diff --git a/CMakeLists.txt b/CMakeLists.txt
index f59fa935..21378d99 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -52,6 +52,7 @@ option(SECP256K1_ENABLE_MODULE_EXTRAKEYS "Enable extrakeys module." ON)
 option(SECP256K1_ENABLE_MODULE_SCHNORRSIG "Enable schnorrsig module." ON)
 option(SECP256K1_ENABLE_MODULE_MUSIG "Enable musig module." ON)
 option(SECP256K1_ENABLE_MODULE_FROST "Enable FROST module (experimental)." OFF)
+option(SECP256K1_ENABLE_MODULE_CHILLDKG "Enable ChillDKG module (experimental)." OFF)
 option(SECP256K1_ENABLE_MODULE_ELLSWIFT "Enable ElligatorSwift module." ON)
 
 option(SECP256K1_ENABLE_MODULE_GENERATOR "Enable NUMS generator module." ON)
@@ -299,6 +300,7 @@ message("  extrakeys ........................... ${SECP256K1_ENABLE_MODULE_EXTRA
 message("  schnorrsig .......................... ${SECP256K1_ENABLE_MODULE_SCHNORRSIG}")
 message("  musig ............................... ${SECP256K1_ENABLE_MODULE_MUSIG}")
 message("  frost ............................... ${SECP256K1_ENABLE_MODULE_FROST}")
+message("  chilldkg ............................ ${SECP256K1_ENABLE_MODULE_CHILLDKG}")
 message("  ElligatorSwift ...................... ${SECP256K1_ENABLE_MODULE_ELLSWIFT}")
 message("  generator ........................... ${SECP256K1_ENABLE_MODULE_GENERATOR}")
 message("  rangeproof .......................... ${SECP256K1_ENABLE_MODULE_RANGEPROOF}")
diff --git a/Makefile.am b/Makefile.am
index 9053929b..24128039 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -363,3 +363,7 @@ endif
 if ENABLE_MODULE_FROST
 include src/modules/frost/Makefile.am.include
 endif
+
+if ENABLE_MODULE_CHILLDKG
+include src/modules/chilldkg/Makefile.am.include
+endif
diff --git a/configure.ac b/configure.ac
index 9df02dd4..4e2f70c1 100644
--- a/configure.ac
+++ b/configure.ac
@@ -245,6 +245,11 @@ AC_ARG_ENABLE(module_frost,
     [],
     [SECP_SET_DEFAULT([enable_module_frost], [no], [yes])])
 
+AC_ARG_ENABLE(module_chilldkg,
+    AS_HELP_STRING([--enable-module-chilldkg],[enable ChillDKG module (experimental)]),
+    [],
+    [SECP_SET_DEFAULT([enable_module_chilldkg], [no], [yes])])
+
 # Test-only override of the (autodetected by the C code) "widemul" setting.
 # Legal values are:
 #  * int64 (for [u]int64_t),
@@ -551,6 +556,18 @@ if test x"$enable_module_frost" = x"yes"; then
   enable_module_schnorrsig=yes
 fi
 
+if test x"$enable_module_chilldkg" = x"yes"; then
+  if test x"$enable_module_schnorrsig" = x"no"; then
+    AC_MSG_ERROR([Module dependency error: You have disabled the schnorrsig module explicitly, but it is required by the chilldkg module.])
+  fi
+  if test x"$enable_module_ecdh" = x"no"; then
+    AC_MSG_ERROR([Module dependency error: You have disabled the ecdh module explicitly, but it is required by the chilldkg module.])
+  fi
+  SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DENABLE_MODULE_CHILLDKG=1"
+  enable_module_schnorrsig=yes
+  enable_module_ecdh=yes
+fi
+
 if test x"$enable_external_default_callbacks" = x"yes"; then
   SECP_CONFIG_DEFINES="$SECP_CONFIG_DEFINES -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1"
 fi
@@ -598,6 +615,9 @@ if test x"$enable_experimental" = x"no"; then
   if test x"$enable_module_frost" = x"yes"; then
     AC_MSG_ERROR([FROST module is experimental. Use --enable-experimental to allow.])
   fi
+  if test x"$enable_module_chilldkg" = x"yes"; then
+    AC_MSG_ERROR([ChillDKG module is experimental. Use --enable-experimental to allow.])
+  fi
 fi
 
