diff --git a/CHANGELOG.md b/CHANGELOG.md
index 026822796f..1c2d580094 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+Changes in next release
+=======================
+## ✨ Features
+
+* Allow passing a signing function when setting up Rust crypto ([#5483](https://github.com/matrix-org/matrix-js-sdk/pull/5483)). Contributed by @andybalaam.
+
 Changes in [42.2.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v42.2.0) (2026-08-18)
 ==================================================================================================
 ## 🐛 Bug Fixes
diff --git a/package.json b/package.json
index dc098749ca..9a465604f5 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
     ],
     "dependencies": {
         "@babel/runtime": "^8.0.0",
-        "@matrix-org/matrix-sdk-crypto-wasm": "^18.4.0",
+        "@matrix-org/matrix-sdk-crypto-wasm": "^18.6.0",
         "another-json": "^0.2.0",
         "bs58": "^6.0.0",
         "content-type": "^2.0.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0b55815968..d7d67e99e6 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -216,8 +216,8 @@ importers:
         specifier: ^8.0.0
         version: 8.0.0
       '@matrix-org/matrix-sdk-crypto-wasm':
-        specifier: ^18.4.0
-        version: 18.4.0
+        specifier: ^18.6.0
+        version: 18.6.0
       another-json:
         specifier: ^0.2.0
         version: 0.2.0
@@ -982,8 +982,8 @@ packages:
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
-  '@matrix-org/matrix-sdk-crypto-wasm@18.4.0':
-    resolution: {integrity: sha512-osxkU1DQ+05+anGHapjWyvZqdHUb94Id37gy54mCKn1Cq/D7iGT5oEUEhjp4oTnCLo4TOtI6ULJ/LHsapaIptQ==}
+  '@matrix-org/matrix-sdk-crypto-wasm@18.6.0':
+    resolution: {integrity: sha512-P3v8849O/1+c1CYDQ1X6L1p6UpakYAav1L4wTNvwLA54n9wNpadpw8sLZoxhaG4ftlmNzxFztjRYwDvx56d11w==}
     engines: {node: '>= 18'}
 
   '@matrix-org/olm@3.2.15':
@@ -3475,7 +3475,7 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.5
 
-  '@matrix-org/matrix-sdk-crypto-wasm@18.4.0': {}
+  '@matrix-org/matrix-sdk-crypto-wasm@18.6.0': {}
 
   '@matrix-org/olm@3.2.15': {}
 
diff --git a/spec/integ/crypto/rust-crypto.spec.ts b/spec/integ/crypto/rust-crypto.spec.ts
index bf0f08dd62..4874c18bea 100644
--- a/spec/integ/crypto/rust-crypto.spec.ts
+++ b/spec/integ/crypto/rust-crypto.spec.ts
@@ -155,7 +155,7 @@ eXmIj7ZEOIsufPdiYuKDp/aUdgUHmuCGyegfoCJze36SdFX5q6z8Aq5nKPtz+FM=
 -----END CERTIFICATE-----
 `;
 
-    it("should pass on the caCertsPem if supplied", async () => {
+    it("should pass on the caCertsPem and sign function if supplied", async () => {
         // Given a Matrix client
         const matrixClient = createClient({
             baseUrl: "http://test.server",
@@ -165,8 +165,18 @@ eXmIj7ZEOIsufPdiYuKDp/aUdgUHmuCGyegfoCJze36SdFX5q6z8Aq5nKPtz+FM=
 
         const initFromStore = vi.spyOn(OlmMachine, "initFromStore");
 
+        const x509Signer = async (item: Uint8Array) => {
+            return {
+                signature_bytes: item,
+                certificate_chain: "MYCHAIN",
+                signature_scheme: "RsaPssSha512" as const,
+            };
+        };
+
+        const x509Validity = () => 12000.3;
+
         // When we init Rust crypto and pass a PEM for the CA certs
-        await matrixClient.initRustCrypto({ caCertsPem: CA_PEM });
+        await matrixClient.initRustCrypto({ caCertsPem: CA_PEM, x509Signer, x509Validity });
 
         // Then that PEM was passed in to the Olm machine
         expect(initFromStore).toHaveBeenCalledWith(
@@ -175,6 +185,8 @@ eXmIj7ZEOIsufPdiYuKDp/aUdgUHmuCGyegfoCJze36SdFX5q6z8Aq5nKPtz+FM=
             expect.anything(),
             expect.anything(),
             CA_PEM,
+            x509Signer,
+            x509Validity,
         );
     });
 
diff --git a/spec/unit/rust-crypto/rust-crypto.spec.ts b/spec/unit/rust-crypto/rust-crypto.spec.ts
index 1383bc4987..898d0234f0 100644
--- a/spec/unit/rust-crypto/rust-crypto.spec.ts
+++ b/spec/unit/rust-crypto/rust-crypto.spec.ts
@@ -141,10 +141,12 @@ describe("initRustCrypto", () => {
             mockStore,
             logger,
             undefined,
+            undefined,
+            undefined,
         );
     });
 
