diff --git a/src/bls/bls.cpp b/src/bls/bls.cpp
index 96a188e2ae93..1a8bab710d83 100644
--- a/src/bls/bls.cpp
+++ b/src/bls/bls.cpp
@@ -15,9 +15,40 @@
 #include <cstring>
 
 namespace bls {
-    std::atomic<bool> bls_legacy_scheme = std::atomic<bool>(true);
+std::atomic<bool> bls_legacy_scheme = std::atomic<bool>(true);
+
+namespace {
+//! Trivially destructible, like util/threadnames.cpp's thread-local name.
+thread_local std::optional<bool> g_thread_legacy_scheme;
+} // namespace
+
+bool EffectiveLegacyScheme() { return g_thread_legacy_scheme ? *g_thread_legacy_scheme : bls_legacy_scheme.load(); }
+
+void SetEffectiveLegacyScheme(bool legacy)
+{
+    if (g_thread_legacy_scheme) {
+        g_thread_legacy_scheme = legacy;
+    } else {
+        bls_legacy_scheme.store(legacy);
+    }
 }
 
+ScopedLegacySchemeOverride::ScopedLegacySchemeOverride(bool legacy) noexcept :
+    m_saved{g_thread_legacy_scheme}
+{
+    g_thread_legacy_scheme = legacy;
+}
+
+ScopedLegacySchemeOverride::~ScopedLegacySchemeOverride() noexcept
+{
+    if (!m_committed || !m_saved) {
+        g_thread_legacy_scheme = m_saved;
+    }
+}
+
+bool ScopedLegacySchemeOverride::Active() noexcept { return g_thread_legacy_scheme.has_value(); }
+} // namespace bls
+
 static const std::unique_ptr<bls::CoreMPL> pSchemeLegacy{std::make_unique<bls::LegacySchemeMPL>()};
 static const std::unique_ptr<bls::CoreMPL> pScheme(std::make_unique<bls::BasicSchemeMPL>());
 
@@ -145,7 +176,7 @@ void CBLSPublicKey::AggregateInsecure(const CBLSPublicKey& o)
 {
     assert(IsValid() && o.IsValid());
     try {
-        impl = Scheme(bls::bls_legacy_scheme.load())->Aggregate({impl, o.impl});
+        impl = Scheme(bls::EffectiveLegacyScheme())->Aggregate({impl, o.impl});
     } catch (...) {
         fValid = false;
     }
@@ -166,7 +197,7 @@ CBLSPublicKey CBLSPublicKey::AggregateInsecure(Span<CBLSPublicKey> pks)
 
     CBLSPublicKey ret;
     try {
-        ret.impl = Scheme(bls::bls_legacy_scheme.load())->Aggregate(vecPublicKeys);
+        ret.impl = Scheme(bls::EffectiveLegacyScheme())->Aggregate(vecPublicKeys);
         ret.fValid = true;
     } catch (...) {
         ret.fValid = false;
@@ -230,7 +261,7 @@ void CBLSSignature::AggregateInsecure(const CBLSSignature& o)
 {
     assert(IsValid() && o.IsValid());
     try {
-        impl = Scheme(bls::bls_legacy_scheme.load())->Aggregate({impl, o.impl});
+        impl = Scheme(bls::EffectiveLegacyScheme())->Aggregate({impl, o.impl});
     } catch (...) {
         fValid = false;
     }
@@ -251,7 +282,7 @@ CBLSSignature CBLSSignature::AggregateInsecure(Span<CBLSSignature> sigs)
 
     CBLSSignature ret;
     try {
-        ret.impl = Scheme(bls::bls_legacy_scheme.load())->Aggregate(v);
+        ret.impl = Scheme(bls::EffectiveLegacyScheme())->Aggregate(v);
         ret.fValid = true;
     } catch (...) {
         ret.fValid = false;
@@ -283,7 +314,7 @@ CBLSSignature CBLSSignature::AggregateSecure(Span<CBLSSignature> sigs,
 
     CBLSSignature ret;
     try {
-        ret.impl = Scheme(bls::bls_legacy_scheme.load())->AggregateSecure(vecPublicKeys, vecSignatures, bls::Bytes(hash.begin(), hash.size()));
+        ret.impl = Scheme(bls::EffectiveLegacyScheme())->AggregateSecure(vecPublicKeys, vecSignatures, bls::Bytes(hash.begin(), hash.size()));
         ret.fValid = true;
     } catch (...) {
         ret.fValid = false;
@@ -322,10 +353,16 @@ bool CBLSSignature::VerifyInsecure(const CBLSPublicKey& pubKey, const uint256& h
 
 bool CBLSSignature::VerifyInsecure(const CBLSPublicKey& pubKey, const uint256& hash) const
 {
-    return VerifyInsecure(pubKey, hash, bls::bls_legacy_scheme.load());
+    return VerifyInsecure(pubKey, hash, bls::EffectiveLegacyScheme());
 }
 
 bool CBLSSignature::VerifyInsecureAggregated(Span<CBLSPublicKey> pubKeys, Span<uint256> hashes) const
+{
+    return VerifyInsecureAggregated(pubKeys, hashes, bls::EffectiveLegacyScheme());
+}
+
+bool CBLSSignature::VerifyInsecureAggregated(Span<CBLSPublicKey> pubKeys, Span<uint256> hashes,
+                                             const bool specificLegacyScheme) const
 {
     if (!IsValid()) {
         return false;
@@ -346,13 +383,18 @@ bool CBLSSignature::VerifyInsecureAggregated(Span<CBLSPublicKey> pubKeys, Span<u
     }
 
     try {
-        return Scheme(bls::bls_legacy_scheme.load())->AggregateVerify(pubKeyVec, hashes2, impl);
+        return Scheme(specificLegacyScheme)->AggregateVerify(pubKeyVec, hashes2, impl);
     } catch (...) {
         return false;
     }
 }
 
 bool CBLSSignature::VerifySecureAggregated(Span<CBLSPublicKey> pks, const uint256& hash) const
+{
+    return VerifySecureAggregated(pks, hash, bls::EffectiveLegacyScheme());
+}
+
+bool CBLSSignature::VerifySecureAggregated(Span<CBLSPublicKey> pks, const uint256& hash, const bool specificLegacyScheme) const
 {
     if (pks.empty()) {
         return false;
@@ -365,7 +407,7 @@ bool CBLSSignature::VerifySecureAggregated(Span<CBLSPublicKey> pks, const uint25
     }
 
     try {
-        return Scheme(bls::bls_legacy_scheme.load())->VerifySecure(vecPublicKeys, impl, bls::Bytes(hash.begin(), hash.size()));
+        return Scheme(specificLegacyScheme)->VerifySecure(vecPublicKeys, impl, bls::Bytes(hash.begin(), hash.size()));
     } catch (...) {
         return false;
     }
diff --git a/src/bls/bls.h b/src/bls/bls.h
index 82abc2c6de04..023b927312cb 100644
--- a/src/bls/bls.h
+++ b/src/bls/bls.h
@@ -24,11 +24,47 @@
 #include <array>
 #include <atomic>
 #include <mutex>
+#include <optional>
 #include <ranges>
 
 namespace bls {
-    extern std::atomic<bool> bls_legacy_scheme;
-}
+//! Process-wide default scheme of BLS operations that are not given one. It
+//! follows the active chainstate's tip only: other threads read it outside
+//! cs_main, so work for any other chain context (a background chainstate, a dry
+//! run) sets a ScopedLegacySchemeOverride instead.
+extern std::atomic<bool> bls_legacy_scheme;
+
+//! The scheme of BLS operations on this thread that are not given one: the
+//! innermost ScopedLegacySchemeOverride if one is set, else bls_legacy_scheme.
+bool EffectiveLegacyScheme();
+
+//! Switches EffectiveLegacyScheme(): this thread's override if one is set,
+//! else bls_legacy_scheme.
+void SetEffectiveLegacyScheme(bool legacy);
+
+//! Sets EffectiveLegacyScheme() on this thread only, for the object's lifetime.
+//! Work handed to another thread does not see it and must capture the scheme.
+class ScopedLegacySchemeOverride
+{
+public:
+    explicit ScopedLegacySchemeOverride(bool legacy) noexcept;
+    ~ScopedLegacySchemeOverride() noexcept;
+
+    ScopedLegacySchemeOverride(const ScopedLegacySchemeOverride&) = delete;
+    ScopedLegacySchemeOverride& operator=(const ScopedLegacySchemeOverride&) = delete;
+
+    //! Leaves the scheme in force at scope exit to the enclosing override. The
+    //! outermost override always ends with its scope.
+    void Commit() noexcept { m_committed = true; }
+
+    //! Whether an override is set on this thread.
+    static bool Active() noexcept;
+
+private:
+    const std::optional<bool> m_saved;
+    bool m_committed{false};
+};
+} // namespace bls
 
