diff --git a/contracts/src/Gateway.sol b/contracts/src/Gateway.sol
index 92814be1f0..1d301492e6 100644
--- a/contracts/src/Gateway.sol
+++ b/contracts/src/Gateway.sol
@@ -569,7 +569,7 @@ contract Gateway is IGateway, IInitializable {
 
         CoreStorage.Layout storage $ = CoreStorage.layout();
 
-        $.mode = OperatingMode.Normal;
+        $.mode = OperatingMode.RejectingOutboundMessages;
         $.defaultFee = defaultFee;
 
         // Initialize an agent & channel for BridgeHub
diff --git a/contracts/test/Gateway.t.sol b/contracts/test/Gateway.t.sol
index 3b43489a61..d6800af1b8 100644
--- a/contracts/test/Gateway.t.sol
+++ b/contracts/test/Gateway.t.sol
@@ -93,6 +93,9 @@ contract GatewayTest is Test {
         );
         GatewayMock(address(gateway)).setCommitmentsAreVerified(true);
 
+        Gateway.SetOperatingModeParams memory params = Gateway.SetOperatingModeParams({mode: OperatingMode.Normal});
+        GatewayMock(address(gateway)).setOperatingModePublic(abi.encode(params));
+
         bridgeHubAgent = IGateway(address(gateway)).agentOf(bridgeHubAgentID);
         assetHubAgent = IGateway(address(gateway)).agentOf(assetHubAgentID);
 
diff --git a/parachain/Cargo.lock b/parachain/Cargo.lock
index 0a1aadd73c..8732841b3f 100644
--- a/parachain/Cargo.lock
+++ b/parachain/Cargo.lock
@@ -115,6 +115,17 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "ark-bls12-377"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb00293ba84f51ce3bd026bd0de55899c4e68f0a39a5728cebae3a73ffdc0a4f"
+dependencies = [
+ "ark-ec",
+ "ark-ff",
+ "ark-std",
+]
+
 [[package]]
 name = "ark-bls12-381"
 version = "0.4.0"
@@ -408,6 +419,25 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bip39"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93f2635620bf0b9d4576eb7bb9a38a55df78bd1205d26fa994b25911a69f212f"
+dependencies = [
+ "bitcoin_hashes",
+ "rand 0.8.5",
+ "rand_core 0.6.4",
+ "serde",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "bitcoin_hashes"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90064b8dee6815a6470d60bad07bbbaee885c0e12d04177138fa3291a01b7bc4"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -670,6 +700,12 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13418e745008f7349ec7e449155f419a61b92b58a99cc3616942b926825ec76b"
 
+[[package]]
+name = "constcat"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd7e35aee659887cbfb97aaf227ac12cad1a9d7c71e55ff3376839ed4e282d08"
+
 [[package]]
 name = "convert_case"
 version = "0.4.0"
@@ -806,6 +842,7 @@ dependencies = [
  "platforms",
  "rustc_version",
  "subtle",
+ "zeroize",
 ]
 
 [[package]]
@@ -1026,6 +1063,7 @@ version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
+ "pkcs8",
  "signature",
 ]
 
@@ -1037,7 +1075,9 @@ checksum = "7277392b266383ef8396db7fdeb1e77b6c52fed775f5df15bb24f35b72156980"
 dependencies = [
  "curve25519-dalek 4.1.1",
  "ed25519",
+ "serde",
  "sha2 0.10.7",
+ "zeroize",
 ]
 
 [[package]]
@@ -2373,15 +2413,6 @@ dependencies = [
  "crypto-mac 0.11.1",
 ]
 
-[[package]]
-name = "pbkdf2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83a0692ec44e4cf1ef28ca317f14f8f07da2d95ec3fa01f86e4467b725e60917"
-dependencies = [
- "digest 0.10.7",
-]
-
 [[package]]
 name = "percent-encoding"
 version = "2.2.0"
@@ -2433,7 +2464,6 @@ version = "1.0.0"
 dependencies = [
  "bounded-collections",
  "derive_more",
- "frame-support",
  "parity-scale-codec",
  "polkadot-core-primitives",
  "scale-info",
@@ -2441,6 +2471,7 @@ dependencies = [
  "sp-core",
  "sp-runtime",
  "sp-std",
+ "sp-weights",
 ]
 
 [[package]]
@@ -2740,12 +2771,6 @@ version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ef03e0a2b150c7a90d01faf6254c9c48a41e95fb2a8c2ac1c6f0d2b9aefc342"
 
