            psbt_in.map.pop(PSBT_IN_SIGHASH_TYPE, None)
+        reply = signed.to_base64()
+    elif mode == "strip":
+        # Return only the signatures, plus the fields required to describe
+        # the same transaction
+        signed = PSBT.from_base64(reply)
+        stripped = PSBT.from_base64(reply)
+        stripped.make_blank()
+        for signed_in, stripped_in in zip(signed.i, stripped.i):
+            for key, value in signed_in.map.items():
+                if key == PSBT_IN_TAP_KEY_SIG or (isinstance(key, bytes) and key[0] == PSBT_IN_PARTIAL_SIG):
+                    stripped_in.map[key] = value
+        reply = stripped.to_base64()
+
+    sys.stdout.write(json.dumps({"psbt": reply}))
 
 parser = argparse.ArgumentParser(prog='./signer.py', description='External signer mock')
 parser.add_argument('--fingerprint')
@@ -87,11 +271,20 @@ def signtx(args):
 parser_getdescriptors.add_argument('--account', metavar='account')
 
 parser_displayaddress = subparsers.add_parser('displayaddress', help='display address on signer')
-parser_displayaddress.add_argument('--desc', metavar='desc')
+parser_displayaddress.add_argument('--desc', metavar='desc', default=None)
+parser_displayaddress.add_argument('--registration', default=None)
+parser_displayaddress.add_argument('--index', type=int, default=None)
+parser_displayaddress.add_argument('--multipath-index', type=int, default=0)
 parser_displayaddress.set_defaults(func=displayaddress)
 
+parser_register = subparsers.add_parser('registerdescriptor')
+parser_register.add_argument('name')
+parser_register.add_argument('descriptor')
+parser_register.set_defaults(func=registerdescriptor)
+
 parser_signtx = subparsers.add_parser('signtx')
 parser_signtx.add_argument('psbt', metavar='psbt')
+parser_signtx.add_argument('--registration', default=None)
 
 parser_signtx.set_defaults(func=signtx)
 
diff --git a/test/functional/rpc_psbt.py b/test/functional/rpc_psbt.py
index 23273d54b56f..40e89bf23df6 100755
--- a/test/functional/rpc_psbt.py
+++ b/test/functional/rpc_psbt.py
@@ -557,6 +557,42 @@ def test_sighash_adding(self):
 
         wallet.unloadwallet()
 
+    def test_combinepsbt_sighash_type(self):
+        self.log.info("Test that combining PSBTs preserves the sighash type field regardless of order")
+        node = self.nodes[0]
+        node.createwallet("combine_sighash")
+        wallet = node.get_wallet_rpc("combine_sighash")
+        def_wallet = node.get_wallet_rpc(self.default_wallet_name)
+
+        def_wallet.send([{wallet.getnewaddress(address_type="bech32"): 1}])
+        self.generate(node, 1)
+        psbt = wallet.walletcreatefundedpsbt(wallet.listunspent(), [{def_wallet.getnewaddress(): 0.5}])["psbt"]
+
+        signed = wallet.walletprocesspsbt(psbt=psbt, sighashtype="ALL|ANYONECANPAY", finalize=False)["psbt"]
+        assert_equal(node.decodepsbt(signed)["inputs"][0].get("sighash"), "ALL|ANYONECANPAY")
+        updated = wallet.walletprocesspsbt(psbt=psbt, sign=False)["psbt"]
+        assert "sighash" not in node.decodepsbt(updated)["inputs"][0]
+
+        finalized = []
+        for psbts in [[signed, updated], [updated, signed]]:
+            combined = node.combinepsbt(psbts)
+            assert_equal(node.decodepsbt(combined)["inputs"][0].get("sighash"), "ALL|ANYONECANPAY")
+            fin_res = node.finalizepsbt(combined)
+            assert_equal(fin_res["complete"], True)
+            assert_equal(node.testmempoolaccept([fin_res["hex"]])[0]["allowed"], True)
+            finalized.append(fin_res["hex"])
+        assert_equal(finalized[0], finalized[1])
+
+        wallet.unloadwallet()
+
+    def test_decodepsbt_long_sighash_type(self):
+        self.log.info("Test that decodepsbt rejects invalid trailing bytes in the sighash type field")
+        node = self.nodes[0]
+        psbt = PSBT.from_base64(node.createpsbt([{"txid": "00" * 32, "vout": 0}], [{"data": "00"}]))
+        # The first byte of this sighash type is ALL, but the type itself is not
+        psbt.i[0].map[PSBT_IN_SIGHASH_TYPE] = (0x101).to_bytes(4, "little")
+        assert_equal(node.decodepsbt(psbt.to_base64())["inputs"][0]["sighash"], "")
+
     def assert_change_type(self, psbtx, expected_type):
         """Assert that the given PSBT has a change output with the given type."""
 
@@ -1613,12 +1649,83 @@ def global_xpub_key(extended_pubkey):
         # Broadcast transaction
         self.nodes[2].sendrawtransaction(processed_psbt['hex'])
 
+        self.log.info("Test descriptorprocesspsbt keypath_only skips taproot script path signing")
+        taproot_key = get_generate_key()
+        taproot_descriptor = descsum_create(f"tr({H_POINT},pk({taproot_key.privkey}))")
+        taproot_public_descriptor = descsum_create(f"tr({H_POINT},pk({taproot_key.pubkey}))")
+        taproot_address = self.nodes[2].deriveaddresses(taproot_descriptor)[0]
+        taproot_utxo = self.create_outpoints(self.nodes[0], outputs=[{taproot_address: 1}])[0]
+        self.sync_all()
+
+        taproot_psbt = self.nodes[2].createpsbt([taproot_utxo], {self.nodes[0].getnewaddress(): 0.99999})
+        keypath_only_psbt = self.nodes[2].descriptorprocesspsbt(
+            psbt=taproot_psbt,
+            descriptors=[taproot_descriptor],
+            finalize=False,
+            keypath_only=True,
+        )
+        decoded = self.nodes[2].decodepsbt(keypath_only_psbt["psbt"])
+        assert "taproot_scripts" not in decoded["inputs"][0]
+        assert "taproot_key_path_sig" not in decoded["inputs"][0]
+        assert "taproot_script_path_sigs" not in decoded["inputs"][0]
+
+        prepopulated_psbt = self.nodes[2].descriptorprocesspsbt(
+            psbt=taproot_psbt,
+            descriptors=[taproot_public_descriptor],
+            finalize=False,
+        )
+        decoded = self.nodes[2].decodepsbt(prepopulated_psbt["psbt"])
+        assert "taproot_scripts" in decoded["inputs"][0]
+        assert "taproot_script_path_sigs" not in decoded["inputs"][0]
+
+        keypath_only_prepopulated_psbt = self.nodes[2].descriptorprocesspsbt(
+            psbt=prepopulated_psbt["psbt"],
+            descriptors=[taproot_descriptor],
+            finalize=False,
+            keypath_only=True,
+        )
+        decoded = self.nodes[2].decodepsbt(keypath_only_prepopulated_psbt["psbt"])
+        assert "taproot_scripts" in decoded["inputs"][0]
+        assert "taproot_key_path_sig" not in decoded["inputs"][0]
+        assert "taproot_script_path_sigs" not in decoded["inputs"][0]
+
+        signed_psbt = self.nodes[2].descriptorprocesspsbt(
+            psbt=taproot_psbt,
+            descriptors=[taproot_descriptor],
+            finalize=False,
+            keypath_only=False,
+        )
+        decoded = self.nodes[2].decodepsbt(signed_psbt["psbt"])
+        assert "taproot_script_path_sigs" in decoded["inputs"][0]
+
+        # Do not finalize an existing script-path signature when keypath_only is
+        # requested, since that would produce a broadcastable script-path spend.
+        keypath_only_signed_psbt = self.nodes[2].descriptorprocesspsbt(
+            psbt=signed_psbt["psbt"],
+            descriptors=[taproot_descriptor],
+            finalize=True,
+            keypath_only=True,
+        )
+        assert_equal(keypath_only_signed_psbt["complete"], False)
+        decoded = self.nodes[2].decodepsbt(keypath_only_signed_psbt["psbt"])
+        assert "taproot_script_path_sigs" in decoded["inputs"][0]
+        assert "final_scriptwitness" not in decoded["inputs"][0]
+
+        # The standalone finalizer has no key-path-only policy and can explicitly
+        # finalize the otherwise unchanged script-path signature.
+        finalized = self.nodes[2].finalizepsbt(keypath_only_signed_psbt["psbt"])
+        assert_equal(finalized["complete"], True)
+        rawtx = finalized["hex"]
+        assert self.nodes[2].testmempoolaccept([rawtx])[0]["allowed"]
+
         self.log.info("Test descriptorprocesspsbt raises if an invalid sighashtype is passed")
         assert_raises_rpc_error(-8, "'all' is not a valid sighash parameter.", self.nodes[2].descriptorprocesspsbt, psbt=psbt, descriptors=[descriptor], sighashtype="all")
 
         if not self.options.usecli:
             self.test_sighash_mismatch()
         self.test_sighash_adding()
+        self.test_combinepsbt_sighash_type()
+        self.test_decodepsbt_long_sighash_type()
         self.test_psbt_named_parameter_handling()
         self.test_psbt_roundtrip()
         self.test_psbt_version()
diff --git a/test/functional/rpc_signer.py b/test/functional/rpc_signer.py
index 6d51182c6bf2..fbec9597f183 100755
--- a/test/functional/rpc_signer.py
+++ b/test/functional/rpc_signer.py
@@ -9,7 +9,6 @@
 """
 import os
 import platform
-import sys
 
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.util import (
@@ -19,10 +18,6 @@
 
 
 class RPCSignerTest(BitcoinTestFramework):
-    def mock_signer_path(self):
-        path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'mocks', 'signer.py')
-        return sys.executable + " " + path
-
     def set_test_params(self):
         self.num_nodes = 4
 
diff --git a/test/functional/test_framework/test_framework.py b/test/functional/test_framework/test_framework.py
index 87317c3eeff0..968253d53b7c 100755
--- a/test/functional/test_framework/test_framework.py
+++ b/test/functional/test_framework/test_framework.py
@@ -1117,6 +1117,11 @@ def skip_if_no_external_signer(self):
         if not self.is_external_signer_compiled():
             raise SkipTest("external signer support has not been compiled.")
 