 // reversed BLS12-381
 constexpr int BLS_CURVE_ID_SIZE{32};
@@ -177,7 +213,7 @@ class CBLSWrapper
     template <typename Stream>
     inline void Serialize(Stream& s) const
     {
-        Serialize(s, bls::bls_legacy_scheme.load());
+        Serialize(s, bls::EffectiveLegacyScheme());
     }
 
     template <typename Stream>
@@ -205,7 +241,7 @@ class CBLSWrapper
     template <typename Stream>
     inline void Unserialize(Stream& s)
     {
-        Unserialize(s, bls::bls_legacy_scheme.load());
+        Unserialize(s, bls::EffectiveLegacyScheme());
     }
 
     inline bool CheckMalleable(Span<uint8_t> vecBytes, const bool specificLegacyScheme) const
@@ -228,7 +264,7 @@ class CBLSWrapper
 
     inline std::string ToString() const
     {
-        return ToString(bls::bls_legacy_scheme.load());
+        return ToString(bls::EffectiveLegacyScheme());
     }
 };
 
@@ -365,8 +401,12 @@ class CBLSSignature : public CBLSWrapper<bls::G2Element, BLS_CURVE_SIG_SIZE, CBL
     void MulInsecure(const CBLSSecretKey& factor);
     [[nodiscard]] bool VerifyInsecure(const CBLSPublicKey& pubKey, const uint256& hash, const bool specificLegacyScheme) const;
     [[nodiscard]] bool VerifyInsecure(const CBLSPublicKey& pubKey, const uint256& hash) const;
+    [[nodiscard]] bool VerifyInsecureAggregated(Span<CBLSPublicKey> pubKeys, Span<uint256> hashes,
+                                                const bool specificLegacyScheme) const;
     [[nodiscard]] bool VerifyInsecureAggregated(Span<CBLSPublicKey> pubKeys, Span<uint256> hashes) const;
 
+    [[nodiscard]] bool VerifySecureAggregated(Span<CBLSPublicKey> pks, const uint256& hash,
+                                              const bool specificLegacyScheme) const;
     [[nodiscard]] bool VerifySecureAggregated(Span<CBLSPublicKey> pks, const uint256& hash) const;
 
     bool Recover(Span<CBLSSignature> sigs, Span<CBLSId> ids);
@@ -410,7 +450,7 @@ class CBLSLazyWrapper
 
 public:
     CBLSLazyWrapper() :
-        bufLegacyScheme(bls::bls_legacy_scheme.load())
+        bufLegacyScheme(bls::EffectiveLegacyScheme())
     {}
 
     explicit CBLSLazyWrapper(const CBLSLazyWrapper& r)
diff --git a/src/bls/bls_batchverifier.h b/src/bls/bls_batchverifier.h
index 647d38e675e3..843fe85cfcbf 100644
--- a/src/bls/bls_batchverifier.h
+++ b/src/bls/bls_batchverifier.h
@@ -47,6 +47,8 @@ class CBLSBatchVerifier
     bool secureVerification;
     bool perMessageFallback;
     size_t subBatchSize;
+    //! Taken from the constructing thread, so a batch verifies under one scheme wherever Verify() runs
+    const bool legacyScheme;
 
     MessageMap messages;
     MessagesBySourceMap messagesBySource;
@@ -61,7 +63,8 @@ class CBLSBatchVerifier
     CBLSBatchVerifier(bool _secureVerification, bool _perMessageFallback, size_t _subBatchSize = 0) :
             secureVerification(_secureVerification),
             perMessageFallback(_perMessageFallback),
-            subBatchSize(_subBatchSize)
+            subBatchSize(_subBatchSize),
+            legacyScheme(bls::EffectiveLegacyScheme())
     {
     }
 
@@ -135,7 +138,7 @@ class CBLSBatchVerifier
                             }
 
                             const auto& msg = msgIt->second;
-                            if (!msg.sig.VerifyInsecure(msg.pubKey, msg.msgHash)) {
+                            if (!msg.sig.VerifyInsecure(msg.pubKey, msg.msgHash, legacyScheme)) {
                                 badMessages.emplace(msg.msgId);
                             }
                         }
@@ -201,7 +204,7 @@ class CBLSBatchVerifier
         }
 
         CBLSSignature aggSig = CBLSSignature::AggregateInsecure(sigsToAggregate);
-        return aggSig.VerifyInsecureAggregated(pubKeys, msgHashes);
+        return aggSig.VerifyInsecureAggregated(pubKeys, msgHashes, legacyScheme);
     }
 
     bool VerifyBatchSecure(std::map<uint256, std::vector<MessageMapIterator>>& byMessageHash)
@@ -251,7 +254,7 @@ class CBLSBatchVerifier
         assert(!msgHashes.empty());
 
         CBLSSignature aggSig = CBLSSignature::AggregateInsecure(sigsToAggregate);
-        return aggSig.VerifyInsecureAggregated(pubKeys, msgHashes);
+        return aggSig.VerifyInsecureAggregated(pubKeys, msgHashes, legacyScheme);
     }
 };
 
diff --git a/src/bls/bls_worker.cpp b/src/bls/bls_worker.cpp
index 7e383a644ba3..a387670d7141 100644
--- a/src/bls/bls_worker.cpp
+++ b/src/bls/bls_worker.cpp
@@ -825,8 +825,8 @@ std::set<size_t> CBLSWorker::FindVerificationVectorsWithSharedCoefficients(Span<
 
 void CBLSWorker::AsyncSign(const CBLSSecretKey& secKey, const uint256& msgHash, const CBLSWorker::SignDoneCallback& doneCallback)
 {
-    workerPool.push([secKey, msgHash, doneCallback](int threadId) {
-        doneCallback(secKey.Sign(msgHash, bls::bls_legacy_scheme.load()));
+    workerPool.push([secKey, msgHash, doneCallback, legacy = bls::EffectiveLegacyScheme()](int threadId) {
+        doneCallback(secKey.Sign(msgHash, legacy));
     });
 }
 
@@ -838,18 +838,19 @@ void CBLSWorker::AsyncVerifySig(const CBLSSignature& sig, const CBLSPublicKey& p
         return;
     }
 
+    const bool legacy{bls::EffectiveLegacyScheme()};
     std::unique_lock<std::mutex> l(sigVerifyMutex);
 
     bool foundDuplicate = std::ranges::any_of(sigVerifyQueue,
                                               [&msgHash](const auto& job) { return job.msgHash == msgHash; });
 
-    if (foundDuplicate) {
-        // batched/aggregated verification does not allow duplicate hashes, so we push what we currently have and start
-        // with a fresh batch
+    if (foundDuplicate || (!sigVerifyQueue.empty() && sigVerifyQueue.front().legacyScheme != legacy)) {
+        // batched/aggregated verification does not allow duplicate hashes or mixed schemes, so we push what we
+        // currently have and start with a fresh batch
         PushSigVerifyBatch();
     }
 
-    sigVerifyQueue.emplace_back(std::move(doneCallback), std::move(cancelCond), sig, pubKey, msgHash);
+    sigVerifyQueue.emplace_back(std::move(doneCallback), std::move(cancelCond), sig, pubKey, msgHash, legacy);
     if (sigVerifyBatchesInProgress == 0 || sigVerifyQueue.size() >= SIG_VERIFY_BATCH_SIZE) {
         PushSigVerifyBatch();
     }
@@ -876,7 +877,7 @@ void CBLSWorker::PushSigVerifyBatch()
         if (jobs.size() == 1) {
             const auto& job = jobs[0];
             if (!job.cancelCond()) {
-                bool valid = job.sig.VerifyInsecure(job.pubKey, job.msgHash);
+                bool valid = job.sig.VerifyInsecure(job.pubKey, job.msgHash, job.legacyScheme);
                 job.doneCallback(valid);
             }
             std::unique_lock<std::mutex> l(sigVerifyMutex);
@@ -910,7 +911,7 @@ void CBLSWorker::PushSigVerifyBatch()
         }
 