-    it("passes through the store params (key) and CA certs", async () => {
+    it("passes through the store params (key), CA certs and sign function", async () => {
         const mockStore = { free: vi.fn() } as unknown as StoreHandle;
         vi.spyOn(StoreHandle, "openWithKey").mockResolvedValue(mockStore);
 
@@ -154,6 +156,16 @@ describe("initRustCrypto", () => {
         const storeKey = new Uint8Array(32);
         const logger = new DebugLogger(debug("matrix-js-sdk:test:initRustCrypto"));
         const caCertsPem = "MY_PEM etc...";
+        const x509Signer = async (item: Uint8Array) => {
+            return {
+                signature_bytes: item,
+                certificate_chain: "CHAIN",
+                signature_scheme: "RsaPssSha512" as const,
+            };
+        };
+        const x509Validity = () => {
+            return 10000;
+        };
 
         await initRustCrypto({
             logger,
@@ -165,6 +177,8 @@ describe("initRustCrypto", () => {
             storePrefix: "storePrefix",
             storeKey: storeKey,
             caCertsPem,
+            x509Signer,
+            x509Validity,
         });
 
         expect(StoreHandle.openWithKey).toHaveBeenCalledWith("storePrefix", storeKey, logger);
@@ -174,6 +188,8 @@ describe("initRustCrypto", () => {
             mockStore,
             logger,
             caCertsPem,
+            x509Signer,
+            x509Validity,
         );
     });
 
@@ -204,6 +220,8 @@ describe("initRustCrypto", () => {
             mockStore,
             logger,
             undefined,
+            undefined,
+            undefined,
         );
     });
 
diff --git a/src/client.ts b/src/client.ts
index 24cd760dbd..7b0879e26e 100644
--- a/src/client.ts
+++ b/src/client.ts
@@ -1980,7 +1980,14 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @param args.caCertsPem - Optional PEM-formatted string that provides CA certificates. These will be used to check
      *    X.509 signatures on user identities. Any user identity that has a valid signature according to the supplied
      *    CAs will be considered verified, without any manual verification taking place.
-     *
+     *    NOTE: this is an unspecified extension to Matrix. Applications should exercise caution when using it.
+     * @param args.x509Signer - Optional async function for signing some data with an X.509 certificate. Used to sign
+     *    the user's identity so compatible clients will recognise this user as verified without manual verification
+     *    taking place. If you supply this you must also supply rawX509Validity.
+     *    NOTE: this is an unspecified extension to Matrix. Applications should exercise caution when using it.
+     * @param args.x509Validity - Optional function returning the validity period of the X.509 certificate used for
+     *    signing, as the number of milliseconds since the Unix epoch. If you supply this you must also supply
+     *    rawX509Signer.
      *    NOTE: this is an unspecified extension to Matrix. Applications should exercise caution when using it.
      *
      * @returns a Promise which will resolve when the crypto layer has been
@@ -1993,6 +2000,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             storageKey?: Uint8Array;
             storagePassword?: string;
             caCertsPem?: string;
+            x509Signer?: (item: Uint8Array) => Promise<{
+                signature_bytes: Uint8Array;
+                certificate_chain: string;
+                signature_scheme: "RsaPssSha512";
+            }>;
+            x509Validity?: () => number;
         } = {},
     ): Promise<void> {
         if (this.cryptoBackend) {
@@ -2040,6 +2053,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             enableEncryptedStateEvents: this.enableEncryptedStateEvents,
 
             caCertsPem: args.caCertsPem,
+            x509Signer: args.x509Signer,
+            x509Validity: args.x509Validity,
         });
 
         rustCrypto.setSupportedVerificationMethods(this.verificationMethods);
diff --git a/src/rust-crypto/index.ts b/src/rust-crypto/index.ts
index 6bf96629d7..be938e4a1a 100644
--- a/src/rust-crypto/index.ts
+++ b/src/rust-crypto/index.ts
@@ -103,6 +103,25 @@ export interface InitRustCryptoArgs {
      * considered verified, without any manual verification taking place.
      */
     caCertsPem?: string;
+
+    /**
+     * Optional async function for signing some data with an X.509 certificate.
+     * Used to sign the user's identity so compatible clients will recognise
+     * this user as verified without manual verification taking place. If you
+     * supply this you must also supply rawX509Validity.
+     */
+    x509Signer?: (item: Uint8Array) => Promise<{
+        signature_bytes: Uint8Array;
+        certificate_chain: string;
+        signature_scheme: "RsaPssSha512";
+    }>;
+
+    /**
+     * Optional function returning the validity period of the X.509 certificate
+     * used for signing, as the number of milliseconds since the Unix epoch. If
+     * you supply this you must also supply rawX509Signer.
+     */
+    x509Validity?: () => number;
 }
 
 /**
@@ -158,6 +177,8 @@ async function initOlmMachine(
         legacyCryptoStore,
         enableEncryptedStateEvents,
         caCertsPem,
+        x509Signer,
+        x509Validity,
     }: InitRustCryptoArgs,
     storeHandle: StoreHandle,
 ): Promise<RustCrypto> {
@@ -169,6 +190,8 @@ async function initOlmMachine(
         storeHandle,
         logger,
         caCertsPem,
+        x509Signer,
+        x509Validity,
     );
 
     // A final migration step, now that we have an OlmMachine.