diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml
index 37e99e1f..e2dc16df 100644
--- a/mdx/common-beans.xml
+++ b/mdx/common-beans.xml
@@ -261,6 +261,12 @@
 
     <bean id="PipelineMergeStage.deduplicate" abstract="true" parent="PipelineMergeStage"
         p:collectionMergeStrategy-ref="deduplicateMergeStrategy"/>
+
+    <bean id="SplitMergeStage" abstract="true" parent="stage_parent"
+        class="net.shibboleth.metadata.pipeline.SplitMergeStage"/>
+
+    <bean id="XPathItemSelectionStrategy" abstract="true"
+        class="net.shibboleth.metadata.dom.XPathItemSelectionStrategy"/>
     
     <!-- *** Parent beans for ukf-mda. *** -->
     
diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml
index 91b25280..388e3463 100644
--- a/mdx/uk/generate.xml
+++ b/mdx/uk/generate.xml
@@ -361,7 +361,7 @@
         ***************************************
     -->
     
-    <bean id="uk_wayfSelector" class="net.shibboleth.metadata.dom.XPathItemSelectionStrategy">
+    <bean id="uk_wayfSelector" parent="XPathItemSelectionStrategy">
         <constructor-arg value="/md:EntityDescriptor[not(md:Extensions/wayf:HideFromWAYF)]"/>
         <constructor-arg ref="commonNamespaces"/>
     </bean>
@@ -479,7 +479,7 @@
         Entities in the CDSALL aggregate are restricted to those entities registered by the
         UK federation plus all identity providers from whatever source.
     -->
-    <bean id="CDSAllSelector" class="net.shibboleth.metadata.dom.XPathItemSelectionStrategy">
+    <bean id="CDSAllSelector" parent="XPathItemSelectionStrategy">
         <constructor-arg value="/md:EntityDescriptor[md:IDPSSODescriptor or
             md:Extensions/mdrpi:RegistrationInfo/@registrationAuthority = 'http://ukfederation.org.uk']"/>
         <constructor-arg ref="commonNamespaces"/>
@@ -674,7 +674,7 @@
         </property>
     </bean>
     
-    <bean id="uk_exportSelector" class="net.shibboleth.metadata.dom.XPathItemSelectionStrategy">
+    <bean id="uk_exportSelector" parent="XPathItemSelectionStrategy">
         <constructor-arg value="/md:EntityDescriptor[md:Extensions/ukfedlabel:ExportOptIn]"/>
         <constructor-arg ref="commonNamespaces"/>
     </bean>
@@ -731,7 +731,7 @@
         ***********************************************************
     -->
     
-    <bean id="uk_exportPreviewSelector" class="net.shibboleth.metadata.dom.XPathItemSelectionStrategy">
+    <bean id="uk_exportPreviewSelector" parent="XPathItemSelectionStrategy">
         <constructor-arg value="/md:EntityDescriptor[not(md:Extensions/ukfedlabel:ExportOptOut)]"/>
         <constructor-arg ref="commonNamespaces"/>
     </bean>
@@ -740,6 +740,84 @@
         p:id="uk_exportPreviewPipeline">
         <property name="stages">
             <list>
+
+                <!--
+                    Additional rules excluding entities from the aggregate.
+                    
+                    The basic rule (expressed in uk_exportPreviewSelector) is that
+                    entities are excluded if they do not have the ExportOptOut label.
+                    Additional rules below are applied to entities which do not
+                    have the ExportOptIn label: in other words, a rule in this section
+                    can always be overridden by an explicit ExportOptIn.
+                -->
+                <bean p:id="exclusion" parent="SplitMergeStage">
+
+                    <!-- select entities with ExportOptIn label -->
+                    <property name="selectionStrategy">
+                        <bean parent="XPathItemSelectionStrategy">
+                            <constructor-arg value="/md:EntityDescriptor[md:Extensions/ukfedlabel:ExportOptIn]"/>
+                            <constructor-arg ref="commonNamespaces"/>
+                        </bean>
+                    </property>
+
+                    <!--
+                        Pipeline for selected (explicitly opted in) items.
+                    -->
+                    <property name="selectedItemPipeline">
+                        <bean p:id="selectedItemPipeline" parent="SimplePipeline">
+                            <property name="stages">
+                                <list>
+                                    <!-- nothing required -->
+                                </list>
+                            </property>
+                        </bean>
+                    </property>
+
+                    <!--
+                        The pipeline for unselected (not explicitly opted in) items removes entities
+                        matching specific rules.
+                    -->
+                    <property name="nonselectedItemPipeline">
+                        <bean p:id="nonSelectedItemPipeline" parent="SimplePipeline">
+                            <property name="stages">
+                                <list>
+
+                                    <!-- Identity providers lacking support for SAML 2.0 -->
+                                    <bean p:id="SAML1onlyIdPs" parent="XPathFilteringStage"
+                                        p:XPathExpression="md:IDPSSODescriptor
+                                            [not(contains(@protocolSupportEnumeration,'urn:oasis:names:tc:SAML:2.0:protocol'))]">
+                                    </bean>
+
+                                    <!-- Aggregated schools sector identity providers -->
+                                    <!--
+                                        Preferred implementation:
+                                        
+                                        <bean p:id="syntheticScopes" parent="XPathFilteringStage"
+                                            p:XPathExpression="shibmd:Scope[ends-with(., '.eng.ukfederation.org.uk']"/>
+                                        
+                                        Unfortunately, the "ends-with" function is an XPath 2 feature, so we settle for
+                                        using "contains" instead; in our case it is equivalent.
+                                    -->
+                                    <bean p:id="syntheticScopes" parent="XPathFilteringStage"
+                                        p:XPathExpression="//shibmd:Scope[contains(., '.eng.ukfederation.org.uk')]"/>
+                                    <!-- Specific providers not caught by the previous condition -->
+                                    <bean p:id="GlowScotland" parent="EntityFilterStage">
+                                        <property name="designatedEntities">
+                                            <set>
+                                                <value>https://idp.glowscotland.org.uk/shibboleth</value>
+                                            </set>
+                                        </property>
+                                    </bean>
+
+                                    <!-- Identity providers with regular expression scopes -->
+                                    <bean p:id="regexScopes" parent="XPathFilteringStage"
+                                        p:XPathExpression="//shibmd:Scope[@regexp='true']"/>
+                                </list>
+                            </property>
+                        </bean>
+                    </property>
+                </bean>
+
                 <!--
                     Enforce IdP display name uniqueness before assembling aggregate
                 -->