         if (!pubKeys.empty()) {
-            bool allValid = aggSig.VerifyInsecureAggregated(pubKeys, msgHashes);
+            bool allValid = aggSig.VerifyInsecureAggregated(pubKeys, msgHashes, jobs.front().legacyScheme);
             if (allValid) {
                 for (size_t i = 0; i < pubKeys.size(); i++) {
                     jobs[indexes[i]].doneCallback(true);
@@ -920,7 +921,7 @@ void CBLSWorker::PushSigVerifyBatch()
                 // TODO this could be improved if we would cache pairing results in some way as the previous aggregated verification already calculated all the pairings for the hashes
                 for (size_t i = 0; i < pubKeys.size(); i++) {
                     const auto& job = jobs[indexes[i]];
-                    bool valid = job.sig.VerifyInsecure(job.pubKey, job.msgHash);
+                    bool valid = job.sig.VerifyInsecure(job.pubKey, job.msgHash, job.legacyScheme);
                     job.doneCallback(valid);
                 }
             }
diff --git a/src/bls/bls_worker.h b/src/bls/bls_worker.h
index 74c7ffe67d9b..fe3fc71410b6 100644
--- a/src/bls/bls_worker.h
+++ b/src/bls/bls_worker.h
@@ -35,12 +35,16 @@ class CBLSWorker
         CBLSSignature sig;
         CBLSPublicKey pubKey;
         uint256 msgHash;
-        SigVerifyJob(SigVerifyDoneCallback&& _doneCallback, CancelCond&& _cancelCond, const CBLSSignature& _sig, CBLSPublicKey _pubKey, const uint256& _msgHash) :
+        //! The submitting thread's scheme; the job runs on a worker thread
+        bool legacyScheme;
+        SigVerifyJob(SigVerifyDoneCallback&& _doneCallback, CancelCond&& _cancelCond, const CBLSSignature& _sig,
+                     CBLSPublicKey _pubKey, const uint256& _msgHash, bool _legacyScheme) :
             doneCallback(_doneCallback),
             cancelCond(_cancelCond),
             sig(_sig),
             pubKey(std::move(_pubKey)),
-            msgHash(_msgHash)
+            msgHash(_msgHash),
+            legacyScheme(_legacyScheme)
         {
         }
     };
diff --git a/src/chainlock/clsig.cpp b/src/chainlock/clsig.cpp
index 9313824eb007..8b1dc44491a7 100644
--- a/src/chainlock/clsig.cpp
+++ b/src/chainlock/clsig.cpp
@@ -86,9 +86,9 @@ class DecodedSignatureCache
     CBLSSignature Decode(const std::array<uint8_t, CBLSSignature::SerSize>& bytes) EXCLUSIVE_LOCKS_REQUIRED(!m_mutex)
     {
         // Decode exactly as the coinbase payload was always decoded: under the
-        // process-wide scheme flag, including its opposite-scheme rejection. The
-        // flag is part of the key so a transient value cannot leak into later calls.
-        const bool legacy = bls::bls_legacy_scheme.load();
+        // effective scheme, including its opposite-scheme rejection. The scheme is
+        // part of the key so another context's value cannot leak into later calls.
+        const bool legacy = bls::EffectiveLegacyScheme();
         const uint256 key = (CHashWriter(SER_GETHASH, 0) << Span{bytes} << legacy).GetHash();
         CBLSSignature sig;
         {
diff --git a/src/evo/mnhftx.cpp b/src/evo/mnhftx.cpp
index 1a2555cd3628..a113e487604f 100644
--- a/src/evo/mnhftx.cpp
+++ b/src/evo/mnhftx.cpp
@@ -387,10 +387,10 @@ bool CMNHFManager::ForceSignalDBUpdate(const CBlockIndex* tip)
     // force ehf signals db update
     auto dbTx = m_evoDb.BeginTransaction();
 
-    const bool last_legacy = bls::bls_legacy_scheme.load();
-    bls::bls_legacy_scheme.store(false);
-    GetSignalsStage(tip);
-    bls::bls_legacy_scheme.store(last_legacy);
+    {
+        const bls::ScopedLegacySchemeOverride basic_scheme{/*legacy=*/false};
+        GetSignalsStage(tip);
+    }
 
     dbTx->Commit();
     // flush it to disk
diff --git a/src/evo/specialtxman.cpp b/src/evo/specialtxman.cpp
index eb2f68cb730a..fb2bd6b890cf 100644
--- a/src/evo/specialtxman.cpp
+++ b/src/evo/specialtxman.cpp
@@ -1092,11 +1092,11 @@ bool CSpecialTxProcessor::ProcessSpecialTxsInBlock(Chainstate& chainstate, const
         LogPrint(BCLog::BENCHMARK, "      - m_mnhfman->ProcessBlock: %.2fms [%.2fs]\n", Ticks<MillisecondsDouble>(nTime8 - nTime7),
                  Ticks<SecondsDouble>(nTimeMnehf));
 
-        if (DeploymentActiveAfter(pindex, m_consensus_params, Consensus::DEPLOYMENT_V19) && bls::bls_legacy_scheme.load()) {
+        if (DeploymentActiveAfter(pindex, m_consensus_params, Consensus::DEPLOYMENT_V19) && bls::EffectiveLegacyScheme()) {
             // NOTE: The block next to the activation is the one that is using new rules.
             // V19 activated just activated, so we must switch to the new rules here.
-            bls::bls_legacy_scheme.store(false);
-            LogPrintf("CSpecialTxProcessor::%s -- bls_legacy_scheme=%d\n", __func__, bls::bls_legacy_scheme.load());
+            bls::SetEffectiveLegacyScheme(false);
+            LogPrintf("CSpecialTxProcessor::%s -- bls_legacy_scheme=%d\n", __func__, bls::EffectiveLegacyScheme());
         }
     } catch (const EvoDbInconsistencyError& e) {
         // Local EvoDB corruption detected below (the node is already
@@ -1114,14 +1114,14 @@ bool CSpecialTxProcessor::UndoSpecialTxsInBlock(const Chainstate& chainstate, co
 {
     AssertLockHeld(::cs_main);
 
-    auto bls_legacy_scheme = bls::bls_legacy_scheme.load();
+    const bool bls_legacy_scheme{bls::EffectiveLegacyScheme()};
 
     try {
         if (!DeploymentActiveAt(*pindex, m_consensus_params, Consensus::DEPLOYMENT_V19) && !bls_legacy_scheme) {
             // NOTE: The block next to the activation is the one that is using new rules.
             // Removing the activation block here, so we must switch back to the old rules.
-            bls::bls_legacy_scheme.store(true);
-            LogPrintf("CSpecialTxProcessor::%s -- bls_legacy_scheme=%d\n", __func__, bls::bls_legacy_scheme.load());
+            bls::SetEffectiveLegacyScheme(true);
+            LogPrintf("CSpecialTxProcessor::%s -- bls_legacy_scheme=%d\n", __func__, bls::EffectiveLegacyScheme());
         }
 
         if (!m_mnhfman->UndoBlock(block, pindex)) {
@@ -1136,8 +1136,8 @@ bool CSpecialTxProcessor::UndoSpecialTxsInBlock(const Chainstate& chainstate, co
             return false;
         }
     } catch (const std::exception& e) {
-        bls::bls_legacy_scheme.store(bls_legacy_scheme);
-        LogPrintf("CSpecialTxProcessor::%s -- bls_legacy_scheme=%d\n", __func__, bls::bls_legacy_scheme.load());
+        bls::SetEffectiveLegacyScheme(bls_legacy_scheme);
+        LogPrintf("CSpecialTxProcessor::%s -- bls_legacy_scheme=%d\n", __func__, bls::EffectiveLegacyScheme());
         LogError("CSpecialTxProcessor::%s -- FAILURE! %s\n", __func__, e.what());
         return false;
     }
diff --git a/src/llmq/dkgmessages.h b/src/llmq/dkgmessages.h
index 7080779abf2f..6ddba6a752a2 100644
--- a/src/llmq/dkgmessages.h
+++ b/src/llmq/dkgmessages.h
@@ -55,7 +55,7 @@ class CDKGContribution
         s >> quorumHash;
         s >> proTxHash;
         // Decode the whole vvec under one scheme, so that vvecLegacyScheme describes every point in it
-        vvecLegacyScheme = bls::bls_legacy_scheme.load();
+        vvecLegacyScheme = bls::EffectiveLegacyScheme();
         for (uint64_t i = 0, size = ReadCompactSize(s); i < size; i++) {
             s >> CBLSPublicKeyVersionWrapper(tmp1.emplace_back(), vvecLegacyScheme);
         }
diff --git a/src/llmq/signing.h b/src/llmq/signing.h
index b2ee2d22ba00..b11cba7379c8 100644
--- a/src/llmq/signing.h
+++ b/src/llmq/signing.h
@@ -82,7 +82,7 @@ class CRecoveredSig : virtual public CSigBase
     CRecoveredSig(Consensus::LLMQType _llmqType, const uint256& _quorumHash, const uint256& _id, const uint256& _msgHash, const CBLSLazySignature& _sig) :
                   CSigBase(_llmqType, _quorumHash, _id, _msgHash), sig(_sig) {UpdateHash();};
     CRecoveredSig(Consensus::LLMQType _llmqType, const uint256& _quorumHash, const uint256& _id, const uint256& _msgHash, const CBLSSignature& _sig) :
-                  CSigBase(_llmqType, _quorumHash, _id, _msgHash) {const_cast<CBLSLazySignature&>(sig).Set(_sig, bls::bls_legacy_scheme.load()); UpdateHash();};
+                  CSigBase(_llmqType, _quorumHash, _id, _msgHash) {const_cast<CBLSLazySignature&>(sig).Set(_sig, bls::EffectiveLegacyScheme()); UpdateHash();};
 
 private:
     // only in-memory
diff --git a/src/llmq/signing_shares.cpp b/src/llmq/signing_shares.cpp
index 5dd6ce91a3bc..566bccf8a361 100644
--- a/src/llmq/signing_shares.cpp
+++ b/src/llmq/signing_shares.cpp
@@ -1569,7 +1569,7 @@ std::optional<CSigShare> CSigSharesManager::CreateSigShareForSingleMember(const
 
     // TODO: This one should be SIGN by QUORUM key, not by OPERATOR key
     // see TODO in CDKGSession::FinalizeSingleCommitment for details
-    auto bls_scheme = bls::bls_legacy_scheme.load();
+    auto bls_scheme = bls::EffectiveLegacyScheme();
     sigShare.sigShare.Set(m_mn_activeman.Sign(signHash, bls_scheme), bls_scheme);
 
     if (!sigShare.sigShare.Get().IsValid()) {
@@ -1624,7 +1624,7 @@ std::optional<CSigShare> CSigSharesManager::CreateSigShare(const CQuorum& quorum
     CSigShare sigShare(quorum.params.type, quorum.qc->quorumHash, id, msgHash, static_cast<uint16_t>(memberIdx), {});
     uint256 signHash = sigShare.buildSignHash().Get();
 