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
 [[package]]
 name = "rustc-hex"
 version = "2.1.0"
@@ -3397,6 +3422,7 @@ version = "21.0.0"
 dependencies = [
  "array-bytes 6.1.0",
  "bandersnatch_vrfs",
+ "bip39",
  "bitflags",
  "blake2",
  "bounded-collections",
@@ -3407,6 +3433,7 @@ dependencies = [
  "hash-db",
  "hash256-std-hasher",
  "impl-serde",
+ "itertools",
  "lazy_static",
  "libsecp256k1",
  "log",
@@ -3431,8 +3458,8 @@ dependencies = [
  "ss58-registry",
  "substrate-bip39",
  "thiserror",
- "tiny-bip39",
  "tracing",
+ "w3f-bls",
  "zeroize",
 ]
 
@@ -3859,6 +3886,7 @@ dependencies = [
  "impl-trait-for-tuples",
  "log",
  "parity-scale-codec",
+ "scale-info",
  "sp-arithmetic",
  "sp-core",
  "sp-io",
@@ -3903,7 +3931,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49eee6965196b32f882dd2ee85a92b1dbead41b04e53907f269de3b0dc04733c"
 dependencies = [
  "hmac 0.11.0",
- "pbkdf2 0.8.0",
+ "pbkdf2",
  "schnorrkel",
  "sha2 0.9.9",
  "zeroize",
@@ -4008,25 +4036,6 @@ dependencies = [
  "once_cell",
 ]
 
-[[package]]
-name = "tiny-bip39"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62cc94d358b5a1e84a5cb9109f559aa3c4d634d2b1b4de3d0fa4adc7c78e2861"
-dependencies = [
- "anyhow",
- "hmac 0.12.1",
- "once_cell",
- "pbkdf2 0.11.0",
- "rand 0.8.5",
- "rustc-hash",
- "sha2 0.10.7",
- "thiserror",
- "unicode-normalization",
- "wasm-bindgen",
- "zeroize",
-]
-
 [[package]]
 name = "tiny-keccak"
 version = "1.5.0"
@@ -4284,6 +4293,30 @@ version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
+[[package]]
+name = "w3f-bls"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7335e4c132c28cc43caef6adb339789e599e39adbe78da0c4d547fad48cbc331"
+dependencies = [
+ "ark-bls12-377",
+ "ark-bls12-381",
+ "ark-ec",
+ "ark-ff",
+ "ark-serialize",
+ "ark-serialize-derive",
+ "arrayref",
+ "constcat",
+ "digest 0.10.7",
+ "rand 0.8.5",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+ "sha2 0.10.7",
+ "sha3",
+ "thiserror",
+ "zeroize",
+]
+
 [[package]]
 name = "walkdir"
 version = "2.3.2"
diff --git a/parachain/pallets/control/src/mock.rs b/parachain/pallets/control/src/mock.rs
index 42a7fab772..7dc6e8d25b 100644
--- a/parachain/pallets/control/src/mock.rs
+++ b/parachain/pallets/control/src/mock.rs
@@ -3,14 +3,16 @@
 use crate as snowbridge_control;
 use frame_support::{
 	parameter_types,
-	traits::{tokens::fungible::Mutate, ConstU128, ConstU16, ConstU64, ConstU8, Contains},
+	traits::{tokens::fungible::Mutate, ConstU128, ConstU16, ConstU64, ConstU8},
 	weights::IdentityFee,
 	PalletId,
 };
 use sp_core::H256;
 use xcm_executor::traits::ConvertLocation;
 
-use snowbridge_core::{outbound::ConstantGasMeter, sibling_sovereign_account, AgentId, ParaId};
+use snowbridge_core::{
+	outbound::ConstantGasMeter, sibling_sovereign_account, AgentId, AllowSiblingsOnly, ParaId,
+};
 use sp_runtime::{
 	traits::{AccountIdConversion, BlakeTwo256, IdentityLookup, Keccak256},
 	AccountId32, BuildStorage,
@@ -132,6 +134,7 @@ impl pallet_balances::Config for Test {
 	type FreezeIdentifier = ();
 	type MaxFreezes = ();
 	type RuntimeHoldReason = ();
+	type RuntimeFreezeReason = ();
 	type MaxHolds = ();
 }
 
