diff --git a/src/modules/chilldkg/util_impl.h b/src/modules/chilldkg/util_impl.h
index f10512da..63bfcc4e 100644
--- a/src/modules/chilldkg/util_impl.h
+++ b/src/modules/chilldkg/util_impl.h
@@ -104,7 +104,14 @@ static int secp256k1_chilldkg_xonly_load(secp256k1_ge *p, const unsigned char *i
 
 static void secp256k1_chilldkg_pad33(unsigned char *out33, const char *str) {
     size_t len = strlen(str);
-    VERIFY_CHECK(len <= 33);
+    /* Every call site passes a string literal of the module, so this cannot
+     * trigger. The clamp must not sit inside VERIFY_CHECK, which is compiled
+     * out in noverify builds: an over-long tag would overflow out33 and make
+     * the memset length below underflow to a huge value. */
+    if (len > 33) {
+        VERIFY_CHECK(0);
+        len = 33;
+    }
     memcpy(out33, str, len);
     memset(out33 + len, 0, 33 - len);
 }
@@ -116,7 +123,20 @@ static void secp256k1_chilldkg_schnorrsig_sha256_tagged(const secp256k1_hash_ctx
     size_t prefix_len = strlen(tag_prefix);
     size_t subtag_len = strlen(subtag);
 
-    VERIFY_CHECK(prefix_len + subtag_len <= sizeof(tag));
+    /* The longest tag the module builds is "BIP DKG/pop message" ||
+     * "/challenge", 29 bytes. As in secp256k1_chilldkg_pad33, the bound is
+     * enforced outside VERIFY_CHECK so that a future over-long tag cannot
+     * overflow tag[] in a noverify build. Clamping rather than returning
+     * early keeps sha initialized for the caller; a truncated tag changes
+     * every hash the module computes, so the test vectors fail loudly. */
+    if (prefix_len > sizeof(tag)) {
+        VERIFY_CHECK(0);
+        prefix_len = sizeof(tag);
+    }
+    if (subtag_len > sizeof(tag) - prefix_len) {
+        VERIFY_CHECK(0);
+        subtag_len = sizeof(tag) - prefix_len;
+    }
     memcpy(tag, tag_prefix, prefix_len);
     memcpy(tag + prefix_len, subtag, subtag_len);
     secp256k1_sha256_initialize_tagged(hash_ctx, sha, tag, prefix_len + subtag_len);