-    auto bls_scheme = bls::bls_legacy_scheme.load();
+    auto bls_scheme = bls::EffectiveLegacyScheme();
     sigShare.sigShare.Set(skShare.Sign(signHash, bls_scheme), bls_scheme);
     if (!sigShare.sigShare.Get().IsValid()) {
         LogPrintf("CSigSharesManager::%s -- failed to sign sigShare. signHash=%s, id=%s, msgHash=%s, time=%s\n", __func__,
diff --git a/src/llmq/utils.cpp b/src/llmq/utils.cpp
index 0d34b0c43dcf..20a8c0ec3bd8 100644
--- a/src/llmq/utils.cpp
+++ b/src/llmq/utils.cpp
@@ -563,12 +563,12 @@ BlsCheck::~BlsCheck() = default;
 bool BlsCheck::operator()()
 {
     if (m_pubkeys.size() > 1) {
-        if (!m_sig.VerifySecureAggregated(m_pubkeys, m_msg_hash)) {
+        if (!m_sig.VerifySecureAggregated(m_pubkeys, m_msg_hash, m_legacy_scheme)) {
             LogPrint(BCLog::LLMQ, "%s\n", m_id_string);
             return false;
         }
     } else if (m_pubkeys.size() == 1) {
-        if (!m_sig.VerifyInsecure(m_pubkeys.back(), m_msg_hash)) {
+        if (!m_sig.VerifyInsecure(m_pubkeys.back(), m_msg_hash, m_legacy_scheme)) {
             LogPrint(BCLog::LLMQ, "%s\n", m_id_string);
             return false;
         }
@@ -586,6 +586,7 @@ void BlsCheck::swap(BlsCheck& obj) noexcept
     std::swap(m_pubkeys, obj.m_pubkeys);
     std::swap(m_msg_hash, obj.m_msg_hash);
     std::swap(m_id_string, obj.m_id_string);
+    std::swap(m_legacy_scheme, obj.m_legacy_scheme);
 }
 
 std::optional<std::vector<CDeterministicMNCPtr>> ComputeQuorumMembersFromWorkBlock(
diff --git a/src/llmq/utils.h b/src/llmq/utils.h
index 65c4c2682808..fe45ecf195d1 100644
--- a/src/llmq/utils.h
+++ b/src/llmq/utils.h
@@ -48,6 +48,8 @@ struct BlsCheck {
     std::vector<CBLSPublicKey> m_pubkeys;
     uint256 m_msg_hash;
     std::string m_id_string;
+    //! The building thread's scheme; CCheckQueue runs the check on another thread
+    bool m_legacy_scheme{bls::EffectiveLegacyScheme()};
 
 public:
     BlsCheck();
diff --git a/src/node/chainstate.cpp b/src/node/chainstate.cpp
index ea001791d571..13ecf5e54839 100644
--- a/src/node/chainstate.cpp
+++ b/src/node/chainstate.cpp
@@ -437,13 +437,6 @@ ChainstateLoadResult VerifyLoadedChainstate(ChainstateManager& chainman, const C
                 break;
             } // no default case, so the compiler can warn about missing cases
 
-            // VerifyDB() disconnects blocks which might result in us switching back to legacy.
-            // Make sure we use the right scheme.
-            if (v19active && bls::bls_legacy_scheme.load()) {
-                bls::bls_legacy_scheme.store(false);
-                if (notify_bls_state) notify_bls_state(bls::bls_legacy_scheme.load());
-            }
-
             if (options.check_level >= 3) {
                 chainstate->ResetBlockFailureFlags(nullptr);
             }
diff --git a/src/node/miner.cpp b/src/node/miner.cpp
index ca84a4b531da..aa3373b449a3 100644
--- a/src/node/miner.cpp
+++ b/src/node/miner.cpp
@@ -356,7 +356,7 @@ std::unique_ptr<CBlockTemplate> BlockAssembler::CreateNewBlock(const CScript& sc
             if (fV20Active_context) {
                 CBLSSignature best_cl_sig;
                 const bool has_best_cl{CalcCbTxBestChainlock(m_chainlocks, m_chainstate.m_blockman, pindexPrev, cbTx.bestCLHeightDiff, best_cl_sig)};
-                cbTx.bestCLSignature.Set(best_cl_sig, bls::bls_legacy_scheme.load());
+                cbTx.bestCLSignature.Set(best_cl_sig, bls::EffectiveLegacyScheme());
                 if (has_best_cl) {
                     LogPrintf("CreateNewBlock() h[%d] CbTx bestCLHeightDiff[%d] CLSig[%s]\n", nHeight, cbTx.bestCLHeightDiff, cbTx.bestCLSignature.ToString());
                 } else {
diff --git a/src/rpc/quorums.cpp b/src/rpc/quorums.cpp
index 3d211138d3ea..90691979bfc6 100644
--- a/src/rpc/quorums.cpp
+++ b/src/rpc/quorums.cpp
@@ -702,7 +702,7 @@ static RPCHelpMan quorum_verify()
     const uint256 id(ParseHashV(request.params[1], "id"));
     const uint256 msgHash(ParseHashV(request.params[2], "msgHash"));
 
-    const bool use_bls_legacy = bls::bls_legacy_scheme.load();
+    const bool use_bls_legacy = bls::EffectiveLegacyScheme();
     CBLSSignature sig;
     if (!sig.SetHexStr(request.params[3].get_str(), use_bls_legacy)) {
         throw JSONRPCError(RPC_INVALID_PARAMETER, "invalid signature format");
diff --git a/src/test/bls_tests.cpp b/src/test/bls_tests.cpp
index 83715e84f296..9becd1b6f4df 100644
--- a/src/test/bls_tests.cpp
+++ b/src/test/bls_tests.cpp
@@ -10,6 +10,7 @@
 #include <consensus/validation.h>
 #include <crypto/common.h>
 #include <deploymentstatus.h>
+#include <kernel/notifications_interface.h>
 #include <random.h>
 #include <script/standard.h>
 #include <streams.h>
@@ -17,10 +18,15 @@
 #include <timedata.h>
 #include <util/helpers.h>
 #include <util/strencodings.h>
+#include <util/translation.h>
 #include <validation.h>
 
 #include <boost/test/unit_test.hpp>
 
+#include <future>
+#include <memory>
+#include <thread>
+
 BOOST_AUTO_TEST_SUITE(bls_tests)
 
 void FuncSign(const bool legacy_scheme)
@@ -317,7 +323,8 @@ static void AddCancellingMessages(std::vector<Message>& vec, uint32_t sourceId1,
     m2.valid = false;
 }
 
-static void Verify(std::vector<Message>& vec, bool secureVerification, bool perMessageFallback)
+static void Verify(std::vector<Message>& vec, bool secureVerification, bool perMessageFallback,
+                   bool verifyUnderOppositeScheme)
 {
     CBLSBatchVerifier<uint32_t, uint32_t> batchVerifier(secureVerification, perMessageFallback);
 
@@ -332,7 +339,14 @@ static void Verify(std::vector<Message>& vec, bool secureVerification, bool perM
         batchVerifier.PushMessage(m.sourceId, m.msgId, m.msgHash, m.sig, m.pk);
     }
 
-    batchVerifier.Verify();
+    if (verifyUnderOppositeScheme) {
+        std::thread{[&] {
+            const bls::ScopedLegacySchemeOverride opposite{!bls::EffectiveLegacyScheme()};
+            batchVerifier.Verify();
+        }}.join();
+    } else {
+        batchVerifier.Verify();
+    }
 
     BOOST_CHECK(batchVerifier.badSources == expectedBadSources);
 
@@ -345,10 +359,13 @@ static void Verify(std::vector<Message>& vec, bool secureVerification, bool perM
 
 static void Verify(std::vector<Message>& vec)
 {
-    Verify(vec, false, false);
-    Verify(vec, true, false);
-    Verify(vec, false, true);
-    Verify(vec, true, true);
+    // A batch verifies under the scheme it was built under, wherever Verify() runs
+    for (const bool verifyUnderOppositeScheme : {false, true}) {
+        Verify(vec, false, false, verifyUnderOppositeScheme);
+        Verify(vec, true, false, verifyUnderOppositeScheme);
+        Verify(vec, false, true, verifyUnderOppositeScheme);
+        Verify(vec, true, true, verifyUnderOppositeScheme);
+    }
 }
 
 void FuncBatchVerifier(const bool legacy_scheme)
@@ -956,6 +973,98 @@ BOOST_AUTO_TEST_CASE(test_get_hash_consistency)
     BOOST_CHECK(hash1 == hash2);
 }
 
