diff --git a/bip-0138.md b/bip-0138.md
index 4bf4eb52..f1f2a268 100644
--- a/bip-0138.md
+++ b/bip-0138.md
@@ -11,7 +11,7 @@
               https://groups.google.com/g/bitcoindev/c/5NgJbpVDgEc/m/TtGK9sF9BgAJ
               https://github.com/bitcoin/bips/pull/1951
   Version: 0.1.2
-  Requires: 32, 340, 380, 388, 389
+  Requires: 32, 340, 380, 388, 389, 390
 ```
 
 ## Introduction
@@ -138,8 +138,8 @@ accounts whose xpub was never sent to such a server, such as BIP48 or BIP87 acco
 
 ### Descriptor key requirements
 
-Only key expressions of the extended-public-key type with a trailing
-derivation step or wildcard contribute to $\{p_1, \dots, p_n\}$. Without
+Outside `musig()`, only key expressions of the extended-public-key type with a
+trailing derivation step or wildcard contribute to $\{p_1, \dots, p_n\}$. Without
 that derivation, the xpub's root pubkey, used to seed $s$, would also be
 the on-chain pubkey of every spend, so observing one spend would let
 anyone recompute $s$ and decrypt the backup.[^trailing-derivation] The
@@ -150,9 +150,9 @@ rule generalizes to any network prefix (`xpub`/`tpub`/`Vpub`/...).
     a wildcard, breaks the identity between the xpub root pubkey and the
     on-chain pubkey. Fixed-derivation expressions like `xpub.../0/5` are
     allowed because the on-chain key (`xpub/0/5`) already differs from the
-    encryption seed (the xpub root). Literal pubkeys and bare xpubs are
-    disallowed for the same reason: the literal value is exactly what goes
-    on-chain, so $s$ would become recoverable from a single observed spend.
+    encryption seed (the xpub root). Outside `musig()`, literal pubkeys and
+    bare xpubs are disallowed for the same reason: the literal value is exactly
+    what goes on-chain, so $s$ would become recoverable from a single observed spend.
 
 Allowed forms (origin information `[...]` is optional and orthogonal):
 
@@ -163,11 +163,18 @@ Allowed forms (origin information `[...]` is optional and orthogonal):
 | `<xpub>/<path>/*` (fixed derivation followed by a wildcard) | `xpub.../0/*`     |
 | `<xpub>/<a;b;...>` (multipath, no wildcard)                 | `xpub.../<0;1>`   |
 | `<xpub>/<a;b;...>/*` (multipath followed by a wildcard)     | `xpub.../<0;1>/*` |
+| `<xpub>` (only as a `musig()` participant)                 | `xpub...`         |
+
+Within a [BIP390](bip-0390.mediawiki) `musig()` expression, participant xpubs
+are allowed with or without trailing derivation: the aggregate on-chain key
+does not reveal the individual participant keys. For encryption, use each
+participant's xpub root rather than the aggregate key. Literal public-key
+participants remain excluded.
 
 Implementations:
 
-- MUST exclude every other form (literal pubkeys, bare xpubs, ...) from
-  $\{p_1, \dots, p_n\}$.
+- MUST exclude every other form (literal pubkeys, bare xpubs outside `musig()`,
+  ...) from $\{p_1, \dots, p_n\}$.
 - MUST refuse to encode a backup if the resulting set is empty.
 - MUST make the user aware of each excluded expression, since the
   cosigner holding that key will be unable to decrypt the backup with
diff --git a/bip-0138/test_vectors/recipient_keys.json b/bip-0138/test_vectors/recipient_keys.json
index de127951..05f4c8f0 100644
--- a/bip-0138/test_vectors/recipient_keys.json
+++ b/bip-0138/test_vectors/recipient_keys.json
@@ -71,5 +71,25 @@
       "pk(04ebd252ca0877aae09b9d058219682775aa3cbcd049c12f07832f2cf6a3b517089e956909c4c07e8529f45f3ff8904d28df5a181619e21bdf748a896322530039)"
     ],
     "expected_keys": null
+  },
+  {
+    "description": "Bare MuSig participant xpubs",
+    "descriptors": [
+      "tr(musig(tpubDEPBvXvhta3pjVaKokqC3eeMQnszj9ehFaA2zD5nSdkaccwGAizu8jVB2NeSpvmP2P52MBoZvNCixqXRJnTyXx51FQzARR63tjxQSyP3Btw,tpubDC5FSnBiZDMmhiuCmWAYsLwgLYrrT9rAqvTySfuCCrgsWz8wxMXUS9Tb9iVMvcRbvFcAHGkMD5Kx8koh4GquNGNTfohfk7pgjhaPCdXpoba))"
+    ],
+    "expected_keys": [
+      "8b42cd4776376c82791b494155151f56c2d7b471e0c7a526a7ce60dd872e3867",
+      "ebd252ca0877aae09b9d058219682775aa3cbcd049c12f07832f2cf6a3b51708"
+    ]
+  },
+  {
+    "description": "Derivation after MuSig aggregation",
+    "descriptors": [
+      "tr(musig(tpubDEPBvXvhta3pjVaKokqC3eeMQnszj9ehFaA2zD5nSdkaccwGAizu8jVB2NeSpvmP2P52MBoZvNCixqXRJnTyXx51FQzARR63tjxQSyP3Btw,tpubDC5FSnBiZDMmhiuCmWAYsLwgLYrrT9rAqvTySfuCCrgsWz8wxMXUS9Tb9iVMvcRbvFcAHGkMD5Kx8koh4GquNGNTfohfk7pgjhaPCdXpoba)/<0;1>/*)"
+    ],
+    "expected_keys": [
+      "8b42cd4776376c82791b494155151f56c2d7b471e0c7a526a7ce60dd872e3867",
+      "ebd252ca0877aae09b9d058219682775aa3cbcd049c12f07832f2cf6a3b51708"
+    ]
   }
 ]