@@ -201,17 +204,6 @@ impl BenchmarkHelper<RuntimeOrigin> for () {
 	}
 }
 
-pub struct AllowSiblingsOnly;
-impl Contains<MultiLocation> for AllowSiblingsOnly {
-	fn contains(location: &MultiLocation) -> bool {
-		if let MultiLocation { parents: 1, interior: X1(Parachain(_)) } = location {
-			true
-		} else {
-			false
-		}
-	}
-}
-
 impl crate::Config for Test {
 	type RuntimeEvent = RuntimeEvent;
 	type OwnParaId = OwnParaId;
diff --git a/parachain/pallets/inbound-queue/src/test.rs b/parachain/pallets/inbound-queue/src/test.rs
index ebbba1e770..36a70ae912 100644
--- a/parachain/pallets/inbound-queue/src/test.rs
+++ b/parachain/pallets/inbound-queue/src/test.rs
@@ -84,6 +84,7 @@ impl pallet_balances::Config for Test {
 	type FreezeIdentifier = ();
 	type MaxFreezes = ();
 	type RuntimeHoldReason = ();
+	type RuntimeFreezeReason = ();
 	type MaxHolds = ();
 }
 
diff --git a/parachain/primitives/core/src/lib.rs b/parachain/primitives/core/src/lib.rs
index d9c4d5102c..0a5ec88d42 100644
--- a/parachain/primitives/core/src/lib.rs
+++ b/parachain/primitives/core/src/lib.rs
@@ -14,8 +14,11 @@ pub use polkadot_parachain_primitives::primitives::{
 	Id as ParaId, IsSystem, Sibling as SiblingParaId,
 };
 pub use ringbuffer::{RingBufferMap, RingBufferMapImpl};
+
+use frame_support::traits::Contains;
 use sp_core::H256;
 use sp_runtime::traits::AccountIdConversion;
+use xcm::prelude::{Junction::Parachain, Junctions::X1, MultiLocation};
 
 /// The ID of an agent contract
 pub type AgentId = H256;
@@ -28,6 +31,13 @@ where
 	SiblingParaId::from(para_id).into_account_truncating()
 }
 
+pub struct AllowSiblingsOnly;
+impl Contains<MultiLocation> for AllowSiblingsOnly {
+	fn contains(location: &MultiLocation) -> bool {
+		matches!(location, MultiLocation { parents: 1, interior: X1(Parachain(_)) })
+	}
+}
+
 pub const GWEI: u128 = 1_000_000_000;
 pub const METH: u128 = 1_000_000_000_000_000;
 pub const ETH: u128 = 1_000_000_000_000_000_000;
diff --git a/parachain/primitives/core/tests/mod.rs b/parachain/primitives/core/tests/mod.rs
new file mode 100644
index 0000000000..2da5d2df18
--- /dev/null
+++ b/parachain/primitives/core/tests/mod.rs
@@ -0,0 +1,14 @@
+#[cfg(test)]
+mod tests {
+	use frame_support::traits::Contains;
+	use snowbridge_core::AllowSiblingsOnly;
+	use xcm::prelude::{Junction::Parachain, Junctions::X1, MultiLocation};
+
+	#[test]
+	fn allow_siblings_predicate_only_allows_siblings() {
+		let sibling = MultiLocation::new(1, X1(Parachain(1000)));
+		let child = MultiLocation::new(0, X1(Parachain(1000)));
+		assert!(AllowSiblingsOnly::contains(&sibling), "Sibling returns true.");
+		assert!(!AllowSiblingsOnly::contains(&child), "Child returns false.");
+	}
+}
diff --git a/polkadot-sdk b/polkadot-sdk
index e907a6f3cc..c1394ee8f2 160000
--- a/polkadot-sdk
+++ b/polkadot-sdk
@@ -1 +1 @@
-Subproject commit e907a6f3cc3714847be552c326dfabc5abe741b9
+Subproject commit c1394ee8f296629e26cac8dbbb36eebe0c8c436a
diff --git a/smoketest/Cargo.lock b/smoketest/Cargo.lock
index e29afd0a74..c07954495c 100644
--- a/smoketest/Cargo.lock
+++ b/smoketest/Cargo.lock
@@ -103,6 +103,17 @@ version = "1.0.70"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7de8ce5e0f9f8d88245311066a578d72b7af3e7088f32783804676302df237e4"
 
+[[package]]
+name = "ark-bls12-377"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb00293ba84f51ce3bd026bd0de55899c4e68f0a39a5728cebae3a73ffdc0a4f"
+dependencies = [
+ "ark-ec",
+ "ark-ff",
+ "ark-std",
+]
+
 [[package]]
 name = "ark-bls12-381"
 version = "0.4.0"
@@ -453,6 +464,25 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bip39"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93f2635620bf0b9d4576eb7bb9a38a55df78bd1205d26fa994b25911a69f212f"
+dependencies = [
+ "bitcoin_hashes",
+ "rand 0.8.5",
+ "rand_core 0.6.4",
+ "serde",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "bitcoin_hashes"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90064b8dee6815a6470d60bad07bbbaee885c0e12d04177138fa3291a01b7bc4"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -762,6 +792,12 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13418e745008f7349ec7e449155f419a61b92b58a99cc3616942b926825ec76b"
 