+BOOST_AUTO_TEST_CASE(scheme_override_is_per_thread_and_nests)
+{
+    const bool saved_scheme{bls::bls_legacy_scheme.load()};
+    bls::bls_legacy_scheme.store(false);
+    {
+        bls::ScopedLegacySchemeOverride outer{true};
+        BOOST_CHECK(bls::EffectiveLegacyScheme());
+        bool other_thread{true};
+        std::thread{[&] { other_thread = bls::EffectiveLegacyScheme(); }}.join();
+        BOOST_CHECK(!other_thread);
+        {
+            // A committed scope hands its scheme to the enclosing override...
+            bls::ScopedLegacySchemeOverride inner{true};
+            bls::SetEffectiveLegacyScheme(false);
+            inner.Commit();
+        }
+        BOOST_CHECK(!bls::EffectiveLegacyScheme());
+        {
+            // ...an uncommitted one does not.
+            bls::ScopedLegacySchemeOverride inner{true};
+        }
+        BOOST_CHECK(!bls::EffectiveLegacyScheme());
+        outer.Commit();
+    }
+    // The outermost override ends with its scope, committed or not, and never
+    // touched the process-wide scheme.
+    BOOST_CHECK(!bls::ScopedLegacySchemeOverride::Active());
+    BOOST_CHECK(!bls::bls_legacy_scheme.load());
+    bls::SetEffectiveLegacyScheme(true);
+    BOOST_CHECK(bls::bls_legacy_scheme.load());
+    bls::bls_legacy_scheme.store(saved_scheme);
+}
+
+BOOST_AUTO_TEST_CASE(worker_jobs_keep_the_submitting_scheme)
+{
+    const bool saved_scheme{bls::bls_legacy_scheme.load()};
+    CBLSSecretKey sk;
+    sk.MakeNewKey();
+    const CBLSPublicKey pk{sk.GetPublicKey()};
+
+    struct Job {
+        bool submitLegacy;
+        bool signedLegacy;
+    };
+    // The single worker thread is held while a phase is queued, so its verification batches are fixed: the first
+    // job runs alone and each scheme change starts a new batch. Phase 1: an aggregated batch that passes, then a
+    // signature that would pass if it joined that batch. Phase 2: a batch that falls back to per-signature checks,
+    // then one whose signatures are valid only under the scheme it was not submitted under.
+    const std::vector<std::vector<Job>> phases{
+        {{true, true}, {true, true}, {true, true}, {false, true}},
+        {{false, false}, {false, true}, {false, false}, {true, false}, {true, false}},
+    };
+
+    for (const bool processScheme : {false, true}) {
+        bls::bls_legacy_scheme.store(processScheme);
+        CBLSWorker worker;
+        worker.Start(1);
+        for (const auto& phase : phases) {
+            std::promise<void> held;
+            std::promise<void> release;
+            worker.AsyncSign(sk, GetRandHash(), [&held, released = release.get_future().share()](const CBLSSignature&) {
+                held.set_value();
+                released.wait();
+            });
+            held.get_future().wait();
+            BOOST_REQUIRE(!worker.IsAsyncVerifyInProgress());
+
+            std::vector<uint256> hashes;
+            std::vector<std::future<bool>> verified;
+            std::vector<std::future<CBLSSignature>> signatures;
+            for (const auto& job : phase) {
+                const bls::ScopedLegacySchemeOverride submit{job.submitLegacy};
+                const uint256& hash{hashes.emplace_back(GetRandHash())};
+                verified.emplace_back(worker.AsyncVerifySig(sk.Sign(hash, job.signedLegacy), pk, hash));
+                auto signature{std::make_shared<std::promise<CBLSSignature>>()};
+                signatures.emplace_back(signature->get_future());
+                worker.AsyncSign(sk, hash, [signature](const CBLSSignature& sig) { signature->set_value(sig); });
+            }
+            release.set_value();
+
+            for (size_t i{0}; i < phase.size(); ++i) {
+                BOOST_CHECK_EQUAL(verified[i].get(), phase[i].submitLegacy == phase[i].signedLegacy);
+                const CBLSSignature sig{signatures[i].get()};
+                BOOST_CHECK(sig.VerifyInsecure(pk, hashes[i], phase[i].submitLegacy));
+                BOOST_CHECK(!sig.VerifyInsecure(pk, hashes[i], !phase[i].submitLegacy));
+            }
+        }
+        worker.Stop();
+    }
+    bls::bls_legacy_scheme.store(saved_scheme);
+}
+
 BOOST_AUTO_TEST_CASE(v19_boundary_validation_failure_restores_bls_scheme)
 {
     TestChainV19Setup setup;
@@ -993,6 +1102,33 @@ BOOST_AUTO_TEST_CASE(v19_boundary_validation_failure_restores_bls_scheme)
     (void)chainman.ProcessNewBlock(std::make_shared<const CBlock>(connect_block), /*force_processing=*/true, /*new_block=*/nullptr);
     BOOST_CHECK_EQUAL(WITH_LOCK(::cs_main, return chainman.ActiveChain().Height()), height_before_invalid_block);
     BOOST_CHECK(bls::bls_legacy_scheme.load());
+
+    // `verifychain 4` disconnects and reconnects blocks across V19 under
+    // cs_main while other threads keep verifying for the active chain.
+    // progress() runs before every block VerifyDB checks or reconnects.
+    setup.mineBlocks(2);
+    BOOST_REQUIRE(!bls::bls_legacy_scheme.load());
+    struct SchemeProbe : kernel::Notifications {
+        bool saw_legacy{false};
+        bool global_stayed_basic{true};
+        void progress(const bilingual_str&, int, bool) override
+        {
+            saw_legacy |= bls::EffectiveLegacyScheme();
+            global_stayed_basic &= !bls::bls_legacy_scheme.load();
+        }
+    } probe;
+    {
+        LOCK(::cs_main);
+        Chainstate& chainstate{chainman.ActiveChainstate()};
+        const int last_legacy_height{chainman.GetConsensus().DeploymentHeight(Consensus::DEPLOYMENT_V19) - 1};
+        BOOST_CHECK(CVerifyDB{probe}.VerifyDB(chainstate, chainman.GetConsensus(), chainstate.CoinsTip(), *Assert(setup.m_node.evodb),
+                                              /*nCheckLevel=*/4, /*nCheckDepth=*/chainstate.m_chain.Height() - last_legacy_height + 1) ==
+                    VerifyDBResult::SUCCESS);
+    }
+    BOOST_CHECK_MESSAGE(probe.saw_legacy, "VerifyDB must cross V19 on its own thread");
+    BOOST_CHECK_MESSAGE(probe.global_stayed_basic, "VerifyDB must not switch the running node to the legacy scheme");
+    BOOST_CHECK(!bls::bls_legacy_scheme.load());
+    BOOST_CHECK(!bls::ScopedLegacySchemeOverride::Active());
 }
 
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/test/llmq_utils_tests.cpp b/src/test/llmq_utils_tests.cpp
index 0978a2e3ba3e..afd224a08c1e 100644
--- a/src/test/llmq_utils_tests.cpp
+++ b/src/test/llmq_utils_tests.cpp
@@ -7,6 +7,7 @@
 
 #include <bls/bls.h>
 #include <chainparams.h>
+#include <checkqueue.h>
 #include <consensus/params.h>
 #include <dbwrapper.h>
 #include <llmq/context.h>
@@ -459,6 +460,53 @@ BOOST_AUTO_TEST_CASE(sig_share_batch_verifier_judges_each_sender_by_its_own_shar
     }
 }
 
+BOOST_AUTO_TEST_CASE(bls_check_keeps_the_scheme_it_was_built_under)
+{
+    // ConnectBlock builds commitment checks under its chainstate's scheme, which
+    // may be a thread-local one, and CCheckQueue runs them on other threads.
+    CCheckQueue<utils::BlsCheck> queue{/*nBatchSizeIn=*/1};
+    queue.StartWorkerThreads(/*threads_num=*/2);
+    const bool saved_scheme{bls::bls_legacy_scheme.load()};
+    const uint256 msg_hash{GetRandHash()};
+    std::vector<CBLSSecretKey> sks(3);
+    std::vector<CBLSPublicKey> pks;
+    for (auto& sk : sks) {
+        sk.MakeNewKey();
+        pks.push_back(sk.GetPublicKey());
+    }
+    for (const bool legacy : {true, false}) {
+        bls::bls_legacy_scheme.store(!legacy);
+        std::vector<CBLSSignature> sigs;
+        sigs.reserve(sks.size());
+        for (const auto& sk : sks) {
+            sigs.push_back(sk.Sign(msg_hash, legacy));
+        }
+        const CBLSSignature members_sig{[&] {
+            const bls::ScopedLegacySchemeOverride signer_scheme{legacy};
+            return CBLSSignature::AggregateSecure(sigs, pks, msg_hash);
+        }()};
+        const auto build = [&](bool scheme) {
+            const bls::ScopedLegacySchemeOverride override{scheme};
+            std::vector<utils::BlsCheck> checks;
+            checks.emplace_back(sigs[0], std::vector<CBLSPublicKey>{pks[0]}, msg_hash, "quorum sig");
+            checks.emplace_back(members_sig, pks, msg_hash, "members sig");
+            return checks;
+        };
+        const auto run = [&](std::vector<utils::BlsCheck> checks) {
+            CCheckQueueControl<utils::BlsCheck> control{&queue};
+            control.Add(std::move(checks));
+            return control.Wait();
+        };
+        BOOST_CHECK(run(build(legacy)));
+        // One at a time, so neither check's rejection masks the other's
+        for (const auto& check : build(!legacy)) {
+            BOOST_CHECK(!run({check}));
+        }
+    }
+    bls::bls_legacy_scheme.store(saved_scheme);
+    queue.StopWorkerThreads();
+}
+
 BOOST_AUTO_TEST_CASE(batched_sig_shares_rejects_oversized_inner_vector)
 {
     CDataStream stream{SER_NETWORK, PROTOCOL_VERSION};
diff --git a/src/test/quorum_proofs_tests.cpp b/src/test/quorum_proofs_tests.cpp
index 7aab713dcd3b..a605ed75c70b 100644
--- a/src/test/quorum_proofs_tests.cpp
+++ b/src/test/quorum_proofs_tests.cpp
@@ -2,6 +2,7 @@
 // Distributed under the MIT software license, see the accompanying file COPYING.
 #include <boost/test/unit_test.hpp>
 #include <algorithm>
+#include <bls/bls_batchverifier.h>
 #include <chainlock/clsig.h>
 #include <chainparamsbase.h>
 #include <consensus/merkle.h>
@@ -22,6 +23,7 @@
 #include <set>
 #include <streams.h>
 #include <test/util/setup_common.h>
+#include <thread>
 #include <validation.h>
 
