diff --git a/Cargo.toml b/Cargo.toml
index 149df056..551c1f98 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,6 +39,7 @@ members = [
   "bedrock_client",
   "testnet_initial_state",
   "keycard_wallet",
+  "indexer_ffi",
 ]
 
 [workspace.dependencies]
@@ -56,6 +57,7 @@ indexer_core = { path = "indexer/core" }
 indexer_service = { path = "indexer/service" }
 indexer_service_protocol = { path = "indexer/service/protocol" }
 indexer_service_rpc = { path = "indexer/service/rpc" }
+indexer_ffi = { path = "indexer_ffi" }
 wallet = { path = "wallet" }
 wallet-ffi = { path = "wallet-ffi", default-features = false }
 clock_core = { path = "programs/clock/core" }
diff --git a/artifacts/program_methods/associated_token_account.bin b/artifacts/program_methods/associated_token_account.bin
index be94122a..5439d1af 100644
Binary files a/artifacts/program_methods/associated_token_account.bin and b/artifacts/program_methods/associated_token_account.bin differ
diff --git a/integration_tests/tests/auth_transfer/private.rs b/integration_tests/tests/auth_transfer/private.rs
index 58e5cfd3..f08e3759 100644
--- a/integration_tests/tests/auth_transfer/private.rs
+++ b/integration_tests/tests/auth_transfer/private.rs
@@ -594,6 +594,8 @@ async fn shielded_transfers_to_two_identifiers_same_npk() -> Result<()> {
             to_vpk: Some(vpk_hex.clone()),
             to_identifier: Some(identifier_1),
             amount: 100,
+            from_key_path: None,
+            to_key_path: None,
         }),
     )
     .await?;
@@ -609,6 +611,8 @@ async fn shielded_transfers_to_two_identifiers_same_npk() -> Result<()> {
             to_vpk: Some(vpk_hex),
             to_identifier: Some(identifier_2),
             amount: 200,
+            from_key_path: None,
+            to_key_path: None,
         }),
     )
     .await?;
diff --git a/integration_tests/tests/indexer_ffi.rs b/integration_tests/tests/indexer_ffi.rs
index ac1dab4c..2730f9b5 100644
--- a/integration_tests/tests/indexer_ffi.rs
+++ b/integration_tests/tests/indexer_ffi.rs
@@ -93,6 +93,8 @@ fn indexer_ffi_state_consistency() -> Result<()> {
         to_vpk: None,
         amount: 100,
         to_identifier: Some(0),
+        from_key_path: None,
+        to_key_path: None,
     });
 
     runtime_wrapped.block_on(wallet::cli::execute_subcommand(ctx.wallet_mut(), command))?;
@@ -135,6 +137,8 @@ fn indexer_ffi_state_consistency() -> Result<()> {
         to_vpk: None,
         amount: 100,
         to_identifier: Some(0),
+        from_key_path: None,
+        to_key_path: None,
     });
 
     runtime_wrapped.block_on(wallet::cli::execute_subcommand(ctx.wallet_mut(), command))?;
@@ -238,6 +242,8 @@ fn indexer_ffi_state_consistency_with_labels() -> Result<()> {
         to_vpk: None,
         amount: 100,
         to_identifier: Some(0),
+        from_key_path: None,
+        to_key_path: None,
     });
 
     runtime_wrapped.block_on(wallet::cli::execute_subcommand(ctx.wallet_mut(), command))?;
diff --git a/keycard_wallet/src/python_path.rs b/keycard_wallet/src/python_path.rs
index c8eb049e..b7159295 100644
--- a/keycard_wallet/src/python_path.rs
+++ b/keycard_wallet/src/python_path.rs
@@ -6,9 +6,14 @@ use pyo3::{prelude::*, types::PyList};
 pub fn add_python_path(py: Python<'_>) -> PyResult<()> {
     let current_dir = env::current_dir().expect("Failed to get current working directory");
 
+    let python_base = env::var("VIRTUAL_ENV")
+        .ok()
+        .and_then(|v| PathBuf::from(v).parent().map(PathBuf::from))
+        .unwrap_or_else(|| current_dir.clone());
+
     let mut paths_to_add: Vec<PathBuf> = vec![
-        current_dir.join("python"),
-        current_dir.join("python").join("keycard-py"),
+        python_base.join("python"),
+        python_base.join("python").join("keycard-py"),
     ];
 
     // If a virtualenv is active, add its site-packages so that dependencies
diff --git a/wallet/src/program_facades/native_token_transfer/public.rs b/wallet/src/program_facades/native_token_transfer/public.rs
index 1a7c7f36..69185147 100644
--- a/wallet/src/program_facades/native_token_transfer/public.rs
+++ b/wallet/src/program_facades/native_token_transfer/public.rs
@@ -9,7 +9,7 @@ use pyo3::exceptions::PyRuntimeError;
 use sequencer_service_rpc::RpcClient as _;
 
 use super::NativeTokenTransfer;
-use crate::{ExecutionFailureKind, WalletCore};
+use crate::ExecutionFailureKind;
 
 impl NativeTokenTransfer<'_> {
     pub async fn send_public_transfer(
@@ -57,14 +57,14 @@ impl NativeTokenTransfer<'_> {
                     to_key_path,
                     &msg_hash,
                 )?;
-                WitnessSet::from_list(&[from_sig, to_sig], &[from_pk, to_pk])
+                WitnessSet::from_list(&message, &[from_sig, to_sig], &[from_pk, to_pk])
+                    .map_err(ExecutionFailureKind::TransactionBuildError)?
             } else {
-                WitnessSet::from_list(&[from_sig], &[from_pk])
+                WitnessSet::from_list(&message, &[from_sig], &[from_pk])
+                    .map_err(ExecutionFailureKind::TransactionBuildError)?
             }
         } else {
-            // Silently skips accounts without signing keys
-            let witness_set = WalletCore::sign_public_message(self.0, &message, &sign_ids)
-                .expect("`WalletCore::sign_public_message()` failed to produce a signature for a NativeTokenTransfer.");
+            self.0.sign_public_message(&message, &message.account_ids)?
         };
 
         let tx = PublicTransaction::new(message, witness_set);
@@ -104,7 +104,8 @@ impl NativeTokenTransfer<'_> {
                 key_path,
                 &message.hash_message(),
             )?;
-            WitnessSet::from_list(&[signature], &[pub_key])
+            WitnessSet::from_list(&message, &[signature], &[pub_key])
+                .map_err(ExecutionFailureKind::TransactionBuildError)?
         } else {
             let signing_key = self.0.storage.user_data.get_pub_account_signing_key(from);