+    def mock_signer_path(self, name='signer.py'):
+        """Return a command that invokes a mock external signer script under test/functional/mocks/."""
+        path = os.path.join(os.path.dirname(os.path.realpath(__file__)), '..', 'mocks', name)
+        return sys.executable + " " + os.path.realpath(path)
+
     def skip_if_running_under_valgrind(self):
         """Skip the running test if Valgrind is being used."""
         if self.options.valgrind:
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 89c4b8f4ee06..dcfd0ad32d1f 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -160,6 +160,7 @@
     'p2p_timeouts.py --v2transport',
     'rpc_signer.py',
     'wallet_signer.py',
+    'wallet_signer_musig2.py',
     'mempool_limit.py',
     'rpc_txoutproof.py',
     'rpc_orphans.py',
diff --git a/test/functional/wallet_avoidreuse.py b/test/functional/wallet_avoidreuse.py
index 80d67683680b..bd564904d1d2 100755
--- a/test/functional/wallet_avoidreuse.py
+++ b/test/functional/wallet_avoidreuse.py
@@ -139,6 +139,9 @@ def test_immutable(self):
         # Attempt to set the disable_private_keys flag; this should not work
         assert_raises_rpc_error(-8, "Wallet flag is immutable", self.nodes[1].setwalletflag, 'disable_private_keys')
 
+        if not self.is_external_signer_compiled():
+            assert_raises_rpc_error(-4, "Compiled without external signing support", self.nodes[1].setwalletflag, "external_signer")
+
         tempwallet = ".wallet_avoidreuse.py_test_immutable_wallet.dat"
 
         # Create a wallet with disable_private_keys set; this should work
diff --git a/test/functional/wallet_backwards_compatibility.py b/test/functional/wallet_backwards_compatibility.py
index a5224546300f..2f13c050032e 100755
--- a/test/functional/wallet_backwards_compatibility.py
+++ b/test/functional/wallet_backwards_compatibility.py
@@ -305,6 +305,14 @@ def run_test(self):
         self.sync_mempools()
         # Abandon transaction, but don't confirm
         node_master.abandontransaction(tx3_id)
+        # Import a multipath descriptor, so that w1 contains a multipath
+        # descriptor record tying the expanded receive and change descriptors
+        # together. Older versions must ignore the record.
+        multipath_xprv = ExtendedPrivateKey.generate()
+        multipath_desc = descsum_create(f"wpkh({multipath_xprv.to_string()}/<0;1>/*)")
+        # The record stores the public form
+        multipath_pub_desc = descsum_create(f"wpkh({multipath_xprv.pubkey().to_string()}/<0;1>/*)")
+        assert_equal(wallet.importdescriptors([{"desc": multipath_desc, "timestamp": "now"}])[0]["success"], True)
 
         # w2: wallet with private keys disabled, created on master: update this
         #     test when default wallets private keys disabled can no longer be
@@ -365,6 +373,15 @@ def run_test(self):
                         assert_equal(txs[4]["walletconflicts"], [tx3_id])
                         assert_equal(txs[3]["replaced_by_txid"], tx4_id)
                         assert not hasattr(txs[3], "blockindex")
+                        if n == node_master:
+                            # The multipath descriptor records, one for the
+                            # imported multipath descriptor and one per default
+                            # descriptor pair, survive the round trip through
+                            # the older version
+                            multipaths = [d.get("multipath") for d in wallet.listdescriptors()["descriptors"]]
+                            assert_equal(multipaths.count(multipath_pub_desc), 2)
+                            assert_equal(multipaths.count(None), 0)
+                            assert_equal(len(set(multipaths)), 5)
                     elif wallet_name == "w2":
                         assert_equal(info['private_keys_enabled'], False)
                         assert_equal(info['keypoolsize'], 0)
diff --git a/test/functional/wallet_createwalletdescriptor.py b/test/functional/wallet_createwalletdescriptor.py
index b1d411322812..56bf4c5848e0 100755
--- a/test/functional/wallet_createwalletdescriptor.py
+++ b/test/functional/wallet_createwalletdescriptor.py
@@ -5,6 +5,7 @@
 """Test wallet createwalletdescriptor RPC."""
 
 from test_framework.descriptors import descsum_create
+from test_framework.extendedkey import ExtendedPrivateKey
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.util import (
     assert_equal,
@@ -25,6 +26,8 @@ def run_test(self):
         self.test_basic()
         self.test_imported_other_keys()
         self.test_encrypted()
+        self.test_from_unused_desc()
+        self.test_multipath()
 
     def test_basic(self):
         def_wallet = self.nodes[0].get_wallet_rpc(self.default_wallet_name)
@@ -39,7 +42,7 @@ def test_basic(self):
             if desc["desc"].startswith("wpkh("):
                 expected_descs.append(desc["desc"])
 
-        assert_raises_rpc_error(-5, "Unable to determine which HD key to use from active descriptors. Please specify with 'hdkey'", wallet.createwalletdescriptor, "bech32")
+        assert_raises_rpc_error(-5, "No HD key found. Please generate one with 'addhdkey' or import an active descriptor.", wallet.createwalletdescriptor, "bech32")
         assert_raises_rpc_error(-5, f"Private key for {xpub} is not known", wallet.createwalletdescriptor, type="bech32", hdkey=xpub)
 
         self.log.info("Test createwalletdescriptor after importing active descriptor to blank wallet")
@@ -114,6 +117,48 @@ def test_encrypted(self):
         with WalletUnlock(wallet, "pass"):
             wallet.createwalletdescriptor(type="bech32m")
 
+    def test_from_unused_desc(self):
+        self.log.info("Test createwalletdescriptor from only an unused(KEY) descriptor")
+        self.nodes[0].createwallet("w1", blank=True)
+        w1 = self.nodes[0].get_wallet_rpc("w1")
+
+        # Wallet can't be completely empty
+        assert_raises_rpc_error(-5, "No HD key found. Please generate one with 'addhdkey' or import an active descriptor.", w1.createwalletdescriptor, "bech32")
+
+        # Create unused(KEY) descriptor and try again
+        w1.addhdkey()
+        w1.createwalletdescriptor(type="bech32")
+
+        self.nodes[0].createwallet("w2", blank=True)
+        w2 = self.nodes[0].get_wallet_rpc("w2")
+
+        # Multiple unused(KEY) descriptors require user to choose
+        w2.addhdkey()
+        w2.addhdkey()
+
+        assert_raises_rpc_error(-5, "Unable to determine which HD key to use. Please specify with 'hdkey'", w2.createwalletdescriptor, "bech32")
+
+    def test_multipath(self):
+        self.log.info("Test createwalletdescriptor stores a multipath record for the new descriptor pair")
+        self.nodes[0].createwallet(wallet_name="multipath")
+        wallet = self.nodes[0].get_wallet_rpc("multipath")
+
+        def import_unused_key():
+            known_xpubs = {key["xpub"] for key in wallet.gethdkeys()}
+            res = wallet.importdescriptors([{"desc": descsum_create(f"unused({ExtendedPrivateKey.generate().to_string()})"), "timestamp": "now"}])
+            assert_equal(res[0]["success"], True)
+            return next(key["xpub"] for key in wallet.gethdkeys() if key["xpub"] not in known_xpubs)
+
+        # With the internal option, a single path descriptor is created; the
+        # record is stored by the call that completes the pair
+        single_xpub = import_unused_key()
+        receive_descs = wallet.createwalletdescriptor(type="bech32", internal=False, hdkey=single_xpub)["descs"]
+        receive_entry = next(entry for entry in wallet.listdescriptors()["descriptors"] if entry["desc"] in receive_descs)
+        assert "multipath" not in receive_entry
+        change_descs = wallet.createwalletdescriptor(type="bech32", internal=True, hdkey=single_xpub)["descs"]
+        pair_entries = [entry for entry in wallet.listdescriptors()["descriptors"] if entry["desc"] in receive_descs + change_descs]
+        assert_equal(len(pair_entries), 2)
+        assert_equal(len({entry["multipath"] for entry in pair_entries}), 1)
 
 
 if __name__ == '__main__':
diff --git a/test/functional/wallet_descriptor.py b/test/functional/wallet_descriptor.py
index c3597011230c..e7aebb54e270 100755
--- a/test/functional/wallet_descriptor.py
+++ b/test/functional/wallet_descriptor.py
@@ -34,6 +34,40 @@ def skip_test_if_missing_module(self):
         self.skip_if_no_wallet()
         self.skip_if_no_py_sqlite3()
 
+    def test_multipath_descriptor(self):
+        self.log.info("Check that getaddressinfo and listdescriptors report the multipath descriptor")
+        self.nodes[0].createwallet(wallet_name="multipath", blank=True)
+        wallet = self.nodes[0].get_wallet_rpc("multipath")
+
+        xprv = ExtendedPrivateKey.generate()
+        desc = descsum_create(f"wpkh({xprv.to_string()}/84h/1h/0h/<0;1>/*)")
+        assert_equal(wallet.importdescriptors([{"desc": desc, "timestamp": "now", "active": True, "range": [0, 10]}])[0]["success"], True)
+
+        # The multipath descriptor is reported in normalized public form
+        account_xpub = xprv.derive_path("m/84h/1h/0h").pubkey().to_string()
+        pub_desc = descsum_create(f"wpkh([{xprv._fingerprint().hex()}/84h/1h/0h]{account_xpub}/<0;1>/*)")
+
+        # Both the receive and change address report the multipath descriptor,
+        # while their parent descriptors are the single path ones
+        for addr in [wallet.getnewaddress(), wallet.getrawchangeaddress()]:
+            info = wallet.getaddressinfo(addr)
+            assert_equal(info["multipath"], pub_desc)
+            assert_not_equal(info["parent_desc"], pub_desc)
+
+        # listdescriptors reports it for both expanded descriptors, in public
+        # form even when the private descriptors are listed
+        for private in [False, True]:
+            descriptors = wallet.listdescriptors(private)["descriptors"]
+            assert_equal(len(descriptors), 2)
+            for entry in descriptors:
+                assert_equal(entry["multipath"], pub_desc)
+
+        # The record survives a wallet reload
+        wallet.unloadwallet()
+        self.nodes[0].loadwallet("multipath")
+        for entry in wallet.listdescriptors()["descriptors"]:
+            assert_equal(entry["multipath"], pub_desc)
+
     def test_parent_descriptors(self):
         self.log.info("Check that parent_descs is the same for all RPCs and is normalized")
         self.nodes[0].createwallet(wallet_name="parent_descs")
@@ -291,6 +325,7 @@ def run_test(self):
             assert_raises_rpc_error(-4, "Wallet corrupted", self.nodes[0].loadwallet, wallet_name)
 
         self.test_parent_descriptors()
+        self.test_multipath_descriptor()
 
 if __name__ == '__main__':
     WalletDescriptorTest(__file__).main()
diff --git a/test/functional/wallet_exported_watchonly.py b/test/functional/wallet_exported_watchonly.py
index e08f7bb86a62..4494c97ef4f1 100755
--- a/test/functional/wallet_exported_watchonly.py
+++ b/test/functional/wallet_exported_watchonly.py
@@ -59,6 +59,10 @@ def test_basic_export(self):
         assert_equal(addr, online_wallet2.getnewaddress())
         assert_equal(offline_wallet.listdescriptors()["descriptors"], online_wallet.listdescriptors()["descriptors"])
         assert_equal(offline_wallet.listdescriptors()["descriptors"], online_wallet2.listdescriptors()["descriptors"])
+        # The multipath records are exported too; the equality checks above
+        # ensure they match the originals
+        for entry in online_wallet.listdescriptors()["descriptors"]:
+            assert "multipath" in entry
 