 // Actual testnet archive proof, heights 1548500 -> 1549547. Independently
@@ -476,6 +478,65 @@ BOOST_FIXTURE_TEST_CASE(consensus_valid_envelopes_are_provable, QuorumProofGener
     BOOST_CHECK_THROW(llmq::EncodeBootstrap(*proof, wrong, {record}), std::runtime_error);
     BOOST_CHECK(state.blockHash == proof->target.header.GetHash());
 }
+BOOST_FIXTURE_TEST_CASE(chainlock_verification_ignores_another_threads_scheme, QuorumProofGenerationSetup)
+{
+    // A background chainstate validating history across V19 holds its own BLS
+    // scheme while other threads verify ChainLocks and recovered signatures for
+    // the active chain.
+    CreateHistory();
+    const auto& consensus = Params().GetConsensus();
+    const auto params = *Params().GetLLMQ(consensus.llmqTypeChainLocks);
+    const auto& qman = *m_node.llmq_ctx->qman;
+    const auto& chain = *WITH_LOCK(cs_main, return &m_node.chainman->ActiveChain());
+    const auto* locked = WITH_LOCK(cs_main, return chain.Tip());
+    const auto* start = WITH_LOCK(cs_main, return llmq::SelectQuorumForSigningStartBlock(chain, locked->nHeight));
+    const uint256 request_id{chainlock::GenSigRequestId(locked->nHeight)};
+    const auto signer = llmq::SelectCommitmentForSigning(params, qman, request_id, start);
+    BOOST_REQUIRE(signer);
+    const auto match = std::find_if(commitments.begin(), commitments.end(),
+                                    [&](const auto& qc) { return qc.quorumHash == signer->quorumHash; });
+    BOOST_REQUIRE(match != commitments.end());
+    const CBLSSecretKey& key{keys[match - commitments.begin()]};
+    const uint256 sign_hash{llmq::SignHash{params.type, signer->quorumHash, request_id, locked->GetBlockHash()}.Get()};
+    const auto make_clsig = [&](bool legacy) {
+        return chainlock::ChainLockSig{locked->nHeight, locked->GetBlockHash(), key.Sign(sign_hash, legacy)};
+    };
+    const auto verify = [&](const chainlock::ChainLockSig& clsig) {
+        return chainlock::VerifyChainLock(consensus, qman, clsig, start);
+    };
+    const auto batch_clean = [&](const chainlock::ChainLockSig& clsig) {
+        CBLSBatchVerifier<int, uint256> batch_verifier(/*_secureVerification=*/false, /*_perMessageFallback=*/false);
+        batch_verifier.PushMessage(/*sourceId=*/0, ::SerializeHash(clsig), sign_hash, clsig.getSig(),
+                                   signer->quorumPublicKey);
+        batch_verifier.Verify();
+        return batch_verifier.badSources.empty();
+    };
+
+    const bool saved_scheme{bls::bls_legacy_scheme.load()};
+    for (const bool background_legacy : {true, false}) {
+        bls::bls_legacy_scheme.store(!background_legacy);
+        const auto active_clsig{make_clsig(!background_legacy)};
+        llmq::VerifyRecSigStatus background_own{llmq::VerifyRecSigStatus::NoQuorum};
+        llmq::VerifyRecSigStatus background_active{llmq::VerifyRecSigStatus::NoQuorum};
+        llmq::VerifyRecSigStatus other_thread{llmq::VerifyRecSigStatus::NoQuorum};
+        bool other_thread_batch_clean{false};
+        {
+            const bls::ScopedLegacySchemeOverride scheme{background_legacy};
+            background_own = verify(make_clsig(background_legacy));
+            background_active = verify(active_clsig);
+            std::thread{[&] {
+                other_thread = verify(active_clsig);
+                other_thread_batch_clean = batch_clean(active_clsig);
+            }}.join();
+        }
+        BOOST_CHECK(background_own == llmq::VerifyRecSigStatus::Valid);
+        BOOST_CHECK(background_active == llmq::VerifyRecSigStatus::Invalid);
+        BOOST_CHECK(other_thread == llmq::VerifyRecSigStatus::Valid);
+        BOOST_CHECK(other_thread_batch_clean);
+    }
+    bls::bls_legacy_scheme.store(saved_scheme);
+}
+
 BOOST_AUTO_TEST_CASE(real_testnet_wire_and_crypto) {
     auto bytes = ParseHex(TESTNET_PROOF);
     auto proof = llmq::QuorumProofChain::Decode(bytes);
diff --git a/src/test/validation_chainstate_tests.cpp b/src/test/validation_chainstate_tests.cpp
index 925537c8fe82..80d0722257b9 100644
--- a/src/test/validation_chainstate_tests.cpp
+++ b/src/test/validation_chainstate_tests.cpp
@@ -3,7 +3,10 @@
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 //
 #include <bls/bls.h>
+#include <bls/bls_batchverifier.h>
 #include <chainparams.h>
+#include <coins.h>
+#include <consensus/amount.h>
 #include <consensus/validation.h>
 #include <evo/evodb.h>
 #include <evo/deterministicmns.h>
@@ -11,6 +14,7 @@
 #include <node/interface_ui.h>
 #include <random.h>
 #include <rpc/blockchain.h>
+#include <script/script.h>
 #include <sync.h>
 #include <test/util/chainstate.h>
 #include <test/util/coins.h>
@@ -18,9 +22,13 @@
 #include <test/util/setup_common.h>
 #include <uint256.h>
 #include <util/check.h>
+#include <util/translation.h>
 #include <validation.h>
 #include <validationinterface.h>
 
+#include <functional>
+#include <thread>
+#include <utility>
 #include <vector>
 
 #include <boost/signals2/connection.hpp>
@@ -42,6 +50,39 @@ class TipEventCounter final : public CValidationInterface
     void ChainStateFlushed(const CBlockLocator&) override { ++chainstate_flushed; }
 };
 
+//! Runs a probe once, from inside the first ConnectTip that checks a block:
+//! after ConnectBlock committed it and before the tip moves.
+class BlockCheckedProbe final : public CValidationInterface
+{
+public:
+    std::function<void()> probe;
+
+    void BlockChecked(const CBlock&, const BlockValidationState& state) override
+    {
+        if (probe && state.IsValid()) std::exchange(probe, nullptr)();
+    }
+};
+
+//! Whether a thread with no scheme override accepts a fresh signature made
+//! under `legacy`, alone and batched.
+bool AnotherThreadAccepts(bool legacy)
+{
+    CBLSSecretKey sk;
+    sk.MakeNewKey();
+    const CBLSPublicKey pk{sk.GetPublicKey()};
+    const uint256 msg_hash{InsecureRand256()};
+    const CBLSSignature sig{sk.Sign(msg_hash, legacy)};
+    bool valid{false}, batch_clean{false};
+    std::thread{[&] {
+        valid = sig.VerifyInsecure(pk, msg_hash);
+        CBLSBatchVerifier<int, uint256> batch_verifier(/*_secureVerification=*/false, /*_perMessageFallback=*/false);
+        batch_verifier.PushMessage(/*sourceId=*/0, msg_hash, msg_hash, sig, pk);
+        batch_verifier.Verify();
+        batch_clean = batch_verifier.badSources.empty();
+    }}.join();
+    return valid && batch_clean;
+}
+
 } // namespace
 
 BOOST_FIXTURE_TEST_SUITE(validation_chainstate_tests, ChainTestingSetup)
@@ -195,6 +236,15 @@ struct V19AboveSnapshotSetup : public TestChain100Setup {
     }
 };
 