 # Check for concurrency support (tests only)
@@ -636,6 +656,7 @@ AM_CONDITIONAL([ENABLE_MODULE_ECDSA_ADAPTOR], [test x"$enable_module_ecdsa_adapt
 AM_CONDITIONAL([ENABLE_MODULE_BPPP], [test x"$enable_module_bppp" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_SCHNORRSIG_HALFAGG], [test x"$enable_module_schnorrsig_halfagg" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_FROST], [test x"$enable_module_frost" = x"yes"])
+AM_CONDITIONAL([ENABLE_MODULE_CHILLDKG], [test x"$enable_module_chilldkg" = x"yes"])
 AM_CONDITIONAL([USE_REDUCED_SURJECTION_PROOF_SIZE], [test x"$use_reduced_surjection_proof_size" = x"yes"])
 AM_CONDITIONAL([USE_EXTERNAL_ASM], [test x"$enable_external_asm" = x"yes"])
 AM_CONDITIONAL([USE_ASM_ARM], [test x"$set_asm" = x"arm32"])
@@ -678,6 +699,7 @@ echo "  module ecdsa-adaptor    = $enable_module_ecdsa_adaptor"
 echo "  module bppp             = $enable_module_bppp"
 echo "  module schnorrsig-halfagg = $enable_module_schnorrsig_halfagg"
 echo "  module frost            = $enable_module_frost"
+echo "  module chilldkg         = $enable_module_chilldkg"
 echo
 echo "  asm                     = $set_asm"
 echo "  ecmult window size      = $set_ecmult_window"
diff --git a/include/secp256k1_chilldkg.h b/include/secp256k1_chilldkg.h
new file mode 100644
index 00000000..7764ce30
--- /dev/null
+++ b/include/secp256k1_chilldkg.h
@@ -0,0 +1,38 @@
+#ifndef SECP256K1_CHILLDKG_H
+#define SECP256K1_CHILLDKG_H
+
+#include "secp256k1.h"
+#include "secp256k1_extrakeys.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stddef.h>
+#include <stdint.h>
+
+/** This module implements ChillDKG, a distributed key generation (DKG)
+ *  protocol for FROST, as specified by the bip-frost-dkg BIP draft
+ *  (https://github.com/BlockstreamResearch/bip-frost-dkg, version 0.3.0-dev).
+ *
+ *  This code is currently a work in progress. It's not secure nor stable.
+ *  IT IS EXTREMELY DANGEROUS AND RECKLESS TO USE THIS MODULE IN PRODUCTION!
+ *
+ *  Moreover, the bip-frost-dkg BIP is still a draft: tagged hashes, wire
+ *  formats, and protocol details may change in future BIP versions. There is
+ *  no guarantee that this implementation will remain compatible with the
+ *  final specification.
+ *
+ *  The output of a ChillDKG session (a secret share, the threshold public
+ *  key, and the public shares of all participants) is designed to be used
+ *  directly with the FROST signing module (see include/secp256k1_frost.h).
+ *
+ *  It is recommended to read the documentation in this include file carefully.
+ *  Further notes on API usage can be found in src/modules/chilldkg/chilldkg.md.
+ */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 1f544426..9a66f38f 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -91,6 +91,19 @@ if(SECP256K1_ENABLE_MODULE_FROST)
   set_property(TARGET secp256k1 APPEND PROPERTY PUBLIC_HEADER ${PROJECT_SOURCE_DIR}/include/secp256k1_frost.h)
 endif()
 