         # Verify that online wallet cannot spend, but offline can
         self.funder.sendtoaddress(online_wallet.getnewaddress(), 10)
@@ -175,6 +179,8 @@ def test_export_imported_descriptors(self):
                 {"desc": descsum_create(f"tr({H_POINT},{{pk(tpubD6NzVbkrYhZ4WaWSyoBvQwbpLkojyoTZPRsgXELWz3Popb3qkjcJyJUGLnL4qHHoQvao8ESaAstxYSnhyswJ76uZPStJRJCTKvosUCJZL5B/*),pk(tprv8ZgxMBicQKsPeuVhWwi6wuMQGfPKi9Li5GtX35jVNknACgqe3CY4g5xgkfDDJcmtF7o1QnxWDRYw4H5P26PXq7sbcUkEqeR4fg3Kxp2tigg/0h/*)}})"), "timestamp": "now", "active": True},
                 # miniscript
                 {"desc": descsum_create(f"tr({H_POINT},or_b(pk(tpubD6NzVbkrYhZ4WaWSyoBvQwbpLkojyoTZPRsgXELWz3Popb3qkjcJyJUGLnL4qHHoQvao8ESaAstxYSnhyswJ76uZPStJRJCTKvosUCJZL5B/1/2/*),s:pk(tprv8ZgxMBicQKsPeuVhWwi6wuMQGfPKi9Li5GtX35jVNknACgqe3CY4g5xgkfDDJcmtF7o1QnxWDRYw4H5P26PXq7sbcUkEqeR4fg3Kxp2tigg/1h/2/*)))"), "timestamp": "now", "active": True, "internal": True},
+                # multipath, with hardened derivation so the exported descriptors get a different ID
+                {"desc": descsum_create("wpkh(tprv8ZgxMBicQKsPeuVhWwi6wuMQGfPKi9Li5GtX35jVNknACgqe3CY4g5xgkfDDJcmtF7o1QnxWDRYw4H5P26PXq7sbcUkEqeR4fg3Kxp2tigg/84h/2h/0h/<0;1>/*)"), "timestamp": "now"},
             ]
         )
         assert_equal(all([r["success"] for r in import_res]), True)
@@ -182,8 +188,9 @@ def test_export_imported_descriptors(self):
         # Export the watchonly wallet file and load onto online node
         online_wallet = self.export_and_restore(offline_wallet, "imports_watchonly")
 
-        # Verify public descriptors are the same
+        # Verify public descriptors are the same, including the multipath record
         assert_equal(offline_wallet.listdescriptors()["descriptors"], online_wallet.listdescriptors()["descriptors"])
+        assert any("/84h/2h/0h]" in desc.get("multipath", "") for desc in online_wallet.listdescriptors()["descriptors"])
 
         # Verify all the addresses are the same
         for address_type in ["legacy", "p2sh-segwit", "bech32", "bech32m"]:
diff --git a/test/functional/wallet_fundrawtransaction.py b/test/functional/wallet_fundrawtransaction.py
index a35b2c80cdd0..93525b425e53 100755
--- a/test/functional/wallet_fundrawtransaction.py
+++ b/test/functional/wallet_fundrawtransaction.py
@@ -294,8 +294,10 @@ def test_invalid_option(self):
         dec_tx  = self.nodes[2].decoderawtransaction(rawtx)
         assert_equal(utx['txid'], dec_tx['vin'][0]['txid'])
 
+        assert "keypath_only" not in self.nodes[2].help("fundrawtransaction")
         assert_raises_rpc_error(-8, "Unknown named parameter foo", self.nodes[2].fundrawtransaction, rawtx, foo='bar')
         assert_raises_rpc_error(-3, "JSON value of type bool is not of expected type object", self.nodes[2].fundrawtransaction, rawtx, True)
+        assert_raises_rpc_error(-3, "Unexpected key keypath_only", self.nodes[2].fundrawtransaction, rawtx, {"keypath_only": True})
 
         # reserveChangeKey was deprecated and is now removed
         assert_raises_rpc_error(-8, "Unknown named parameter reserveChangeKey", lambda: self.nodes[2].fundrawtransaction(hexstring=rawtx, reserveChangeKey=True))
diff --git a/test/functional/wallet_hd.py b/test/functional/wallet_hd.py
index e5227e6f496f..f4350457d0e5 100755
--- a/test/functional/wallet_hd.py
+++ b/test/functional/wallet_hd.py
@@ -34,6 +34,8 @@ def test_addhdkey(self):
         wallet = self.nodes[0].get_wallet_rpc("hdkey")
 
         assert_equal(len(wallet.gethdkeys()), 1)
+        existing_wallet_xprv = wallet.gethdkeys(private=True)[0]["xprv"]
+        assert_raises_rpc_error(-4, "HD key already exists", wallet.addhdkey, existing_wallet_xprv)
 
         wallet.addhdkey()
         xpub_info = wallet.gethdkeys()
diff --git a/test/functional/wallet_importdescriptors.py b/test/functional/wallet_importdescriptors.py
index 78378e59c25b..2f3e4b107d01 100755
--- a/test/functional/wallet_importdescriptors.py
+++ b/test/functional/wallet_importdescriptors.py
@@ -19,7 +19,7 @@
 import threading
 import time
 
-from test_framework.address import key_to_p2sh_p2wpkh, key_to_p2wpkh, script_to_p2wsh
+from test_framework.address import base58_to_byte, key_to_p2sh_p2wpkh, key_to_p2wpkh, script_to_p2wsh
 from test_framework.blocktools import COINBASE_MATURITY
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.descriptors import descsum_create
@@ -52,7 +52,7 @@ def set_test_params(self):
     def skip_test_if_missing_module(self):
         self.skip_if_no_wallet()
 
-    def test_importdesc(self, req, success, global_error=False, error_code=None, error_message=None, warnings=None, wallet=None):
+    def test_importdesc(self, req, success, global_error=False, error_code=None, error_message=None, warnings=None, wallet=None, expected_priv=None):
         """Run importdescriptors and assert success"""
         if warnings is None:
             warnings = []
@@ -79,6 +79,14 @@ def test_importdesc(self, req, success, global_error=False, error_code=None, err
             assert_equal(result[0]['error']['code'], error_code)
             assert_equal(result[0]['error']['message'], error_message)
 
+        if expected_priv is not None:
+            priv_descs = wrpc.listdescriptors(True)
+            for desc in priv_descs["descriptors"]:
+                if desc["desc"] == expected_priv:
+                    break
+            else:
+                assert False, "Expected private descriptor was not found in the wallet"
+
     def test_import_unused_key(self):
         self.log.info("Test import of unused(KEY)")
         self.nodes[0].createwallet(wallet_name="import_unused", blank=True)
@@ -286,6 +294,61 @@ def test_musig_private_key_warnings(self, xprv1, acc_xprv2, acc_xpub2, derivatio
         assert_equal(res[3]["success"], True)
         assert_equal(res[3]["warnings"], [MISSING_KEYS_WARNING])
 
+    def test_import_noprivs(self):
+        self.log.info("Test import of descriptors without private keys that the wallet has the privkeys for")
+        self.nodes[0].createwallet(wallet_name="import_noprivs")
+        wallet = self.nodes[0].get_wallet_rpc("import_noprivs")
+        hdkeys = wallet.gethdkeys(private=True)
+        xpub = hdkeys[0]["xpub"]
+        xprv = hdkeys[0]["xprv"]
+        for desc in hdkeys[0]["descriptors"]:
+            if desc["desc"].startswith("pkh(") and "44h/1h/0h" in desc["desc"]:
+                derived_xpub = desc["desc"][4:-14]
+
+        # xpub substitution
+        self.test_importdesc({"timestamp": "now", "desc": descsum_create(f"tr({xpub}/1/2/3)")},
+                             success=True,
+                             wallet=wallet,
+                             expected_priv=descsum_create(f"tr({xprv}/1/2/3)"))
+        self.test_importdesc({"timestamp": "now", "desc": descsum_create(f"tr({derived_xpub}/4/5/6)")},
+                             success=True,
+                             wallet=wallet,
+                             expected_priv=descsum_create(f"tr({xprv}/44h/1h/0h/4/5/6)"))
+
+        # At various descriptor depths, alongside keys the wallet does not know
+        key = get_generate_key()
+        other_key = get_generate_key()
+        pub_desc = descsum_create(f"tr({other_key.pubkey},{{multi_a(2,{xpub}/5/4/3/*,{derived_xpub}/1h/2h/*),{{pk({xpub}/3h/4h/*),multi_a(2,{key.pubkey},{derived_xpub}/5/6)}}}})")
+        priv_desc = descsum_create(f"tr({other_key.pubkey},{{multi_a(2,{xprv}/5/4/3/*,{xprv}/44h/1h/0h/1h/2h/*),{{pk({xprv}/3h/4h/*),multi_a(2,{key.pubkey},{xprv}/44h/1h/0h/5/6)}}}})")
+        self.test_importdesc({"timestamp": "now", "desc": pub_desc, "range": [0, 100]},
+                             success=True,
+                             warnings=["Not all private keys provided. Some wallet functionality may return unexpected errors"],
+                             wallet=wallet,
+                             expected_priv=priv_desc)
+
+        pub_desc = descsum_create(f"tr({other_key.pubkey},pk(musig({xpub},{derived_xpub})/1/2/*))")
+        priv_desc = descsum_create(f"tr({other_key.pubkey},pk(musig({xprv},{xprv}/44h/1h/0h)/1/2/*))")
+        self.test_importdesc({"timestamp": "now", "desc": pub_desc, "range": [0, 100]},
+                             success=True,
+                             warnings=["Not all private keys provided. Some wallet functionality may return unexpected errors"],
+                             wallet=wallet,
+                             expected_priv=priv_desc)
+
+        # Multipath
+        self.test_importdesc({"timestamp": "now", "desc": descsum_create(f"wpkh({derived_xpub}/<0;1>/*)"), "range": [0, 100]},
+                             success=True,
+                             wallet=wallet,
+                             expected_priv=descsum_create(f"wpkh({xprv}/44h/1h/0h/0/*)"))
+
+        self.log.info("Test that a descriptor with an individual pubkey whose privkey is in an xprv fails to import (key substitution fails)")
+        xpub_bytes = base58_to_byte(xpub)[0]
+        xpub_pub = xpub_bytes[-33:].hex()
+        self.test_importdesc({"timestamp": "now", "desc": descsum_create(f"tr({xpub_pub})")},
+                             success=False,
+                             error_code=-4,
+                             error_message="Cannot import descriptor without private keys to a wallet with private keys enabled",
+                             wallet=wallet)
+
     def run_test(self):
         self.log.info('Setting up wallets')
         self.nodes[0].createwallet(wallet_name='w0', disable_private_keys=False)
@@ -1068,7 +1131,45 @@ def run_test(self):
         for _ in range(0, 10):
             assert_equal(w_multipath.getnewaddress(address_type="bech32"), w_multisplit.getnewaddress(address_type="bech32"))
             assert_equal(w_multipath.getrawchangeaddress(address_type="bech32"), w_multisplit.getrawchangeaddress(address_type="bech32"))
-        assert_equal(sorted(w_multipath.listdescriptors()["descriptors"], key=lambda x: x["desc"]), sorted(w_multisplit.listdescriptors()["descriptors"], key=lambda x: x["desc"]))
+        multipath_descs = sorted(w_multipath.listdescriptors()["descriptors"], key=lambda x: x["desc"])
+        multisplit_descs = sorted(w_multisplit.listdescriptors()["descriptors"], key=lambda x: x["desc"])
+        # The multipath_split wallet does not have a multipath field
+        assert all("multipath" not in desc for desc in multisplit_descs)
+        for desc in multipath_descs:
+            desc.pop("multipath")
+        assert_equal(multipath_descs, multisplit_descs)
+
+        self.log.info("Re-importing existing descriptors as a multipath descriptor adds the multipath record")
+        self.test_importdesc({"desc": descsum_create(f"wpkh({xpriv}/<10;20>/0/*)"),
+                              "active": True,
+                              # The existing descriptors were topped up beyond
+                              # the original import range
+                              "range": 999,
+                              "timestamp": timestamp},
+                              success=True,
+                              wallet=w_multisplit)
+        # The re-import added the multipath record to both entries
+        assert_equal([d.get("multipath") for d in w_multisplit.listdescriptors()["descriptors"]],
+                     [descsum_create(f"wpkh({extended_key.pubkey().to_string()}/<10;20>/0/*)")] * 2)
+
+        self.log.info("A multipath descriptor overlapping a different multipath descriptor cannot be imported")
+        stored_multipath = descsum_create(f"wpkh({extended_key.pubkey().to_string()}/<10;20>/0/*)")
+        self.test_importdesc({"desc": descsum_create(f"wpkh({xpriv}/<10;30>/0/*)"),
+                              "range": 999,
+                              "timestamp": timestamp},
+                              success=False,
+                              error_code=-4,
+                              error_message=f"A descriptor expanded from this multipath descriptor is already part of the multipath descriptor '{stored_multipath}'",
+                              wallet=w_multipath)
+
+        self.log.info("Multipath records can reference more than two wallet descriptors")
+        three_path_multipath = descsum_create(f"wpkh({extended_key.pubkey().to_string()}/<30;40;50>/0/*)")
+        self.test_importdesc({"desc": descsum_create(f"wpkh({xpriv}/<30;40;50>/0/*)"),
+                              "range": 10,
+                              "timestamp": timestamp},
+                              success=True,
+                              wallet=w_multipath)
+        assert_equal(sum(d.get("multipath") == three_path_multipath for d in w_multipath.listdescriptors()["descriptors"]), 3)
 
         self.log.info("Test older() safety")
 
