diff --git a/bundled-addons/aegis/addon.json b/bundled-addons/aegis/addon.json
index b074ce38..f36c65f1 100644
--- a/bundled-addons/aegis/addon.json
+++ b/bundled-addons/aegis/addon.json
@@ -1,7 +1,7 @@
 {
   "id": "aegis",
   "name": "Aegis Wallet",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "category": "plugin",
   "description": "Multi-chain wallet (BCH, BTC, TRX, ETH, SOL, SC, DGB) derived from your Theseus vault. Dapps get window.bitcoincash on .x sites; window.tronWeb / window.tronLink / window.ethereum / window.solana on any https page.",
   "author": "Silent Mode",
diff --git a/bundled-addons/aegis/panel.js b/bundled-addons/aegis/panel.js
index 39db123f..f32b409c 100644
--- a/bundled-addons/aegis/panel.js
+++ b/bundled-addons/aegis/panel.js
@@ -2256,18 +2256,28 @@ function renderConnectPane(bchWallets) {
   // Wallets with no derivable seed (WIF single-key imports) can't pair at
   // all, so they're disabled rather than silently failing on Connect.
   const pairable = readyBch.filter((w) => !w.wcBlocked);
+  const blocked = readyBch.filter((w) => w.wcBlocked);
   // Same precedence as the page-initiated pairing in index.js — the wallet
   // nominated for WizardConnect, else whatever the panel is showing. Two
   // different rules here and there is how a pairing surprises someone.
   const wcRole = (state && state.roles && state.roles.wizardconnect) || null;
   const preferId = (pairable.find((w) => w.id === wcRole) || pairable.find((w) => w.id === state.selectedWalletId) || pairable[0] || {}).id || null;
-  const options = readyBch.map((w) => `<option value="${esc(w.id)}" ${w.id === preferId ? "selected" : ""} ${w.wcBlocked ? "disabled" : ""}>${esc(w.label)} · ${esc(w.networkLabel)}${w.id === wcRole ? " ★" : ""}${w.wcBlocked ? ` — can't pair (${esc(w.wcBlockedShort || "unsupported")})` : ""}</option>`).join("");
+  const opt = (w) => `<option value="${esc(w.id)}" ${w.id === preferId ? "selected" : ""} ${w.wcBlocked ? "disabled" : ""}>${esc(w.label)} · ${esc(w.networkLabel)}${w.id === wcRole ? " ★" : ""}${w.wcBlocked ? ` — can't pair (${esc(w.wcBlockedShort || "unsupported")})` : ""}</option>`;
+  // Pairable first, under a heading, whenever anything is blocked. In
+  // registry order a bulk keystore import puts fifteen unpairable WIF
+  // wallets ahead of the two chipnet ones that pair fine, and a list whose
+  // visible rows are all greyed-out testnet entries reads as "chipnet isn't
+  // supported" — which is not true and never was. Grouping keeps the
+  // reasons visible without letting them bury the working options.
+  const options = blocked.length
+    ? `<optgroup label="Can pair">${pairable.map(opt).join("")}</optgroup>`
+      + `<optgroup label="Cannot pair">${blocked.map(opt).join("")}</optgroup>`
+    : pairable.map(opt).join("");
   // Greying an option out with "can't pair" and giving no reason anywhere on
   // the page reads as a broken wallet rather than a property of how it was
   // added. Show the reasons whenever ANY wallet is blocked — the old note
   // only appeared when nothing at all could pair, so a user with one good
   // mainnet wallet and ten WIF-imported chipnet ones saw no explanation.
-  const blocked = readyBch.filter((w) => w.wcBlocked);
   const reasons = [...new Set(blocked.map((w) => w.wcBlocked))].map(esc).join(" ");
   const blockedNote = !blocked.length
     ? ""