+//! The reverse: the snapshot base is past V19, and the background
+//! chainstate's genesis tip is not.
+struct V19BelowSnapshotSetup : public TestChain100Setup {
+    V19BelowSnapshotSetup() :
+        TestChain100Setup{ChainType::REGTEST, {"-testactivationheight=v19@50"}}
+    {
+    }
+};
+
 //! bls::bls_legacy_scheme is process-wide but its correct value is per-block, and
 //! ProcessSpecialTxsInBlock only ever switches legacy -> basic. ConnectBlock must
 //! therefore establish the scheme its parent left behind instead of inheriting
@@ -215,8 +265,10 @@ BOOST_FIXTURE_TEST_CASE(chainstate_connectblock_bls_scheme, V19AboveSnapshotSetu
     // Reach the assumeutxo height and take a snapshot, then take the snapshot
     // chainstate past V19 so the process-wide flag is basic again.
     mineBlocks(9);
+    bls::bls_legacy_scheme.store(false);
     BOOST_REQUIRE(CreateAndActivateUTXOSnapshot(this, NoMalleation, /*reset_chainstate=*/true));
     BOOST_REQUIRE(WITH_LOCK(::cs_main, return chainman.IsSnapshotActive()));
+    BOOST_CHECK_MESSAGE(bls::bls_legacy_scheme.load(), "activating a pre-V19 snapshot must establish the legacy scheme");
 
     // The background chainstate was reset to genesis before activation, so
     // the base MN list was not derivable and no lifecycle marker may have
@@ -236,23 +288,96 @@ BOOST_FIXTURE_TEST_CASE(chainstate_connectblock_bls_scheme, V19AboveSnapshotSetu
     }()};
     BOOST_REQUIRE(WITH_LOCK(::cs_main, return background_cs.m_chain.Height()) < V19_HEIGHT - 1);
 
-    std::vector<CMutableTransaction> noTxns;
-    CScript scriptPubKey = CScript() << ToByteVector(coinbaseKey.GetPubKey()) << OP_CHECKSIG;
-    auto pblock = std::make_shared<const CBlock>(this->CreateBlock(noTxns, scriptPubKey, background_cs));
-    BlockValidationState state;
+    // Give the background chainstate the next (pre-V19) block towards the
+    // snapshot base, as if downloaded again: the snapshot setup only dropped its
+    // HAVE_DATA flag, not the data.
+    const int background_height{WITH_LOCK(::cs_main, return background_cs.m_chain.Height())};
     {
         LOCK(::cs_main);
-        CBlockIndex* pindex = nullptr;
-        bool newblock = false;
-        BOOST_REQUIRE(CheckBlock(*pblock, state, Params().GetConsensus()));
-        BOOST_REQUIRE(m_node.chainman->AcceptBlock(pblock, state, &pindex, true, nullptr, &newblock));
+        CBlockIndex* next{chainman.ActiveChain()[background_height + 1]};
+        next->nStatus |= BLOCK_HAVE_DATA;
+        background_cs.TryAddBlockIndexCandidate(next);
     }
-    BOOST_REQUIRE(background_cs.ActivateBestChain(state, pblock));
+    BlockValidationState state;
+
+    // Other threads verify ChainLocks and recovered signatures for the active
+    // chain without cs_main while the background chainstate connects a block.
+    CBLSSecretKey sk;
+    sk.MakeNewKey();
+    const CBLSPublicKey pk{sk.GetPublicKey()};
+    const uint256 msg_hash{InsecureRand256()};
+    const CBLSSignature basic_sig{sk.Sign(msg_hash, /*specificLegacyScheme=*/false)};
+    bool probed{false}, background_legacy{false}, other_thread_valid{false}, other_thread_batch_clean{false};
+    auto probe{std::make_shared<BlockCheckedProbe>()};
+    probe->probe = [&] {
+        probed = true;
+        background_legacy = bls::EffectiveLegacyScheme();
+        std::thread{[&] {
+            other_thread_valid = basic_sig.VerifyInsecure(pk, msg_hash);
+            CBLSBatchVerifier<int, uint256> batch_verifier(/*_secureVerification=*/false, /*_perMessageFallback=*/false);
+            batch_verifier.PushMessage(/*sourceId=*/0, msg_hash, msg_hash, basic_sig, pk);
+            batch_verifier.Verify();
+            other_thread_batch_clean = batch_verifier.badSources.empty();
+        }}.join();
+    };
+    RegisterSharedValidationInterface(probe);
+    const bool activated{background_cs.ActivateBestChain(state, nullptr)};
+    UnregisterSharedValidationInterface(probe);
+    BOOST_REQUIRE(activated);
+    BOOST_REQUIRE_EQUAL(WITH_LOCK(::cs_main, return background_cs.m_chain.Height()), background_height + 1);
+
+    BOOST_REQUIRE(probed);
+    BOOST_CHECK_MESSAGE(background_legacy, "the background chainstate must connect a pre-V19 block under legacy");
+    BOOST_CHECK_MESSAGE(other_thread_valid, "a background connect must not change another thread's scheme");
+    BOOST_CHECK_MESSAGE(other_thread_batch_clean, "a background connect must not make another thread ban a source");
 
     // The background chainstate validated a pre-V19 block, but only the active
     // chainstate's tip may define the scheme its consumers see.
     BOOST_CHECK_MESSAGE(!bls::bls_legacy_scheme.load(),
                         "a background connect must not leave the active chain on the legacy scheme");
+    BOOST_CHECK(!bls::ScopedLegacySchemeOverride::Active());
+}
+
+//! An invalid snapshot hands the active role back to the pre-V19 background
+//! chainstate from inside its ConnectTip, under that thread's override. Other
+//! threads must get the legacy scheme immediately.
+BOOST_FIXTURE_TEST_CASE(invalid_snapshot_fallback_establishes_bls_scheme, V19AboveSnapshotSetup)
+{
+    ChainstateManager& chainman = *Assert(m_node.chainman);
+    mineBlocks(10);
+    Chainstate& background_cs{chainman.ActiveChainstate()};
+    BOOST_REQUIRE(CreateAndActivateUTXOSnapshot(this));
+    mineBlocks(V19_HEIGHT - WITH_LOCK(::cs_main, return chainman.ActiveHeight()));
+    BOOST_REQUIRE(!bls::bls_legacy_scheme.load());
+
+    bool shut_down{false};
+    {
+        LOCK(::cs_main);
+        Coin extra_coin;
+        extra_coin.out.nValue = 1 * COIN;
+        extra_coin.out.scriptPubKey = CScript{} << OP_TRUE;
+        extra_coin.nHeight = 1;
+        background_cs.CoinsTip().AddCoin(COutPoint{InsecureRand256(), 0}, std::move(extra_coin), /*possible_overwrite=*/false);
+        const bls::ScopedLegacySchemeOverride background_connect_tip{/*legacy=*/true};
+        BOOST_REQUIRE(chainman.MaybeCompleteSnapshotValidation([&](bilingual_str) { shut_down = true; }) ==
+                      SnapshotCompletionResult::HASH_MISMATCH);
+        BOOST_REQUIRE(&chainman.ActiveChainstate() == &background_cs);
+    }
+    BOOST_REQUIRE(shut_down);
+    BOOST_CHECK(bls::bls_legacy_scheme.load());
+    BOOST_CHECK(AnotherThreadAccepts(/*legacy=*/true));
+}
+
+//! Activating a post-V19 snapshot on a node still on the legacy scheme must
+//! switch other threads to basic immediately.
+BOOST_FIXTURE_TEST_CASE(snapshot_activation_establishes_bls_scheme, V19BelowSnapshotSetup)
+{
+    mineBlocks(10);
+    bls::bls_legacy_scheme.store(true);
+    BOOST_REQUIRE(CreateAndActivateUTXOSnapshot(this, NoMalleation, /*reset_chainstate=*/true));
+    BOOST_REQUIRE(WITH_LOCK(::cs_main, return m_node.chainman->IsSnapshotActive()));
+    BOOST_CHECK(!bls::bls_legacy_scheme.load());
+    BOOST_CHECK(AnotherThreadAccepts(/*legacy=*/false));
 }
 
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/validation.cpp b/src/validation.cpp
index f63a3ad06684..a0ac3e84d0f6 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -136,49 +136,64 @@ using node::GetTransaction;
 