@@ -1110,6 +1211,7 @@ def run_test(self):
         self.test_import_unused_noprivs()
         self.test_per_item_errors_are_reported_in_order()
         self.test_rescan_fails_import()
+        self.test_import_noprivs()
 
 if __name__ == '__main__':
     ImportDescriptorsTest(__file__).main()
diff --git a/test/functional/wallet_listdescriptors.py b/test/functional/wallet_listdescriptors.py
index 945f729585d5..dde22c59d10c 100755
--- a/test/functional/wallet_listdescriptors.py
+++ b/test/functional/wallet_listdescriptors.py
@@ -56,6 +56,17 @@ def run_test(self):
         descriptor_strings = [descriptor['desc'] for descriptor in result['descriptors']]
         assert_equal(descriptor_strings, sorted(descriptor_strings))
 
+        self.log.info('Test the multipath field of a default descriptors wallet.')
+        for private in [False, True]:
+            multipaths = set()
+            for entry in node.get_wallet_rpc('w3').listdescriptors(private)['descriptors']:
+                assert '<0;1>' in entry['multipath']
+                assert 'tprv' not in entry['multipath']
+                multipaths.add(entry['multipath'])
+            # The receive and change descriptor of each output type share one
+            # multipath descriptor
+            assert_equal(len(multipaths), 4)
+
         self.log.info('Test descriptors with hardened derivations are listed in importable form.')
         extended_key = ExtendedPrivateKey.generate()
         xprv = extended_key.to_string()
diff --git a/test/functional/wallet_musig.py b/test/functional/wallet_musig.py
index e23c9496154e..dd2d7329e7a0 100755
--- a/test/functional/wallet_musig.py
+++ b/test/functional/wallet_musig.py
@@ -194,7 +194,16 @@ def test_failure_case_3(self, comment, pat):
         assert "musig2_pubnonces" in dec["inputs"][0]
         assert "musig2_partial_sigs" not in dec["inputs"][0]
 
-    def test_success_case(self, comment, pattern, sighash_type=None, scriptpath=False, nosign_wallets=None, only_one_musig_wallet=False):
+    def test_success_case(
+        self,
+        comment,
+        pattern,
+        sighash_type=None,
+        scriptpath=False,
+        keypath_only=False,
+        nosign_wallets=None,
+        only_one_musig_wallet=False,
+    ):
         self.log.info(f"Testing {comment}")
         has_internal = MULTIPATH_TWO_RE.search(pattern) is not None
 
@@ -221,6 +230,9 @@ def test_success_case(self, comment, pattern, sighash_type=None, scriptpath=Fals
                     continue
             if musig_partial_sigs is not None:
                 expected_partial_sigs += musig_partial_sigs
+            if keypath_only:
+                # The first MuSig aggregate is the key path, so do not count script-path MuSigs.
+                break
 
         # Check that the wallets agree on the same musig address
         addr = None
@@ -289,7 +301,7 @@ def test_success_case(self, comment, pattern, sighash_type=None, scriptpath=Fals
             if nosign_wallets and i in nosign_wallets:
                 continue
             for psbt_list in [nonce_psbts, nonce_psbts2]:
-                proc = wallet.walletprocesspsbt(psbt=psbt, sighashtype=sighash_type)
+                proc = wallet.walletprocesspsbt(psbt=psbt, sighashtype=sighash_type, keypath_only=keypath_only)
                 assert_equal(proc["complete"], False)
                 psbt_list.append(proc["psbt"])
 
@@ -310,7 +322,7 @@ def test_success_case(self, comment, pattern, sighash_type=None, scriptpath=Fals
             if nosign_wallets and i in nosign_wallets:
                 continue
             for psbt, psbt_list in [(comb_nonce_psbt, psig_psbts), (comb_nonce_psbt2, psig_psbts2)]:
-                proc = wallet.walletprocesspsbt(psbt=psbt, sighashtype=sighash_type)
+                proc = wallet.walletprocesspsbt(psbt=psbt, sighashtype=sighash_type, keypath_only=keypath_only)
                 assert_equal(proc["complete"], False)
                 psbt_list.append(proc["psbt"])
 
@@ -355,8 +367,23 @@ def run_test(self):
         self.test_success_case("tr(H,{pk(musig/*), pk(musig/*)})", "tr($H,{pk(musig($0,$1,$2)/<0;1>/*),pk(musig($3,$4,$5)/0/*)})", scriptpath=True)
         self.test_success_case("tr(H,{pk(musig/*), pk(same keys different musig/*)})", "tr($H,{pk(musig($0,$1,$2)/<0;1>/*),pk(musig($1,$2)/0/*)})", scriptpath=True)
         self.test_success_case("tr(H,and(pk(musig/*),pk(same musig, other derivation/*)))", "tr($H,and_v(v:pk(musig($0,$1,$2)/<0;1>/*),pk(musig($0,$1,$2)/<2;3>/*)))", scriptpath=True)
-        self.test_success_case("tr(musig/*,{pk(partial keys diff musig-1/*),pk(partial keys diff musig-2/*)})}", "tr(musig($0,$1,$2)/<3;4>/*,{pk(musig($0,$1)/<5;6>/*),pk(musig($1,$2)/7/*)})")
-        self.test_success_case("tr(musig/*,{pk(partial keys diff musig-1/*),pk(partial keys diff musig-2/*)})} script-path", "tr(musig($0,$1,$2)/<3;4>/*,{pk(musig($0,$1)/<5;6>/*),pk(musig($1,$2)/7/*)})", scriptpath=True, nosign_wallets=[0])
+        # Descriptor with one MuSig key path and two MuSig script paths.
+        key_and_script_path_musigs = "tr(musig($0,$1,$2)/<3;4>/*,{pk(musig($0,$1)/<5;6>/*),pk(musig($1,$2)/7/*)})"
+        self.test_success_case(
+            "tr() with MuSig key path and different MuSig script paths",
+            key_and_script_path_musigs,
+        )
+        self.test_success_case(
+            "tr() with MuSig script path when key path cannot sign",
+            key_and_script_path_musigs,
+            scriptpath=True,
+            nosign_wallets=[0],
+        )
+        self.test_success_case(
+            "tr() with MuSig key path and keypath_only",
+            key_and_script_path_musigs,
+            keypath_only=True,
+        )
         self.test_success_case("tr(H,and(pk(musig/*),after(1)))", "tr($H,and_v(v:pk(musig($0,$1,$2)/<0;1>/*),after(1)))", scriptpath=True)
         self.test_success_case("tr(H,and(pk_k(musig/*),after(1)))", "tr($H,and_v(vc:pk_k(musig($0,$1,$2)/<0;1>/*),after(1)))", scriptpath=True)
         self.test_success_case("tr(H,and(pkh(musig/*),after(1)))", "tr($H,and_v(v:pkh(musig($0,$1,$2)/<0;1>/*),after(1)))", scriptpath=True)
diff --git a/test/functional/wallet_signer.py b/test/functional/wallet_signer.py
index 896169d4276a..bf98b4224520 100755
--- a/test/functional/wallet_signer.py
+++ b/test/functional/wallet_signer.py
@@ -8,8 +8,9 @@
 See also rpc_signer.py for tests without wallet context.
 """
 import os
-import sys
 
+from test_framework.descriptors import descsum_create
+from test_framework.extendedkey import ExtendedPrivateKey
 from test_framework.test_framework import BitcoinTestFramework
 from test_framework.util import (
     assert_equal,
@@ -19,30 +20,26 @@
 
 
 class WalletSignerTest(BitcoinTestFramework):
-    def mock_signer_path(self):
-        path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'mocks', 'signer.py')
-        return sys.executable + " " + path
-
-    def mock_no_connected_signer_path(self):
-        path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'mocks', 'no_signer.py')
-        return sys.executable + " " + path
-
-    def mock_invalid_signer_path(self):
-        path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'mocks', 'invalid_signer.py')
-        return sys.executable + " " + path
-
-    def mock_multi_signers_path(self):
-        path = os.path.join(os.path.dirname(os.path.realpath(__file__)), 'mocks', 'multi_signers.py')
-        return sys.executable + " " + path
-
     def set_test_params(self):
-        self.num_nodes = 2
+        self.num_nodes = 3
 
         self.extra_args = [
             [],
             [f"-signer={self.mock_signer_path()}", '-keypool=10'],
+            # Node for the signer mock's wallet, kept offline so the mock
+            # can't cheat by e.g. inspecting the UTXO set
+            ["-maxconnections=0"],
         ]
 
+    def setup_network(self):
+        self.setup_nodes()
+        # Leave the signer mock's node disconnected
+        self.connect_nodes(0, 1)
+
+    def sync_except_mock(self):
+        """Sync all nodes except the signer mock's, which never receives blocks."""
+        self.sync_all(self.nodes[0:2])
+
     def skip_test_if_missing_module(self):
         self.skip_if_no_external_signer()
         self.skip_if_no_wallet()
@@ -54,34 +51,73 @@ def set_mock_result(self, node, res):
     def clear_mock_result(self, node):
         os.remove(os.path.join(node.cwd, "mock_result"))
 
+    def set_mock_sign_mode(self, node, mode):
+        with open(os.path.join(node.cwd, "mock_sign_mode"), "w") as f:
+            f.write(mode)
+
+    def clear_mock_sign_mode(self, node):
+        os.remove(os.path.join(node.cwd, "mock_sign_mode"))
+
+    def init_mock_node(self):
+        """Hand the signer mock its dedicated offline node, on which it
+        creates the wallet it signs with."""
+        signer_node = self.nodes[2]
+        assert_equal(signer_node.getconnectioncount(), 0)
+        with open(os.path.join(self.nodes[1].cwd, "mock_rpc_url"), "w") as f:
+            f.write(signer_node.url)
+
     def run_test(self):
+        self.init_mock_node()
         self.test_valid_signer()
+        self.test_import_descriptor()
+        self.test_hot_key()
+        self.test_unusual_signer()
+        self.test_misbehaving_signer()
         self.test_disconnected_signer()
-        self.restart_node(1, [f"-signer={self.mock_invalid_signer_path()}", "-keypool=10"])
+        self.restart_node(1, [f"-signer={self.mock_signer_path('invalid_signer.py')}", "-keypool=10"])
         self.test_invalid_signer()
-        self.restart_node(1, [f"-signer={self.mock_multi_signers_path()}", "-keypool=10"])
+        self.restart_node(1, [f"-signer={self.mock_signer_path('multi_signers.py')}", "-keypool=10"])
         self.test_multiple_signers()
+        self.restart_node(1)
+        self.test_descriptor_registration()
 
     def test_valid_signer(self):
         self.log.debug(f"-signer={self.mock_signer_path()}")
 
