diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 4c4a4d59cc..c6361c358a 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -31,7 +31,12 @@ set(SECP256K1_ENABLE_MODULE_WHITELIST ON CACHE BOOL "" FORCE)
 set(SECP256K1_DISABLE_SHARED ON CACHE BOOL "" FORCE)
 set(SECP256K1_ENABLE_MODULE_ECDH ON CACHE BOOL "" FORCE)
 set(SECP256K1_ENABLE_MODULE_RECOVERY ON CACHE BOOL "" FORCE)
+# Disable unused on-by-default features from secp256k1-zkp
 set(SECP256K1_ENABLE_MODULE_MUSIG OFF CACHE BOOL "" FORCE)
+set(SECP256K1_ENABLE_MODULE_BPPP OFF CACHE BOOL "" FORCE)
+set(SECP256K1_ENABLE_MODULE_ECDSA_ADAPTOR OFF CACHE BOOL "" FORCE)
+set(SECP256K1_ENABLE_MODULE_ECDSA_S2C OFF CACHE BOOL "" FORCE)
+set(SECP256K1_ENABLE_MODULE_SCHNORRSIG_HALFAGG OFF CACHE BOOL "" FORCE)
 set(SECP256K1_BUILD_BENCHMARK OFF CACHE BOOL "" FORCE)
 set(SECP256K1_BUILD_TESTS ${BUILD_TESTS} CACHE BOOL "" FORCE)
 set(SECP256K1_BUILD_EXHAUSTIVE_TESTS ${BUILD_TESTS} CACHE BOOL "" FORCE)
diff --git a/src/blind.cpp b/src/blind.cpp
index fc443d2977..67ffcb4059 100644
--- a/src/blind.cpp
+++ b/src/blind.cpp
@@ -22,6 +22,12 @@ class Blind_ECC_Init {
         secp256k1_context *ctx = secp256k1_context_create(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
         assert(ctx != nullptr);
 
+        // Pass in a random blinding seed to the secp256k1 context (side-channel hardening,
+        // matching the randomization of secp256k1_context_sign in key.cpp).
+        unsigned char randseed[32];
+        GetStrongRandBytes(randseed);
+        assert(secp256k1_context_randomize(ctx, randseed) == 1);
+
         secp256k1_blind_context = ctx;
     }
 
diff --git a/src/confidential_validation.cpp b/src/confidential_validation.cpp
index 915bbb48a7..e089bcea4b 100644
--- a/src/confidential_validation.cpp
+++ b/src/confidential_validation.cpp
@@ -4,6 +4,7 @@
 #include <issuance.h>
 #include <pegins.h>
 #include <script/sigcache.h>
+#include <random.h>
 #include <blind.h>
 
 namespace {
@@ -15,6 +16,11 @@ class CSecp256k1Init {
         assert(secp256k1_ctx_verify_amounts == nullptr);
         secp256k1_ctx_verify_amounts = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN);
         assert(secp256k1_ctx_verify_amounts != nullptr);
+        // Pass in a random blinding seed to the secp256k1 context (side-channel hardening).
+        unsigned char seed[32];
+        GetStrongRandBytes(seed);
+        assert(secp256k1_context_randomize(secp256k1_ctx_verify_amounts, seed));
+
     }
     ~CSecp256k1Init() {
         assert(secp256k1_ctx_verify_amounts != nullptr);
diff --git a/src/pegins.cpp b/src/pegins.cpp
index b09677faec..f5471cd911 100644
--- a/src/pegins.cpp
+++ b/src/pegins.cpp
@@ -35,7 +35,7 @@ class Secp256k1Ctx
 public:
     Secp256k1Ctx() {
         assert(secp256k1_ctx_validation == nullptr);
-        secp256k1_ctx_validation = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN);
+        secp256k1_ctx_validation = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
         assert(secp256k1_ctx_validation != nullptr);
     }
 
diff --git a/src/wallet/rpc/backup.cpp b/src/wallet/rpc/backup.cpp
index 67ffd6958f..548a4d0c07 100644
--- a/src/wallet/rpc/backup.cpp
+++ b/src/wallet/rpc/backup.cpp
@@ -12,6 +12,7 @@
 #include <key_io.h>
 #include <merkleblock.h>
 #include <rpc/util.h>
+#include <random.h>
 #include <script/descriptor.h>
 #include <script/script.h>
 #include <script/solver.h>
@@ -41,6 +42,11 @@ namespace {
     public:
         CSecp256k1Init() {
             secp256k1_ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN);
+            CHECK_NONFATAL(secp256k1_ctx != nullptr);
+            // Pass in a random blinding seed to the secp256k1 context (side-channel hardening).
+            unsigned char seed[32];
+            GetStrongRandBytes(seed);
+            CHECK_NONFATAL(secp256k1_context_randomize(secp256k1_ctx, seed));
         }
         ~CSecp256k1Init() {
             secp256k1_context_destroy(secp256k1_ctx);
diff --git a/src/wallet/rpc/elements.cpp b/src/wallet/rpc/elements.cpp
index 3ae240081a..5ad6f297a9 100644
--- a/src/wallet/rpc/elements.cpp
+++ b/src/wallet/rpc/elements.cpp
@@ -16,6 +16,7 @@
 #include <rpc/server.h>
 #include <rpc/server_util.h>
 #include <rpc/util.h>
+#include <random.h>
 #include <script/generic.hpp>
 #include <script/pegins.h>
 #include <secp256k1.h>
@@ -44,6 +45,11 @@ class CSecp256k1Init {
 public:
     CSecp256k1Init() {
         secp256k1_ctx = secp256k1_context_create(SECP256K1_CONTEXT_VERIFY | SECP256K1_CONTEXT_SIGN);
+        CHECK_NONFATAL(secp256k1_ctx != nullptr);
+        // Pass in a random blinding seed to the secp256k1 context (side-channel hardening).
+        unsigned char seed[32];
+        GetStrongRandBytes(seed);
+        CHECK_NONFATAL(secp256k1_context_randomize(secp256k1_ctx, seed));
     }
     ~CSecp256k1Init() {
         secp256k1_context_destroy(secp256k1_ctx);