diff --git a/messages-solana.options b/messages-solana.options
index 510df1cf..fd945238 100644
--- a/messages-solana.options
+++ b/messages-solana.options
@@ -6,6 +6,8 @@ SolanaSignTx.raw_tx max_size:1232
 SolanaSignTx.token_info max_count:4
 SolanaSignTx.schema_payload max_size:256
 SolanaSignTx.schema_signature max_size:64
+SolanaSignTx.token_recipient_owner max_count:4
+SolanaSignTx.token_recipient_owner max_size:32
 SolanaTokenInfo.mint max_size:32
 SolanaTokenInfo.symbol max_size:13
 SolanaAddress.address max_size:45
diff --git a/messages-solana.proto b/messages-solana.proto
index 865b5cfb..d377a6aa 100644
--- a/messages-solana.proto
+++ b/messages-solana.proto
@@ -78,6 +78,15 @@ message SolanaSignTx {
     optional bytes schema_payload = 9;
     optional bytes schema_signature = 10;       // 64-byte compact secp256k1 over SHA256(payload)
     optional uint32 schema_signer_key_id = 11;  // trusted clearsign signer slot (0-3)
+    /*
+     * Candidate owners for SPL associated-token-account destinations. For a
+     * TransferChecked instruction, firmware may display an owner only after
+     * independently deriving ATA(owner, token_program, mint) and matching it
+     * to the signed destination account. An unmatched candidate is never
+     * treated as a recipient. This lets payment protocols such as x402 show
+     * their payTo address without trusting host-side decoding or chain RPC.
+     */
+    repeated bytes token_recipient_owner = 12;  // 32-byte Solana public keys (max 4)
 }
 
 /**