         # Create new wallets for an external signer.
-        # disable_private_keys and descriptors must be true:
-        assert_raises_rpc_error(-4, "Private keys must be disabled when using an external signer", self.nodes[1].createwallet, wallet_name='not_hww', disable_private_keys=False, external_signer=True)
-        self.nodes[1].createwallet(wallet_name='hww', disable_private_keys=True, external_signer=True)
+        self.nodes[1].createwallet(wallet_name='hww', external_signer=True)
         hww = self.nodes[1].get_wallet_rpc('hww')
         assert_equal(hww.getwalletinfo()["external_signer"], True)
 
-        # Flag can't be set afterwards (could be added later for non-blank descriptor based watch-only wallets)
-        self.nodes[1].createwallet(wallet_name='not_hww', disable_private_keys=True, external_signer=False)
-        not_hww = self.nodes[1].get_wallet_rpc('not_hww')
-        assert_equal(not_hww.getwalletinfo()["external_signer"], False)
-        assert_raises_rpc_error(-8, "Wallet flag is immutable: external_signer", not_hww.setwalletflag, "external_signer", True)
-
+        # Private keys are disabled by default
+        assert_equal(hww.getwalletinfo()["private_keys_enabled"], False)
+
+        # Private keys can be explicitly enabled for external signer wallets
+        self.nodes[1].createwallet(wallet_name='hww_hot', external_signer=True, disable_private_keys=False)
+        hww_hot = self.nodes[1].get_wallet_rpc('hww_hot')
+        assert_equal(hww_hot.getwalletinfo()["external_signer"], True)
+        assert_equal(hww_hot.getwalletinfo()["private_keys_enabled"], True)
+        self.nodes[1].unloadwallet('hww_hot')
+
+        # A blank external signer wallet does not auto-import any keys.
+        self.nodes[1].createwallet(wallet_name='hww_blank', external_signer=True, blank=True)
+        hww_blank = self.nodes[1].get_wallet_rpc('hww_blank')
+        assert_equal(hww_blank.getwalletinfo()["keypoolsize"], 0)
+        assert_equal(hww_blank.listdescriptors()["descriptors"], [])
+        self.nodes[1].unloadwallet('hww_blank')
+
+        # Flag can be set afterwards
+        self.nodes[1].createwallet(wallet_name='not_hww_initially', external_signer=False)
+        not_hww_initially = self.nodes[1].get_wallet_rpc('not_hww_initially')
+        assert_equal(not_hww_initially.getwalletinfo()["external_signer"], False)
+        # Without external_signer, private keys are enabled by default
+        assert_equal(not_hww_initially.getwalletinfo()["private_keys_enabled"], True)
+        not_hww_initially.setwalletflag("external_signer", True)
+        assert_equal(not_hww_initially.getwalletinfo()["external_signer"], True)
 
         self.set_mock_result(self.nodes[1], '0 {"invalid json"}')
         assert_raises_rpc_error(-1, 'Unable to parse JSON',
-            self.nodes[1].createwallet, wallet_name='hww2', disable_private_keys=True, external_signer=True
+            self.nodes[1].createwallet, wallet_name='hww2', external_signer=True
         )
         self.clear_mock_result(self.nodes[1])
 
@@ -115,6 +151,10 @@ def test_valid_signer(self):
         assert_equal(address_info['ismine'], True)
         assert_equal(address_info['hdkeypath'], "m/86h/1h/0h/0/0")
 
+        hww.setwalletflag("external_signer", False)
+        assert_raises_rpc_error(-1, "There is no ScriptPubKeyManager for this address", hww.walletdisplayaddress, address1)
+        hww.setwalletflag("external_signer", True)
+
         self.log.info('Test walletdisplayaddress')
         for address in [address1, address2, address3]:
             result = hww.walletdisplayaddress(address)
@@ -149,93 +189,159 @@ def test_valid_signer(self):
             hww.walletdisplayaddress, address_fail
         )
 
-        self.log.info('Prepare mock PSBT')
-        self.nodes[0].sendtoaddress(address4, 1)
-        self.generate(self.nodes[0], 1)
-
-        # Load private key into wallet to generate a signed PSBT for the mock
-        self.nodes[1].createwallet(wallet_name="mock", disable_private_keys=False, blank=True)
-        mock_wallet = self.nodes[1].get_wallet_rpc("mock")
-        assert mock_wallet.getwalletinfo()['private_keys_enabled']
-
-        result = mock_wallet.importdescriptors([{
-            "desc": "tr([00000001/86h/1h/0']tprv8ZgxMBicQKsPd7Uf69XL1XwhmjHopUGep8GuEiJDZmbQz6o58LninorQAfcKZWARbtRtfnLcJ5MQ2AtHcQJCCRUcMRvmDUjyEmNUWwx8UbK/0/*)#7ew68cn8",
-            "timestamp": 0,
-            "range": [0,1],
-            "internal": False,
-            "active": True
-        },
-        {
-            "desc": "tr([00000001/86h/1h/0']tprv8ZgxMBicQKsPd7Uf69XL1XwhmjHopUGep8GuEiJDZmbQz6o58LninorQAfcKZWARbtRtfnLcJ5MQ2AtHcQJCCRUcMRvmDUjyEmNUWwx8UbK/1/*)#0dtm6drl",
-            "timestamp": 0,
-            "range": [0, 0],
-            "internal": True,
-            "active": True
-        }])
-        assert_equal(result[0], {'success': True})
-        assert_equal(result[1], {'success': True})
-        assert_equal(mock_wallet.getwalletinfo()["txcount"], 1)
-        dest = self.nodes[0].getnewaddress(address_type='bech32')
-        mock_psbt = mock_wallet.walletcreatefundedpsbt([], {dest:0.5}, 0, {'replaceable': True}, True)['psbt']
-        mock_psbt_signed = mock_wallet.walletprocesspsbt(psbt=mock_psbt, sign=True, sighashtype="ALL", bip32derivs=True)
-        mock_tx = mock_psbt_signed["hex"]
-        assert mock_wallet.testmempoolaccept([mock_tx])[0]["allowed"]
-
-        assert_equal(hww.getwalletinfo()["txcount"], 1)
-
-        assert hww.testmempoolaccept([mock_tx])[0]["allowed"]
+        self.log.info('Fund hww wallet')
+        for address in [address1, address2, address3, address4]:
+            self.nodes[0].sendtoaddress(address, 1)
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_except_mock)
+        assert_equal(hww.getwalletinfo()["txcount"], 4)
 
-        with open(os.path.join(self.nodes[1].cwd, "mock_psbt"), "w") as f:
-            f.write(mock_psbt_signed["psbt"])
+        dest = self.nodes[0].getnewaddress(address_type='bech32')
 
         self.log.info('Test send using hww1')
 
-        # Don't broadcast transaction yet so the RPC returns the raw hex
-        res = hww.send(outputs={dest:0.5},add_to_wallet=False)
+        # Spend all four address types at once. Don't broadcast the transaction
+        # yet so the RPC returns the raw hex.
+        res = hww.send(outputs={dest:3.5}, add_to_wallet=False)
         assert res["complete"]
-        assert_equal(res["hex"], mock_tx)
+        assert_equal(len(hww.decoderawtransaction(res["hex"])["vin"]), 4)
+        assert hww.testmempoolaccept([res["hex"]])[0]["allowed"]
 
         self.log.info('Test sendall using hww1')
 
-        res = hww.sendall(recipients=[{dest:0.5}, hww.getrawchangeaddress()], add_to_wallet=False)
+        res = hww.sendall(recipients=[{dest:3.5}, hww.getrawchangeaddress()], add_to_wallet=False)
         assert res["complete"]
-        assert_equal(res["hex"], mock_tx)
+        assert hww.testmempoolaccept([res["hex"]])[0]["allowed"]
         # Broadcast transaction so we can bump the fee
         hww.sendrawtransaction(res["hex"])
 
-        self.log.info('Prepare fee bumped mock PSBT')
-
-        # Now that the transaction is broadcast, bump fee in mock wallet:
-        orig_tx_id = res["txid"]
-        mock_psbt_bumped = mock_wallet.psbtbumpfee(orig_tx_id)["psbt"]
-        mock_psbt_bumped_signed = mock_wallet.walletprocesspsbt(psbt=mock_psbt_bumped, sign=True, sighashtype="ALL", bip32derivs=True)
-
-        with open(os.path.join(self.nodes[1].cwd, "mock_psbt"), "w") as f:
-            f.write(mock_psbt_bumped_signed["psbt"])
-
         self.log.info('Test bumpfee using hww1')
 
-        # Bump fee
+        orig_tx_id = res["txid"]
         res = hww.bumpfee(orig_tx_id)
         assert_greater_than(res["fee"], res["origfee"])
         assert_equal(res["errors"], [])
 
