diff --git a/tests/golden/worm-xattr-unit b/tests/golden/worm-xattr-unit
new file mode 100644
index 00000000..50e1ee8d
--- /dev/null
+++ b/tests/golden/worm-xattr-unit
@@ -0,0 +1,53 @@
+== worm xattr creation without .hide. fails
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== worm xattr creation on dir fails
+setfattr: /mnt/test/test/worm-xattr-unit: Invalid argument
+== worm xattr creation
+== get correct parsed timespec value
+== hidden scoutfs xattrs before expire
+== user xattr creation before expire fails
+setfattr: /mnt/test.0/test/worm-xattr-unit/file-1: Permission denied
+== worm xattr deletion before expire fails
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Permission denied
+== worm xattr update before expire fails
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Permission denied
+== other worm xattr create before expire fails
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Permission denied
+== file deletion before expire fails
+rm: cannot remove ‘/mnt/test/test/worm-xattr-unit/file-1’: Permission denied
+== file rename before expire fails
+mv: cannot move ‘/mnt/test/test/worm-xattr-unit/file-1’ to ‘/mnt/test/test/worm-xattr-unit/file-2’: Permission denied
+== file write before expire fails
+date: write error: Permission denied
+== file truncate before expire fails
+truncate: failed to truncate ‘/mnt/test/test/worm-xattr-unit/file-1’ at 0 bytes: Permission denied
+== file inode update before expire fails
+touch: setting times of ‘/mnt/test/test/worm-xattr-unit/file-1’: Permission denied
+== wait until expiration
+== file write after expire
+== file rename after expire
+== other worm xattr create after expire fails
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== xattr deletion after expire
+== invalid all zero expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== invalid non integer expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== invalid only dots dots expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== invalid mixed dots secs expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== invalid (u32)(u64) nsecs expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== invalid negative (signed)(u64) secs expire value
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+setfattr: /mnt/test/test/worm-xattr-unit/file-1: Invalid argument
+== cleanup
diff --git a/tests/sequence b/tests/sequence
index 37f30647..46d465fe 100644
--- a/tests/sequence
+++ b/tests/sequence
@@ -12,6 +12,7 @@ move-blocks.sh
 enospc.sh
 srch-basic-functionality.sh
 simple-xattr-unit.sh
+worm-xattr-unit.sh
 totl-xattr-tag.sh
 lock-refleak.sh
 lock-shrink-consistency.sh
diff --git a/tests/tests/worm-xattr-unit.sh b/tests/tests/worm-xattr-unit.sh
new file mode 100644
index 00000000..bf30f012
--- /dev/null
+++ b/tests/tests/worm-xattr-unit.sh
@@ -0,0 +1,97 @@
+t_require_commands touch rm setfattr
+
+touch "$T_D0/file-1"
+SECS=$(date '+%s')
+NSECS=$(date '+%N')
+DELAY=10
+EXP=$((SECS + DELAY))
+
+echo "== worm xattr creation without .hide. fails"
+setfattr -n scoutfs.worm.level1_expire -v $EXP.$NSECS "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== worm xattr creation on dir fails"
+setfattr -n scoutfs.hide.worm.level1_expire -v $EXP.$NSECS "$T_D0" 2>&1 | t_filter_fs
+
+echo "== worm xattr creation"
+setfattr -n scoutfs.hide.worm.level1_expire -v $EXP.$NSECS "$T_D0/file-1"
+
+echo "== get correct parsed timespec value"
+diff -u --ignore-all-space <(echo "$EXP.$NSECS") <(getfattr --absolute-names --only-values -n scoutfs.hide.worm.level1_expire -m - "$T_D0/file-1")
+
+echo "== hidden scoutfs xattrs before expire"
+setfattr -n scoutfs.hide.srch.worm_test -v val "$T_D0/file-1"
+
+echo "== user xattr creation before expire fails"
+setfattr -n user.worm_test -v val "$T_D0/file-1"
+
+echo "== worm xattr deletion before expire fails"
+setfattr -x scoutfs.hide.worm.level1_expire "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== worm xattr update before expire fails"
+setfattr -n scoutfs.hide.worm.level1_expire -v $SECS.$NSECS "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== other worm xattr create before expire fails"
+setfattr -n scoutfs.hide.worm.other.level1_expire -v 123.456 "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== file deletion before expire fails"
+rm -f "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== file rename before expire fails"
+mv $T_D0/file-1 $T_D0/file-2 2>&1 | t_filter_fs
+
+echo "== file write before expire fails"
+date >> $T_D0/file-1
+
+echo "== file truncate before expire fails"
+truncate -s 0 $T_D0/file-1 2>&1 | t_filter_fs
+
+echo "== file inode update before expire fails"
+touch $T_D0/file-1 2>&1 | t_filter_fs
+
+echo "== wait until expiration"
+sleep $((DELAY + 1))
+
+echo "== file write after expire"
+date >> $T_D0/file-1
+
+echo "== file rename after expire"
+mv $T_D0/file-1 $T_D0/file-2
+mv $T_D0/file-2 $T_D0/file-1
+
+echo "== other worm xattr create after expire fails"
+setfattr -n scoutfs.hide.worm.other.level1_expire -v 123.456 "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== xattr deletion after expire"
+setfattr -x scoutfs.hide.worm.level1_expire "$T_D0/file-1"
+
+echo "== invalid all zero expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v 0.0 "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== invalid non integer expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v a.a "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== invalid only dots dots expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v . "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v .. "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v ... "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== invalid mixed dots secs expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v 11 "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v .11 "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v 11. "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v .11. "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v .1.1. "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== invalid (u32)(u64) nsecs expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v 1.1000000000 "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v 1.4294967296 "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v 1.18446744073709551615 "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== invalid negative (signed)(u64) secs expire value"
+setfattr -n scoutfs.hide.worm.level1_expire -v 9223372036854775808.1 "$T_D0/file-1" 2>&1 | t_filter_fs
+setfattr -n scoutfs.hide.worm.level1_expire -v 18446744073709551615.1 "$T_D0/file-1" 2>&1 | t_filter_fs
+
+echo "== cleanup"
+rm -f "$T_D0/file-1"
+
+t_pass