 namespace {
 
-//! Restores bls::bls_legacy_scheme on scope exit unless Commit() is called.
-//! ConnectBlock switches the scheme while validating a block across the V19
-//! boundary; this keeps a failed or dry-run validation from leaking that
-//! change into the process-wide flag.
-//!
-//! `enter` establishes the scheme for the scope. The flag is process-wide but
-//! the correct value is per-chainstate, so a background chainstate validating
-//! pre-V19 blocks under an active post-V19 snapshot must set it on entry
-//! (ProcessSpecialTxsInBlock only ever switches legacy->basic) and must not
-//! commit it back to the active chainstate's consumers.
+//! Establishes the BLS scheme for one chain operation (`enter`; std::nullopt
+//! keeps the current one) and restores it on scope exit unless Commit() is
+//! called, so a failed or dry-run validation across the V19 boundary leaks
+//! nothing. Other threads read bls::bls_legacy_scheme outside cs_main to verify
+//! for the active chain, so only a scope that may commit the active
+//! chainstate's tip (`process_wide`) writes it; every other scope, and any
+//! scope nested in a thread-local one, sets the scheme for this thread only.
 class ScopedBLSLegacyScheme
 {
 public:
-    ScopedBLSLegacyScheme() noexcept :
-        m_saved(bls::bls_legacy_scheme.load())
+    ScopedBLSLegacyScheme(bool process_wide, std::optional<bool> enter) noexcept
     {
-    }
-    explicit ScopedBLSLegacyScheme(bool enter) noexcept :
-        m_saved(bls::bls_legacy_scheme.load())
-    {
-        if (enter != m_saved) {
-            bls::bls_legacy_scheme.store(enter);
-            LogPrintf("ScopedBLSLegacyScheme: entered bls_legacy_scheme=%d\n", enter);
+        if (!process_wide || bls::ScopedLegacySchemeOverride::Active()) {
+            m_thread_scheme.emplace(enter.value_or(bls::EffectiveLegacyScheme()));
+            return;
+        }
+        m_saved = bls::bls_legacy_scheme.load();
+        if (enter && *enter != *m_saved) {
+            bls::bls_legacy_scheme.store(*enter);
+            LogPrintf("ScopedBLSLegacyScheme: entered bls_legacy_scheme=%d\n", *enter);
         }
     }
     ~ScopedBLSLegacyScheme() noexcept
     {
-        if (!m_committed && m_saved != bls::bls_legacy_scheme.load()) {
-            bls::bls_legacy_scheme.store(m_saved);
-            LogPrintf("ScopedBLSLegacyScheme: reverted bls_legacy_scheme=%d\n", m_saved);
+        if (m_saved && !m_committed && *m_saved != bls::bls_legacy_scheme.load()) {
+            bls::bls_legacy_scheme.store(*m_saved);
+            LogPrintf("ScopedBLSLegacyScheme: reverted bls_legacy_scheme=%d\n", *m_saved);
         }
     }
 
     ScopedBLSLegacyScheme(const ScopedBLSLegacyScheme&) = delete;
     ScopedBLSLegacyScheme& operator=(const ScopedBLSLegacyScheme&) = delete;
 
-    void Commit() noexcept { m_committed = true; }
+    void Commit() noexcept
+    {
+        m_committed = true;
+        if (m_thread_scheme) m_thread_scheme->Commit();
+    }
 
 private:
-    const bool m_saved;
+    //! Process-wide scope: the scheme to restore.
+    std::optional<bool> m_saved;
+    std::optional<bls::ScopedLegacySchemeOverride> m_thread_scheme;
     bool m_committed{false};
 };
 
+//! Sets the process-wide BLS scheme from the active chainstate's tip; call it
+//! whenever a different chainstate becomes active. Writes the global directly:
+//! the switch can happen inside a background chainstate's ConnectTip, where
+//! SetEffectiveLegacyScheme() would only change that thread's override.
+void EstablishActiveBLSScheme(const ChainstateManager& chainman) EXCLUSIVE_LOCKS_REQUIRED(::cs_main)
+{
+    const bool legacy{!DeploymentActiveAfter(chainman.ActiveTip(), chainman, Consensus::DEPLOYMENT_V19)};
+    if (bls::bls_legacy_scheme.exchange(legacy) != legacy) {
+        LogPrintf("%s: bls_legacy_scheme=%d\n", __func__, legacy);
+    }
+}
+
 } // namespace
 
 const CBlockIndex* Chainstate::FindForkInGlobalIndex(const CBlockLocator& locator) const
@@ -2694,7 +2709,8 @@ bool Chainstate::ConnectBlock(const CBlock& block, BlockValidationState& state,
     // chainstate has already moved the process-wide flag to basic. Rolled back
     // below unless we fully connect the block.
     ScopedBLSLegacyScheme bls_scheme_guard{
-        !DeploymentActiveAt(*pindex, params.GetConsensus(), Consensus::DEPLOYMENT_V19)};
+        /*process_wide=*/!fJustCheck && this == &m_chainman.ActiveChainstate(),
+        /*enter=*/!DeploymentActiveAt(*pindex, params.GetConsensus(), Consensus::DEPLOYMENT_V19)};
 
     // Check it again in case a previous version let a bad block in
     // NOTE: We don't currently (re-)invoke ContextualCheckBlock() or
@@ -3461,9 +3477,12 @@ bool Chainstate::DisconnectTip(BlockValidationState& state, DisconnectedBlockTra
     // Establish that scheme here for the same reason ConnectBlock does, so the
     // invariant holds in both directions instead of depending on the caller. Also
     // restores it if disconnect post-processing fails before m_chain.SetTip()
-    // moves the tip backward.
+    // moves the tip backward. The active tip's scheme must reach the
+    // process-wide flag, so no thread-local scope may enclose this.
+    Assume(this != &m_chainman.ActiveChainstate() || !bls::ScopedLegacySchemeOverride::Active());
     ScopedBLSLegacyScheme bls_scheme_guard{
-        !DeploymentActiveAt(*pindexDelete, m_chainman.GetConsensus(), Consensus::DEPLOYMENT_V19)};
+        /*process_wide=*/this == &m_chainman.ActiveChainstate(),
+        /*enter=*/!DeploymentActiveAt(*pindexDelete, m_chainman.GetConsensus(), Consensus::DEPLOYMENT_V19)};
     // Apply the block atomically to the chain state.
     const auto time_start{SteadyClock::now()};
     {
@@ -3594,8 +3613,10 @@ bool Chainstate::ConnectTip(BlockValidationState& state, CBlockIndex* pindexNew,
     // ConnectBlock commits its BLS-scheme switch on success, but the tip isn't
     // advanced until m_chain.SetTip() below. If a step in between (e.g.
     // FlushStateToDisk) fails, restore the scheme so it stays in sync with the
-    // unchanged tip.
-    ScopedBLSLegacyScheme bls_scheme_guard;
+    // unchanged tip. As in DisconnectTip, no thread-local scope may enclose the
+    // active tip's move.
+    Assume(this != &m_chainman.ActiveChainstate() || !bls::ScopedLegacySchemeOverride::Active());
+    ScopedBLSLegacyScheme bls_scheme_guard{/*process_wide=*/this == &m_chainman.ActiveChainstate(), /*enter=*/std::nullopt};
     // Read block from disk.
     const auto time_1{SteadyClock::now()};
     std::shared_ptr<const CBlock> pthisBlock;
@@ -5234,8 +5255,9 @@ VerifyDBResult CVerifyDB::VerifyDB(
         return VerifyDBResult::SUCCESS;
     }
 
-    // ConnectBlock below switches the scheme but the tip isn't advanced here; restore it on return.
-    ScopedBLSLegacyScheme bls_scheme_guard;
+    // ConnectBlock below switches the scheme but the tip isn't advanced here, so
+    // keep it to this thread and restore it on return.
+    ScopedBLSLegacyScheme bls_scheme_guard{/*process_wide=*/false, /*enter=*/std::nullopt};
 
     // begin tx and let it rollback
     auto dbTx = evoDb.BeginTransaction(chainstate.EvoDbIdentity());
@@ -5334,7 +5356,7 @@ VerifyDBResult CVerifyDB::VerifyDB(
 
     // check level 4: try reconnecting blocks
     if (nCheckLevel >= 4 && !skipped_l3_checks) {
-        // Each successful ConnectBlock leaves the effective scheme set globally so
+        // Each successful ConnectBlock leaves its scheme set on this thread so
         // subsequent iterations see it. The outer bls_scheme_guard restores the
         // original scheme when VerifyDB returns (the chain tip isn't advanced here).
         while (pindex != chainstate.m_chain.Tip()) {
@@ -5388,7 +5410,8 @@ bool Chainstate::RollforwardBlock(const CBlockIndex* pindex, CCoinsViewCache& in
     MNListUpdates mnlist_updates;
     // Use the scheme ConnectBlock used for this block instead of whatever replay inherited
     ScopedBLSLegacyScheme bls_scheme_guard{
-        !DeploymentActiveAt(*pindex, m_chainman.GetConsensus(), Consensus::DEPLOYMENT_V19)};
+        /*process_wide=*/false,
+        /*enter=*/!DeploymentActiveAt(*pindex, m_chainman.GetConsensus(), Consensus::DEPLOYMENT_V19)};
     if (!m_special_tx.ProcessSpecialTxsInBlock(*this, m_chain, block, pindex,
                                                               GetSpecialTxRules(pindex->pprev, m_chainman), inputs,
                                                               blockSubsidy, /*fJustCheck=*/false,
@@ -6340,6 +6363,7 @@ bool ChainstateManager::ActivateSnapshot(
         assert(chaintip_loaded);
 
         m_active_chainstate = m_snapshot_chainstate.get();
+        EstablishActiveBLSScheme(*this);
         m_snapshot_chainstate->m_evoDb.SetDefaultIdentity(EvoDbIdentity::SNAPSHOT);
 
         // Move the mempool to the snapshot chainstate: only the active
@@ -6712,6 +6736,7 @@ SnapshotCompletionResult ChainstateManager::MaybeCompleteSnapshotValidation(
         LogPrintf("[snapshot] deleting snapshot, reverting to validated chain, and stopping node\n");
 
         m_active_chainstate = m_ibd_chainstate.get();
+        EstablishActiveBLSScheme(*this);
         // Hand the mempool back so the again-active background chainstate owns
         // it for the remainder of this (shutting-down) run.
         m_ibd_chainstate->m_mempool = m_snapshot_chainstate->m_mempool;