+    def test_import_descriptor(self):
+        self.log.info('Test using the signer for an imported descriptor, without reloading')
+
+        self.nodes[1].createwallet(wallet_name='hww_import', external_signer=True, blank=True)
+        hww_import = self.nodes[1].get_wallet_rpc('hww_import')
+        xpub = "tpubD6NzVbkrYhZ4WaWSyoBvQwbpLkojyoTZPRsgXELWz3Popb3qkjcJyJUGLnL4qHHoQvao8ESaAstxYSnhyswJ76uZPStJRJCTKvosUCJZL5B"
+        result = hww_import.importdescriptors([{
+            "desc": descsum_create(f"wpkh([00000001/84h/1h/0h]{xpub}/0/*)"),
+            "active": True,
+            "timestamp": "now",
+        }])
+        assert_equal(result[0]["success"], True)
+
+        address = hww_import.getnewaddress(address_type="bech32")
+        display_path = os.path.join(self.nodes[1].cwd, "mock_displayaddress")
+        with open(display_path, "w") as f:
+            f.write(address)
+        assert_equal(hww_import.walletdisplayaddress(address), {"address": address})
+        os.remove(display_path)
+        self.nodes[1].unloadwallet('hww_import')
+
+    def test_hot_key(self):
+        self.log.info('Test spending a hot key coin in an external signer wallet')
+
+        self.nodes[1].createwallet(wallet_name='hww_hot_key', external_signer=True, disable_private_keys=False)
+        hww_hot_key = self.nodes[1].get_wallet_rpc('hww_hot_key')
+        hot_desc = descsum_create(f"wpkh({ExtendedPrivateKey.generate().to_string()}/<0;1>/*)")
+        result = hww_hot_key.importdescriptors([{
+            "desc": hot_desc,
+            "active": True,
+            "timestamp": "now",
+        }])
+        assert_equal(result[0]["success"], True)
+
+        hot_address = hww_hot_key.getnewaddress(address_type="bech32")
+        self.nodes[0].sendtoaddress(hot_address, 1)
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_except_mock)
+        hot_utxo = hww_hot_key.listunspent(addresses=[hot_address])[0]
+
+        dest = self.nodes[0].getnewaddress()
+        res = hww_hot_key.send(outputs={dest: 0.5}, inputs=[hot_utxo], add_inputs=False, add_to_wallet=False)
+        assert res["complete"]
+        assert self.nodes[1].testmempoolaccept([res["hex"]])[0]["allowed"]
+
+    def test_unusual_signer(self):
+        self.log.info('Test unusual but acceptable external signer behavior')
+        hww = self.nodes[1].get_wallet_rpc('hww')
+
+        # Spend a segwit and a taproot UTXO, to cover both ECDSA and schnorr
+        # signatures
+        addresses = [hww.getnewaddress(address_type="bech32"), hww.getnewaddress(address_type="bech32m")]
+        for address in addresses:
+            self.nodes[0].sendtoaddress(address, 1)
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_except_mock)
+        inputs = [{"txid": utxo["txid"], "vout": utxo["vout"]} for utxo in hww.listunspent(addresses=addresses)]
+        assert_equal(len(inputs), 2)
+        dest = self.nodes[0].getnewaddress()
+
+        self.log.info('The signer may strip fields it does not need')
+        self.set_mock_sign_mode(self.nodes[1], "strip")
+        res = hww.send(outputs={dest: 1.5}, inputs=inputs, add_inputs=False, add_to_wallet=False)
+        assert res["complete"]
+        assert hww.testmempoolaccept([res["hex"]])[0]["allowed"]
+
+        self.log.info('The signer may use SIGHASH_ANYONECANPAY, which still commits to all outputs')
+        self.set_mock_sign_mode(self.nodes[1], "sighash_all_anyonecanpay")
+        res = hww.send(outputs={dest: 1.5}, inputs=inputs, add_inputs=False, add_to_wallet=False)
+        assert res["complete"]
+        assert hww.testmempoolaccept([res["hex"]])[0]["allowed"]
+
+        self.clear_mock_sign_mode(self.nodes[1])
+
+    def test_misbehaving_signer(self):
+        self.log.info('Test misbehaving external signer')
+        hww = self.nodes[1].get_wallet_rpc('hww')
+
+        # Spend a segwit and a taproot UTXO, to cover both ECDSA and schnorr
+        # signatures
+        addresses = [hww.getnewaddress(address_type="bech32"), hww.getnewaddress(address_type="bech32m")]
+        for address in addresses:
+            self.nodes[0].sendtoaddress(address, 1)
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_except_mock)
+        inputs = [{"txid": utxo["txid"], "vout": utxo["vout"]} for utxo in hww.listunspent(addresses=addresses)]
+        assert_equal(len(inputs), 2)
+        dest = self.nodes[0].getnewaddress()
+
+        self.log.info('The signer must not tamper with the transaction')
+        for mode in ["change_amount", "change_script", "remove_output"]:
+            self.set_mock_sign_mode(self.nodes[1], mode)
+            with self.nodes[1].assert_debug_log(["Signer returned a PSBT for a different transaction"]):
+                assert_raises_rpc_error(-25, "External signer failed to sign", hww.send, outputs={dest: 1.5}, inputs=inputs, add_inputs=False)
+
+        self.log.info('The signer must not use unsafe sighash types')
+        # The first mode declares the sighash type in the PSBT, the second
+        # leaves it out, so only the signatures themselves reveal it
+        for mode in ["sighash_none", "sighash_none_hidden"]:
+            self.set_mock_sign_mode(self.nodes[1], mode)
+            with self.nodes[1].assert_debug_log(["Signer used an unsafe sighash type: NONE"]):
+                assert_raises_rpc_error(-25, "External signer failed to sign", hww.send, outputs={dest: 1.5}, inputs=inputs, add_inputs=False)
+
+        self.clear_mock_sign_mode(self.nodes[1])
+
+        # The same transaction is accepted from a well-behaved signer
+        res = hww.send(outputs={dest: 1.5}, inputs=inputs, add_inputs=False, add_to_wallet=False)
+        assert res["complete"]
 
     def test_disconnected_signer(self):
         self.log.info('Test disconnected external signer')
 
         # First create a wallet with the signer connected
-        self.nodes[1].createwallet(wallet_name='hww_disconnect', disable_private_keys=True, external_signer=True)
+        self.nodes[1].createwallet(wallet_name='hww_disconnect', external_signer=True)
         hww = self.nodes[1].get_wallet_rpc('hww_disconnect')
         assert_equal(hww.getwalletinfo()["external_signer"], True)
 
         # Fund wallet
         self.nodes[0].sendtoaddress(hww.getnewaddress(address_type="bech32m"), 1)
-        self.generate(self.nodes[0], 1)
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_except_mock)
 
         # Restart node with no signer connected
-        self.log.debug(f"-signer={self.mock_no_connected_signer_path()}")
-        self.restart_node(1, [f"-signer={self.mock_no_connected_signer_path()}", "-keypool=10"])
+        self.log.debug(f"-signer={self.mock_signer_path('no_signer.py')}")
+        self.restart_node(1, [f"-signer={self.mock_signer_path('no_signer.py')}", "-keypool=10"])
         self.nodes[1].loadwallet('hww_disconnect')
         hww = self.nodes[1].get_wallet_rpc('hww_disconnect')
 
@@ -244,15 +350,57 @@ def test_disconnected_signer(self):
         assert_raises_rpc_error(-25, "External signer not found", hww.send, outputs=[{dest:0.5}])
 
     def test_invalid_signer(self):
-        self.log.debug(f"-signer={self.mock_invalid_signer_path()}")
+        self.log.debug(f"-signer={self.mock_signer_path('invalid_signer.py')}")
         self.log.info('Test invalid external signer')
-        assert_raises_rpc_error(-1, "Invalid descriptor", self.nodes[1].createwallet, wallet_name='hww_invalid', disable_private_keys=True, external_signer=True)
+        assert_raises_rpc_error(-1, "Invalid descriptor", self.nodes[1].createwallet, wallet_name='hww_invalid', external_signer=True)
 
     def test_multiple_signers(self):
-        self.log.debug(f"-signer={self.mock_multi_signers_path()}")
+        self.log.debug(f"-signer={self.mock_signer_path('multi_signers.py')}")
         self.log.info('Test multiple external signers')
 
-        assert_raises_rpc_error(-1, "More than one external signer found", self.nodes[1].createwallet, wallet_name='multi_hww', disable_private_keys=True, external_signer=True)
+        assert_raises_rpc_error(-1, "More than one external signer found", self.nodes[1].createwallet, wallet_name='multi_hww', external_signer=True)
+
+    def test_descriptor_registration(self):
+        self.log.debug(f"-signer={self.mock_signer_path()}")
+        self.log.info('Register a descriptor with an external signer')
+
+        self.nodes[1].createwallet(wallet_name='hww_registered', disable_private_keys=True, external_signer=True, blank=True)
+        wallet = self.nodes[1].get_wallet_rpc('hww_registered')
+        self.log.debug(wallet.getwalletinfo())
+        # With blank=True the wallet starts empty: no device single-sig
+        # descriptors are auto-imported, so the only descriptor present
+        # after importdescriptors is the multisig descriptor under test.
+        assert_equal(wallet.listdescriptors()["descriptors"], [])
+
+        # e.g. obtained via hwi getxpub
+        device_key = "[00000001/47h/1h/0h]tpubD6NzVbkrYhZ4YNXVQbNhMK1WqguFsUXceaVJKbmno2aZ3B6QfbMeraaYvnBSGpV3vxLyTTK9DYT1yoEck4XUScMzXoQ2U2oSmE2JyMedq3H"
+        # for this test it doesn't matter that we can't actually sign with it
+        our_key = "[00000001/47h/1h/0h]tpubDAXcJ7s7ZwicqjprRaEWdPoHKrCS215qxGYxpusRLLmJuT69ZSicuGdSfyvyKpvUNYBW1s2U3NSrT6vrCYB9e6nZUEvrqnwXPF8ArTCRXMY"
+
+        res = wallet.importdescriptors([{
+            "desc": descsum_create(f"wsh(multi(2,{device_key}/<0;1>/*,{our_key}/<0;1>/*))"),
+            "active": True,
+            "timestamp": "now"
+        }])
+        assert_equal(res[0]["success"], True)
+
+        self.log.debug(wallet.listdescriptors())
+
+        res = wallet.registerdescriptor()
+        registration = res["registrations"][0]["registration"]
+        assert_equal(registration, "cmRlc2MBBHRlc3Q=")
+
+        info = wallet.getwalletinfo()
+        assert_equal(info["external_signer_registrations"][0]["registration"], registration)
+
+        # Make sure it's persisted
+        self.nodes[1].unloadwallet("hww_registered")
+        self.nodes[1].loadwallet("hww_registered")
+        wallet = self.nodes[1].get_wallet_rpc('hww_registered')
+
+        info = wallet.getwalletinfo()
+        assert_equal(info["external_signer_registrations"][0]["registration"], registration)
+
 