+[[package]]
+name = "constcat"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd7e35aee659887cbfb97aaf227ac12cad1a9d7c71e55ff3376839ed4e282d08"
+
 [[package]]
 name = "core-foundation"
 version = "0.9.3"
@@ -3883,6 +3919,7 @@ version = "21.0.0"
 dependencies = [
  "array-bytes 6.1.0",
  "bandersnatch_vrfs",
+ "bip39",
  "bitflags",
  "blake2",
  "bounded-collections",
@@ -3893,6 +3930,7 @@ dependencies = [
  "hash-db 0.16.0",
  "hash256-std-hasher",
  "impl-serde",
+ "itertools",
  "lazy_static",
  "libsecp256k1",
  "log",
@@ -3917,8 +3955,8 @@ dependencies = [
  "ss58-registry",
  "substrate-bip39",
  "thiserror",
- "tiny-bip39",
  "tracing",
+ "w3f-bls",
  "zeroize",
 ]
 
@@ -4946,6 +4984,30 @@ version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
+[[package]]
+name = "w3f-bls"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7335e4c132c28cc43caef6adb339789e599e39adbe78da0c4d547fad48cbc331"
+dependencies = [
+ "ark-bls12-377",
+ "ark-bls12-381",
+ "ark-ec",
+ "ark-ff",
+ "ark-serialize",
+ "ark-serialize-derive",
+ "arrayref",
+ "constcat",
+ "digest 0.10.7",
+ "rand 0.8.5",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+ "sha2 0.10.8",
+ "sha3",
+ "thiserror",
+ "zeroize",
+]
+
 [[package]]
 name = "walkdir"
 version = "2.3.3"
diff --git a/smoketest/tests/upgrade_gateway.rs b/smoketest/tests/upgrade_gateway.rs
index 8163cfe48e..ed7279ddf9 100644
--- a/smoketest/tests/upgrade_gateway.rs
+++ b/smoketest/tests/upgrade_gateway.rs
@@ -16,7 +16,7 @@ use snowbridge_smoketest::{
 	parachains::{
 		bridgehub::{
 			self,
-			api::{ethereum_control, runtime_types::snowbridge_core::outbound::Initializer},
+			api::{ethereum_control, runtime_types::snowbridge_core::outbound::v1::Initializer},
 		},
 		relaychain,
 		relaychain::api::runtime_types::{
diff --git a/web/packages/test/scripts/set_operating_mode.sh b/web/packages/test/scripts/set_operating_mode.sh
index ebc291b4a1..7edc8c29c1 100755
--- a/web/packages/test/scripts/set_operating_mode.sh
+++ b/web/packages/test/scripts/set_operating_mode.sh
@@ -5,12 +5,12 @@ source scripts/set-env.sh
 source scripts/xcm-helper.sh
 
 enable_gateway() {
-    local transact_call="0x330400"
+    local transact_call="0x330500"
     send_governance_transact_from_relaychain $BRIDGE_HUB_PARAID "$transact_call"
 }
 
 disable_gateway() {
-    local transact_call="0x330401"
+    local transact_call="0x330501"
     send_governance_transact_from_relaychain $BRIDGE_HUB_PARAID "$transact_call"
 }
 
diff --git a/web/packages/test/scripts/start-relayer.sh b/web/packages/test/scripts/start-relayer.sh
index 811d753e08..b937c4ff9a 100755
--- a/web/packages/test/scripts/start-relayer.sh
+++ b/web/packages/test/scripts/start-relayer.sh
@@ -177,7 +177,7 @@ start_relayer() {
     (
         : >$output_dir/execution-relay-asset-hub.log
         while :; do
-            echo "Starting execution relay asset-hub at $(date)"
+            echo "Starting execution relay (asset-hub) at $(date)"
             "${relay_bin}" run execution \
                 --config $output_dir/execution-relay-asset-hub.json \
                 --substrate.private-key "//ExecutionRelay" \
@@ -190,7 +190,7 @@ start_relayer() {
     (
         : >$output_dir/execution-relay-template.log
         while :; do
-            echo "Starting execution relay template at $(date)"
+            echo "Starting execution relay (parachain-template) at $(date)"
             "${relay_bin}" run execution \
                 --config $output_dir/execution-relay-template.json \
                 --substrate.private-key "//ExecutionRelay" \