+if(SECP256K1_ENABLE_MODULE_CHILLDKG)
+  if(DEFINED SECP256K1_ENABLE_MODULE_SCHNORRSIG AND NOT SECP256K1_ENABLE_MODULE_SCHNORRSIG)
+    message(FATAL_ERROR "Module dependency error: You have disabled the schnorrsig module explicitly, but it is required by the chilldkg module.")
+  endif()
+  if(DEFINED SECP256K1_ENABLE_MODULE_ECDH AND NOT SECP256K1_ENABLE_MODULE_ECDH)
+    message(FATAL_ERROR "Module dependency error: You have disabled the ecdh module explicitly, but it is required by the chilldkg module.")
+  endif()
+  set(SECP256K1_ENABLE_MODULE_SCHNORRSIG ON)
+  set(SECP256K1_ENABLE_MODULE_ECDH ON)
+  add_compile_definitions(ENABLE_MODULE_CHILLDKG=1)
+  set_property(TARGET secp256k1 APPEND PROPERTY PUBLIC_HEADER ${PROJECT_SOURCE_DIR}/include/secp256k1_chilldkg.h)
+endif()
+
 if(SECP256K1_ENABLE_MODULE_SCHNORRSIG)
   if(DEFINED SECP256K1_ENABLE_MODULE_EXTRAKEYS AND NOT SECP256K1_ENABLE_MODULE_EXTRAKEYS)
     message(FATAL_ERROR "Module dependency error: You have disabled the extrakeys module explicitly, but it is required by the schnorrsig module.")
diff --git a/src/modules/chilldkg/Makefile.am.include b/src/modules/chilldkg/Makefile.am.include
new file mode 100644
index 00000000..68cefaed
--- /dev/null
+++ b/src/modules/chilldkg/Makefile.am.include
@@ -0,0 +1,3 @@
+include_HEADERS += include/secp256k1_chilldkg.h
+noinst_HEADERS += src/modules/chilldkg/main_impl.h
+noinst_HEADERS += src/modules/chilldkg/tests_impl.h
diff --git a/src/modules/chilldkg/chilldkg.md b/src/modules/chilldkg/chilldkg.md
new file mode 100644
index 00000000..97aebc9e
--- /dev/null
+++ b/src/modules/chilldkg/chilldkg.md
@@ -0,0 +1,24 @@
+Notes on the chilldkg module API
+================================
+
+This module implements ChillDKG, a distributed key generation (DKG) protocol
+for FROST, as specified by the bip-frost-dkg BIP draft
+(https://github.com/BlockstreamResearch/bip-frost-dkg, version 0.3.0-dev). In
+a ChillDKG session, n participants jointly generate a threshold key with the
+help of an untrusted coordinator, such that no party (including the
+coordinator) learns more than its own secret share, and every participant
+obtains the threshold public key and the public shares of all participants.
+The output is designed to feed directly into the frost module
+(`include/secp256k1_frost.h`), which implements FROST signing (BIP 445) and
+explicitly leaves DKG out of scope.
+
+**This module is experimental.** Do not use it in production. The API should
+not be considered stable. The underlying BIP is still a draft (v0.3.0-dev):
+tagged hashes, wire formats, and protocol details may change in future BIP
+versions.
+
+The module depends on the schnorrsig module (for the CertEq certificate and
+proofs of possession) and the ecdh module (for encrypted share distribution).
+
+The API is under construction; see the implementation plan in
+`.idea/docs/chilldkg-implementation-plan.md` for the phased roadmap.
diff --git a/src/modules/chilldkg/main_impl.h b/src/modules/chilldkg/main_impl.h
new file mode 100644
index 00000000..ca29e111
--- /dev/null
+++ b/src/modules/chilldkg/main_impl.h
@@ -0,0 +1,11 @@
+/***********************************************************************
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_MODULE_CHILLDKG_MAIN_H
+#define SECP256K1_MODULE_CHILLDKG_MAIN_H
+
+#include "../../../include/secp256k1_chilldkg.h"
+
+#endif
diff --git a/src/modules/chilldkg/tests_impl.h b/src/modules/chilldkg/tests_impl.h
new file mode 100644
index 00000000..fd0e42cc
--- /dev/null
+++ b/src/modules/chilldkg/tests_impl.h
@@ -0,0 +1,21 @@
+/***********************************************************************
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or https://www.opensource.org/licenses/mit-license.php.*
+ ***********************************************************************/
+
+#ifndef SECP256K1_MODULE_CHILLDKG_TESTS_IMPL_H
+#define SECP256K1_MODULE_CHILLDKG_TESTS_IMPL_H
+
+#include "../../../include/secp256k1_chilldkg.h"
+
+/* Placeholder test for the chilldkg module scaffolding. Real tests are added
+ * in later implementation phases. */
+static void chilldkg_scaffolding_test(void) {
+    CHECK(1);
+}
+
+static const struct tf_test_entry tests_chilldkg[] = {
+    CASE1(chilldkg_scaffolding_test),
+};
+
+#endif
diff --git a/src/secp256k1.c b/src/secp256k1.c
index 0cedc958..427c491d 100644
--- a/src/secp256k1.c
+++ b/src/secp256k1.c
@@ -956,3 +956,7 @@ static int secp256k1_ge_parse_ext(secp256k1_ge* ge, const unsigned char *in33) {
 #ifdef ENABLE_MODULE_FROST
 # include "modules/frost/main_impl.h"
 #endif
+
+#ifdef ENABLE_MODULE_CHILLDKG
+# include "modules/chilldkg/main_impl.h"
+#endif
diff --git a/src/tests.c b/src/tests.c
index 24ab3378..c221cb1c 100644
--- a/src/tests.c
+++ b/src/tests.c
@@ -7924,6 +7924,10 @@ static void run_ecdsa_wycheproof(void) {
 # include "modules/frost/tests_impl.h"
 #endif
 
+#ifdef ENABLE_MODULE_CHILLDKG
+# include "modules/chilldkg/tests_impl.h"
+#endif
+
 static void run_secp256k1_memczero_test(void) {
     unsigned char buf1[6] = {1, 2, 3, 4, 5, 6};
     unsigned char buf2[sizeof(buf1)];
@@ -8294,6 +8298,9 @@ static const struct tf_test_module registry_modules[] = {
 #endif
 #ifdef ENABLE_MODULE_FROST
     MAKE_TEST_MODULE(frost),
+#endif
+#ifdef ENABLE_MODULE_CHILLDKG
+    MAKE_TEST_MODULE(chilldkg),
 #endif
     MAKE_TEST_MODULE(utils),
 };