 if __name__ == '__main__':
     WalletSignerTest(__file__).main()
diff --git a/test/functional/wallet_signer_musig2.py b/test/functional/wallet_signer_musig2.py
new file mode 100755
index 000000000000..015c6a8d3161
--- /dev/null
+++ b/test/functional/wallet_signer_musig2.py
@@ -0,0 +1,369 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Test MuSig2 descriptors in an external-signer wallet."""
+import json
+import os
+
+from test_framework.descriptors import descsum_create
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import (
+    assert_equal,
+    assert_raises_rpc_error,
+)
+
+
+# The single mocked external signer device used by the hot+device
+# subtests below is backed by a real cosigner wallet on the offline mock node; the
+# device's xprv, xpub, fingerprint and BIP32 origin are all derived
+# from that wallet at runtime in `_setup_device_wallet`.
+DEVICE_ACCOUNT_PATH = "m/87h/1h/0h"
+
+
+class WalletSignerMuSig2Test(BitcoinTestFramework):
+    def set_test_params(self):
+        self.num_nodes = 3
+        self.extra_args = [
+            [],
+            [f"-signer={self.mock_signer_path()}", '-keypool=10'],
+            ["-maxconnections=0"],
+        ]
+
+    def setup_network(self):
+        self.setup_nodes()
+        self.connect_nodes(0, 1)
+
+    def sync_except_mock(self):
+        self.sync_all(self.nodes[0:2])
+
+    def skip_test_if_missing_module(self):
+        self.skip_if_no_external_signer()
+        self.skip_if_no_wallet()
+
+    def run_test(self):
+        self.def_wallet = self.nodes[0].get_wallet_rpc(self.default_wallet_name)
+        self._init_mock_node()
+        self._setup_device_wallet()
+        self.test_create_wallet()
+        self.test_register()
+        self.test_display_address()
+        self.test_registered_musig2()
+        self.test_registered_musig2_two_signers()
+
+    def _setup_device_wallet(self):
+        """Create the cosigner wallet on the offline mock node that backs the
+        external signer device. The mock binary delegates `signtx` to
+        this wallet via RPC, so the device contributes a real
+        MuSig2 pubnonce and partial signature on each round instead of
+        replaying a pre-staged PSBT."""
+        device = self._make_device_cosigner('hww_musig_device')
+        self.device_wallet = device['wallet']
+        self.device_origin = device['origin']
+        self.device_xpub = device['xpub']
+        self.device_xprv = device['xprv']
+        self.device_fingerprint = device['fingerprint']
+        self._set_mock_signers([device])
+
+    def _init_mock_node(self):
+        assert_equal(self.nodes[2].getconnectioncount(), 0)
+        with open(os.path.join(self.nodes[1].cwd, "mock_rpc_url"), "w") as f:
+            f.write(self.nodes[2].url)
+
+    def _set_mock_signers(self, devices):
+        """Expose device wallets on the offline mock node as signers."""
+        with open(os.path.join(self.nodes[1].cwd, "mock_signers"), "w") as f:
+            json.dump({device['fingerprint']: device['name'] for device in devices}, f)
+
+    def test_create_wallet(self):
+        self.log.info('Create an external-signer wallet with a MuSig2 descriptor')
+
+        # Blank wallet so signer setup doesn't auto-import the device's
+        # placeholder single-sig descriptors. Add a hot HD seed locally and
+        # import an xpub-only descriptor; Sjors/bitcoin#127 fills in the
+        # matching private key while parsing it.
+        self.nodes[1].createwallet(
+            wallet_name='hww_musig',
+            external_signer=True,
+            disable_private_keys=False,
+            blank=True,
+        )
+        hww_musig = self.nodes[1].get_wallet_rpc('hww_musig')
+        hww_musig.addhdkey()
+        local_info = hww_musig.derivehdkey(DEVICE_ACCOUNT_PATH, {"private": True})
+
+        musig_descriptor = (
+            f"tr(musig({local_info['origin']}{local_info['xpub']},"
+            f"{self.device_origin}{self.device_xpub})/<0;1>/*)"
+        )
+        result = hww_musig.importdescriptors([{
+            "desc": descsum_create(musig_descriptor),
+            "active": True,
+            "timestamp": "now",
+        }])
+        assert_equal(result[0]["success"], True)
+
+        # Mirror the descriptor on the device cosigner wallet (with the
+        # device xprv and the local xpub) so the mock signer can
+        # contribute its real MuSig2 nonce and partial signature when
+        # the wallet calls signtx.
+        device_descriptor = (
+            f"tr(musig({self.device_origin}{self.device_xprv},"
+            f"{local_info['origin']}{local_info['xpub']})/<0;1>/*)"
+        )
+        result = self.device_wallet.importdescriptors([{
+            "desc": descsum_create(device_descriptor),
+            "active": True,
+            "timestamp": "now",
+        }])
+        assert_equal(result[0]["success"], True)
+        descs = hww_musig.listdescriptors()["descriptors"]
+        active_musig = [d for d in descs if d["active"] and d["desc"].startswith("tr(musig(")]
+        # One active descriptor each for receive and change.
+        assert_equal(len(active_musig), 2)
+
+    def test_register(self):
+        self.log.info('Register the MuSig2 descriptor')
+        hww_musig = self.nodes[1].get_wallet_rpc('hww_musig')
+        res = hww_musig.registerdescriptor()
+        assert_equal(len(res["registrations"]), 1)
+        assert_equal(res["registrations"][0]["fingerprint"], self.device_fingerprint)
+        info = hww_musig.getwalletinfo()
+        assert_equal(len(info["external_signer_registrations"]), 1)
+        assert_equal(info["external_signer_registrations"][0]["fingerprint"], self.device_fingerprint)
+
+    def test_display_address(self):
+        self.log.info('Display an address from the MuSig2 descriptor')
+        hww_musig = self.nodes[1].get_wallet_rpc('hww_musig')
+
+        addr = hww_musig.getnewaddress(address_type="bech32m")
+        addr_info = hww_musig.getaddressinfo(addr)
+        assert_equal(addr_info["ismine"], True)
+        assert_equal(addr_info["solvable"], True)
+        # The wallet has a registered descriptor whose fingerprint
+        # matches the connected mock device, so walletdisplayaddress
+        # dispatches through DisplayAddressRegistered. Stage the address
+        # for the device to echo back.
+        mock_display_path = os.path.join(self.nodes[1].cwd, "mock_displayaddress")
+        with open(mock_display_path, "w") as f:
+            f.write(addr)
+        assert_equal(hww_musig.walletdisplayaddress(addr), {"address": addr})
+        os.remove(mock_display_path)
+
+    def _set_musig_mock_state(self, *, error=None, crash=None, reset_counter=True):
+        """Drop mock state files in node 1's cwd. None means leave existing
+        file in place; '' means remove the file."""
+        cwd = self.nodes[1].cwd
+        for name, value in (
+            ('mock_signtx_error', error),
+            ('mock_signtx_crash', crash),
+        ):
+            path = os.path.join(cwd, name)
+            if value is None:
+                continue
+            if value == '':
+                if os.path.isfile(path):
+                    os.remove(path)
+                continue
+            with open(path, 'w') as f:
+                f.write(value)
+        if reset_counter:
+            for filename in os.listdir(cwd):
+                if filename.startswith('mock_signtx_') and filename.endswith('_counter'):
+                    os.remove(os.path.join(cwd, filename))
+
+    def test_registered_musig2(self):
+        self.log.info("Test MuSig2 registered-descriptor signing dance via mock signer")
+        hww = self.nodes[1].get_wallet_rpc('hww_musig')
+
+        # Fund the wallet at the first MuSig2 receive address.
+        addr = hww.getnewaddress(address_type="bech32m")
+        self.def_wallet.sendtoaddress(addr, 1)
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_except_mock)
+
+        # Send via the external-signer wallet. `send` funds, signs and
+        # broadcasts in one RPC: CWallet::FillPSBT dispatches through
+        # FillPSBTRegistered, the round-1 fan-out collects the device
+        # pubnonce and the local SPKM contributes the matching nonce,
+        # the round-2 retry inside FillPSBT collects the device's
+        # partial sig and the local SPKM produces its own, and
+        # FinalizePSBT aggregates the two psigs into a Schnorr
+        # key-path signature. Both contributions come from real
+        # MuSig2 signers (the local descriptor + the cosigner wallet
+        # on node 0 driven by the mock subprocess). Nothing is
+        # replayed.
+        dest = self.def_wallet.getnewaddress(address_type="bech32m")
+        result = hww.send(outputs=[{dest: 0.5}])
+        assert_equal(result["complete"], True)
+        # The mock saw two signtx calls (round 1 + round 2).
+        with open(os.path.join(self.nodes[1].cwd,
+                               f'mock_signtx_{self.device_fingerprint}_counter')) as f:
+            assert_equal(f.read().strip(), "2")
+        # `send` already broadcast the tx; mempool acceptance verifies
+        # the aggregated MuSig2 signature is valid.
+        assert result["txid"] in self.nodes[1].getrawmempool()
+
+        # Build a stand-alone PSBT for the soft- and hard-fail subtests
+        # below; using the same PSBT through both subtests lets us
+        # assert the local nonce is preserved across calls without
+        # racing the broadcast of the optimistic path. Fund a second
+        # UTXO since `send` consumed the first.
+        addr = hww.getnewaddress(address_type="bech32m")
+        self.def_wallet.sendtoaddress(addr, 1)
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_except_mock)
+        psbt = hww.walletcreatefundedpsbt(inputs=[], outputs=[{dest: 0.5}])["psbt"]
+
+        # --- Soft-fail path ---
+        # Configure the mock to return a structured signer error from
+        # signtx. Because the local SPKM has an xprv and contributed
+        # its MuSig2 pubnonce in the round-1 fan-out, FillPSBTRegistered
+        # soft-fails the device's signtx so that fresh local
+        # contribution isn't discarded: the caller can re-issue
+        # walletprocesspsbt once the device is back to drive round 2.
+        self._set_musig_mock_state(error="device disconnected")
+        result = hww.walletprocesspsbt(psbt=psbt)
+        assert_equal(result["complete"], False)
+        # The local nonce now lives in the returned PSBT. Re-issuing
+        # walletprocesspsbt on that PSBT exercises the hard-fail branch:
+        # the local pass is a no-op (its pubnonce is already there), so
+        # FillPSBTRegistered can't justify hiding the device error and
+        # surfaces it as EXTERNAL_SIGNER_FAILED.
+        psbt_with_nonce = result["psbt"]
+        assert_raises_rpc_error(
+            -25, "External signer failed to sign",
+            hww.walletprocesspsbt, psbt=psbt_with_nonce,
+        )
+
+        # --- Subprocess-crash path ---
+        # `signer.py` exiting non-zero used to escape FillPSBTRegistered as
+        # an uncaught std::runtime_error and bubble up as an opaque
+        # internal JSON-RPC error. Commit "external signer: surface
+        # SignTransactionRegistered crash as signer error" routes that
+        # through the same uniform soft/hard-fail logic as a structured
+        # signer error.
+        self._set_musig_mock_state(error='', crash='1')
+        assert_raises_rpc_error(
+            -25, "External signer failed to sign",
+            hww.walletprocesspsbt, psbt=psbt_with_nonce,
+        )
+        # Reset state so subsequent tests aren't affected.
+        self._set_musig_mock_state(crash='')
+
+    def test_registered_musig2_two_signers(self):
+        self.log.info("Test MuSig2 registered-descriptor signing with two external signers")
+        # Two co-signing devices, both reachable through the same
+        # `-signer` mock binary. After CWallet's registration dispatch was
+        # taught to fan out to every connected signer (commit "wallet:
+        # fan registerdescriptor/displayaddress/FillPSBT out to all
+        # signers"), this scenario completes inside a single
+        # walletprocesspsbt call: the round-1 fan-out collects every
+        # cosigner's pubnonce, the round-2 retry inside FillPSBT
+        # collects every partial sig, and FillPSBTRegistered's FinalizePSBT
+        # aggregates them into a Schnorr key-path signature.
+
+        # Clear failure/display state left by the single-device scenarios.
+        cwd = self.nodes[1].cwd
+        for stale in ('mock_signtx_error', 'mock_signtx_crash', 'mock_displayaddress'):
+            stale_path = os.path.join(cwd, stale)
+            if os.path.isfile(stale_path):
+                os.remove(stale_path)
+
+        # Two device-side cosigner wallets on the offline mock node, each with its own
+        # xprv at the same BIP32 path. Together with the local mirror
+        # held by the registered-descriptor wallet on node 1, this is a 2-of-2 MuSig2.
+        device_a = self._make_device_cosigner('hww_musig_device_a')
+        device_b = self._make_device_cosigner('hww_musig_device_b')
+
+        # Wire the mock to enumerate both device wallets.
+        self._set_mock_signers([device_a, device_b])
+
+        # External signer wallet on node 1: no local privkeys (both cosigners are
+        # devices), blank so signer setup doesn't auto-import single-sig
+        # placeholder descriptors.
+        self.nodes[1].createwallet(
+            wallet_name='hww_registered_2of2',
+            disable_private_keys=True,
+            external_signer=True,
+            blank=True,
+        )
+        hww = self.nodes[1].get_wallet_rpc('hww_registered_2of2')
+        musig_descriptor = (
+            f"tr(musig({device_a['origin']}{device_a['xpub']},"
+            f"{device_b['origin']}{device_b['xpub']})/<0;1>/*)"
+        )
+        result = hww.importdescriptors([{
+            "desc": descsum_create(musig_descriptor),
+            "active": True,
+            "timestamp": "now",
+        }])
+        assert_equal(result[0]["success"], True)
+
+        # Mirror the same descriptor on each device wallet, with that
+        # device's own xprv swapped in. The mock routes signtx to
+        # these wallets so they produce real MuSig2 contributions.
+        for device in (device_a, device_b):
+            other = device_b if device is device_a else device_a
+            mirror = (
+                f"tr(musig({device['origin']}{device['xprv']},"
+                f"{other['origin']}{other['xpub']})/<0;1>/*)"
+            )
+            res = device['wallet'].importdescriptors([{
+                "desc": descsum_create(mirror),
+                "active": True,
+                "timestamp": "now",
+            }])
+            assert_equal(res[0]["success"], True)
+
+        # registerdescriptor fans out: one registration per device.
+        hww.registerdescriptor()
+        info = hww.getwalletinfo()
+        assert_equal(len(info["external_signer_registrations"]), 2)
+        assert_equal({entry["fingerprint"] for entry in info["external_signer_registrations"]},
+                     {device_a['fingerprint'], device_b['fingerprint']})
+
+        # Fund the aggregated address.
+        addr = hww.getnewaddress(address_type="bech32m")
+        self.def_wallet.sendtoaddress(addr, 1)
+        self.generate(self.nodes[0], 1, sync_fun=self.sync_except_mock)
+
+        # Single RPC: round 1 fan-out + round 2 retry fan-out + finalize
+        # all happen inside walletprocesspsbt.
+        dest = self.def_wallet.getnewaddress(address_type="bech32m")
+        psbt = hww.walletcreatefundedpsbt(inputs=[], outputs=[{dest: 0.5}],
+                                          options={"change_type": "bech32m"})["psbt"]
+        proc = hww.walletprocesspsbt(psbt=psbt)
+        assert_equal(proc["complete"], True)
+        # Both devices were invoked. The fan-out iterates signers in
+        # order: round 1 calls each (collecting nonces, with the second
+        # also producing a partial sig once both nonces are present);
+        # round 2 calls the first signer again to add its partial sig
+        # and finalize, after which the PSBT is complete and
+        # FillPSBTRegistered short-circuits the remaining signers. So one
+        # device sees two signtx calls and the other sees one.
+        counters = sorted(
+            int(open(os.path.join(cwd, f"mock_signtx_{d['fingerprint']}_counter")).read())
+            for d in (device_a, device_b)
+        )
+        assert_equal(counters, [1, 2])
+        assert self.nodes[0].testmempoolaccept([proc["hex"]])[0]["allowed"]
+
+    def _make_device_cosigner(self, name):
+        """Stand up a cosigner wallet on the offline node to back one mock device.
+        Returns a dict with the wallet handle and the BIP32 material the
+        registered-descriptor wallet's MuSig2 descriptor needs."""
+        self.nodes[2].createwallet(wallet_name=name)
+        wallet = self.nodes[2].get_wallet_rpc(name)
+        wallet.addhdkey()
+        info = wallet.derivehdkey(DEVICE_ACCOUNT_PATH, {"private": True})
+        return {
+            'name': name,
+            'wallet': wallet,
+            'origin': info["origin"],
+            'xpub': info["xpub"],
+            'xprv': info["xprv"],
+            'fingerprint': info["origin"][1:9],
+        }
+
+
+if __name__ == '__main__':
+    WalletSignerMuSig2Test(__file__).main()
diff --git a/test/functional/wallet_taproot.py b/test/functional/wallet_taproot.py
index 1aca5d421c84..fee8e5fc0fcf 100755
--- a/test/functional/wallet_taproot.py
+++ b/test/functional/wallet_taproot.py
@@ -64,9 +64,6 @@ def skip_test_if_missing_module(self):
     def setup_network(self):
         self.setup_nodes()
 
-    def init_wallet(self, *, node):
-        pass
-
     @staticmethod
     def make_desc(pattern, privmap, keys, pub_only = False):
         pat = pattern.replace("$H", H_POINT)
@@ -172,8 +169,8 @@ def do_test_sendtoaddress(self, comment, pattern, privmap, treefn, keys_pay, key
         assert rpc_online.gettransaction(txid)["confirmations"] > 0
         rpc_online.unloadwallet()
 
-    def do_test_psbt(self, comment, pattern, privmap, treefn, keys_pay, keys_change):
-        self.log.info("Testing %s through PSBT" % comment)
+    def do_test_psbt(self, comment, pattern, privmap, treefn, keys_pay, keys_change, keypath_only):
+        self.log.info(f"Testing {comment} through PSBT { '(key path only)' if keypath_only else '' }")
 
         # Create wallets
         wallet_uuid = uuid.uuid4().hex
@@ -183,6 +180,8 @@ def do_test_psbt(self, comment, pattern, privmap, treefn, keys_pay, keys_change)
         psbt_online = self.nodes[0].get_wallet_rpc(f"psbt_online_{wallet_uuid}")
         psbt_offline = self.nodes[1].get_wallet_rpc(f"psbt_offline_{wallet_uuid}")
         key_only_wallet = self.nodes[1].get_wallet_rpc(f"key_only_wallet_{wallet_uuid}")
+        if keypath_only:
+            assert "keypath_only" in psbt_online.help("walletcreatefundedpsbt")
 
         desc_pay = self.make_desc(pattern, privmap, keys_pay, False)
         desc_change = self.make_desc(pattern, privmap, keys_change, False)
@@ -213,12 +212,25 @@ def do_test_psbt(self, comment, pattern, privmap, treefn, keys_pay, keys_change)
             self.generatetoaddress(self.nodes[0], 1, self.boring.getnewaddress(), sync_fun=self.no_op)
             test_balance = int(psbt_online.getbalance() * 100000000)
             ret_amnt = random.randrange(100000, test_balance)
-            # Increase fee_rate to compensate for the wallet's inability to estimate fees for script path spends.
-            psbt = psbt_online.walletcreatefundedpsbt([], [{self.boring.getnewaddress(): Decimal(ret_amnt) / 100000000}], None, {"subtractFeeFromOutputs":[0], "fee_rate": 200, "change_type": address_type})['psbt']
-            res = psbt_offline.walletprocesspsbt(psbt=psbt, finalize=False)
+            fee_rate = 1
+            if not keypath_only:
+                # Increase fee_rate to compensate for the wallet's inability to estimate fees for script path spends.
+                fee_rate = 200
+            options = {
+                "subtractFeeFromOutputs": [0],
+                "fee_rate": fee_rate,
+                "change_type": address_type,
+                "keypath_only": keypath_only,
+            }
+            psbt = psbt_online.walletcreatefundedpsbt([], [{self.boring.getnewaddress(): Decimal(ret_amnt) / 100000000}], None, options)['psbt']
+            if keypath_only:
+                for psbtin in psbt_online.decodepsbt(psbt)["inputs"]:
+                    assert "taproot_scripts" not in psbtin
+            res = psbt_offline.walletprocesspsbt(psbt=psbt, finalize=False, keypath_only=keypath_only)
             for wallet in [psbt_offline, key_only_wallet]:
-                res = wallet.walletprocesspsbt(psbt=psbt, finalize=False)
+                res = wallet.walletprocesspsbt(psbt=psbt, finalize=False, keypath_only=keypath_only)
 
+                retry = False
                 decoded = wallet.decodepsbt(res["psbt"])
                 if pattern.startswith("tr("):
                     for psbtin in decoded["inputs"]:
@@ -226,19 +238,66 @@ def do_test_psbt(self, comment, pattern, privmap, treefn, keys_pay, keys_change)
                         assert "witness_utxo" in psbtin
                         assert "taproot_internal_key" in psbtin
                         assert "taproot_bip32_derivs" in psbtin
-                        assert "taproot_key_path_sig" in psbtin or "taproot_script_path_sigs" in psbtin
+                        if keypath_only:
+                            assert "taproot_script_path_sigs" not in psbtin
+                            if  "taproot_key_path_sig" not in psbtin:
+                                retry = True
+                        else:
+                            assert "taproot_key_path_sig" in psbtin or "taproot_script_path_sigs" in psbtin
                         if "taproot_script_path_sigs" in psbtin:
                             assert "taproot_merkle_root" in psbtin
                             assert "taproot_scripts" in psbtin
 
+                if retry:
+                    self.log.debug("Retry with script path")
+                    fee_rate = 200
+                    psbt = psbt_online.walletcreatefundedpsbt([], [{self.boring.getnewaddress(): Decimal(ret_amnt) / 100000000}], None, {"subtractFeeFromOutputs":[0], "fee_rate": fee_rate, "change_type": address_type})['psbt']
+                    res = wallet.walletprocesspsbt(psbt=psbt, finalize=False, keypath_only=False)
+
                 rawtx = self.nodes[0].finalizepsbt(res['psbt'])['hex']
                 res = self.nodes[0].testmempoolaccept([rawtx])
+                self.log.debug(res)
                 assert res[0]["allowed"]
 
             txid = self.nodes[0].sendrawtransaction(rawtx)
             self.generatetoaddress(self.nodes[0], 1, self.boring.getnewaddress(), sync_fun=self.no_op)
             assert psbt_online.gettransaction(txid)['confirmations'] > 0
 
+        if keypath_only:
+            self.log.info("Testing send with keypath_only")
+
+            def assert_no_script_path(psbt):
+                decoded = psbt_online.decodepsbt(psbt)
+                for psbtin in decoded["inputs"]:
+                    assert "taproot_script_path_sigs" not in psbtin
+
+            test_balance = int(psbt_online.getbalance() * 100000000)
+            outputs = {self.boring.getnewaddress(): Decimal(test_balance // 2) / 100000000}
+            res = psbt_online.send(
+                outputs=outputs,
+                options={
+                    "keypath_only": True,
+                    "psbt": True,
+                    "add_to_wallet": False,
+                    "fee_rate": 1,
+                    "subtract_fee_from_outputs": [0],
+                },
+            )
+            assert_equal(res["complete"], False)
+            assert_no_script_path(res["psbt"])
+
+            self.log.info("Testing sendall with keypath_only")
+            res = psbt_online.sendall(
+                recipients=[self.boring.getnewaddress()],
+                keypath_only=True,
+                psbt=True,
+                add_to_wallet=False,
+                fee_rate=1,
+            )
+            assert_equal(res["complete"], False)
+            assert_no_script_path(res["psbt"])
+
+        # Cleanup
         # Match the framework fallbackfee; otherwise the underestimated taproot
         # script-path spend size can produce an effective feerate below min relay.
         psbt = psbt_online.sendall(recipients=[self.boring.getnewaddress()], psbt=True, fee_rate=20)["psbt"]
@@ -252,13 +311,15 @@ def do_test_psbt(self, comment, pattern, privmap, treefn, keys_pay, keys_change)
 
     def do_test(self, comment, pattern, privmap, treefn):
         nkeys = len(privmap)
-        keys = random.sample(self.keys, nkeys * 4)
+        keys = random.sample(self.keys, nkeys * 6)
         self.do_test_addr(comment, pattern, privmap, treefn, keys[0:nkeys])
         self.do_test_sendtoaddress(comment, pattern, privmap, treefn, keys[0:nkeys], keys[nkeys:2*nkeys])
-        self.do_test_psbt(comment, pattern, privmap, treefn, keys[2*nkeys:3*nkeys], keys[3*nkeys:4*nkeys])
+        self.do_test_psbt(comment, pattern, privmap, treefn, keys[2*nkeys:3*nkeys], keys[3*nkeys:4*nkeys], keypath_only=False)
+        if 'tr' in pattern:
+            self.do_test_psbt(comment, pattern, privmap, treefn, keys[4*nkeys:5*nkeys], keys[5*nkeys:6*nkeys], keypath_only=True)
 
     def generate_test_keys(self):
-        xprvs = [ExtendedPrivateKey.generate() for _ in range(0, 13)]
+        xprvs = [ExtendedPrivateKey.generate() for _ in range(0, 18)]
         return [{
             "xprv": xprv.to_string(),
             "xpub": xprv.pubkey().to_string(),