diff --git a/cts/schemas/test-3/ref/sort-nvsets.ref-1 b/cts/schemas/test-3/ref/sort-nvsets.ref-1
index d06f9948d2..38cfc6e4cc 100644
--- a/cts/schemas/test-3/ref/sort-nvsets.ref-1
+++ b/cts/schemas/test-3/ref/sort-nvsets.ref-1
@@ -1,115 +1,115 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0" original="1">
   <configuration original="1">
     <!-- The essential elements of this test are:
          * There are several nvset elements (cluster_property_set,
            instance_attributes, meta_attributes, utilization) distributed among
            various parent element types.
          * Many of the nvsets have score attributes.
          * Each of the nvsets has an id attribute with a number that indicates
            its sort order relative to its siblings of the same element type, or
            an id-ref to the same.
          * One cluster_property_set has id "cib-bootstrap-options" and score
            "-INFINITY".
          * One meta_attributes set has an nvpair child, to verify that children
            are preserved. Otherwise, children are omitted, for readability.
          * The document orders of 0 vs. empty score and of "INFINITY" vs.
            "+INFINITY" are reversed in rsc_defaults and op_defaults compared to
            the other elements.
 
          In this situation:
          * All nvset elements should be moved below their non-nvset siblings.
          * The cluster_property_set with id "cib-bootstrap-options" should be
            ordered before all its siblings. "cib-bootstrap-options" always sorts
            first regardless of score.
          * Otherwise, nvset elements of a given type under a given parent should
            be ordered according to their score attribute (using document order
            in case of a tie), which corresponds to the numbers in their IDs.
 
          This doesn't test every possible location where a nvset elements may
          occur, but it should be exhaustive enough to be satisfactory.
       -->
     <crm_config original="1">
-      <cluster_property_set id="cps7" score="-30" original="1"/>
-      <cluster_property_set id="cps3" score="120" original="1"/>
-      <cluster_property_set id="cps5" original="1"/>
-      <cluster_property_set id="cps8" score="-INFINITY" original="1"/>
       <cluster_property_set id="cib-bootstrap-options" score="-INFINITY" original="1"/>
-      <cluster_property_set id="cps4" score="70" original="1"/>
-      <cluster_property_set id="cps6" score="0" original="1"/>
       <cluster_property_set id="cps1" score="+INFINITY" original="1"/>
       <cluster_property_set id="cps2" score="INFINITY" original="1"/>
+      <cluster_property_set id="cps3" score="120" original="1"/>
+      <cluster_property_set id="cps4" score="70" original="1"/>
+      <cluster_property_set id="cps5" original="1"/>
+      <cluster_property_set id="cps6" score="0" original="1"/>
+      <cluster_property_set id="cps7" score="-30" original="1"/>
+      <cluster_property_set id="cps8" score="-INFINITY" original="1"/>
     </crm_config>
     <nodes original="1"/>
     <resources original="1">
       <clone id="clone1" original="1">
-        <meta_attributes id="cma7" score="-30" original="1"/>
-        <meta_attributes id="cma3" score="120" original="1"/>
-        <meta_attributes id="cma5" original="1"/>
-        <meta_attributes id="cma8" score="-INFINITY" original="1"/>
         <primitive class="ocf" id="rsc1" provider="heartbeat" type="apache" original="1">
-          <utilization id="pu3" score="120" original="1"/>
-          <instance_attributes id="pia5" original="1"/>
-          <meta_attributes id="pma7" score="-30" original="1"/>
-          <meta_attributes id="pma3" score="120" original="1"/>
-          <utilization id="pu5" original="1"/>
-          <instance_attributes id="pia3" score="120" original="1"/>
-          <meta_attributes id="pma5" original="1"/>
-          <utilization id="pu7" score="-30" original="1"/>
           <operations original="1">
             <op id="rsc1_monitor_20000" interval="20s" name="monitor" original="1">
+              <meta_attributes id="oma1" score="120" original="1"/>
               <meta_attributes id="oma2" original="1"/>
               <meta_attributes id="oma3" score="-30" original="1"/>
-              <meta_attributes id="oma1" score="120" original="1"/>
             </op>
           </operations>
           <instance_attributes id="pia1" score="+INFINITY" original="1"/>
-          <meta_attributes id="pma8" score="-INFINITY" original="1"/>
           <instance_attributes id="pia2" score="INFINITY" original="1"/>
-          <meta_attributes id="pma4" score="70" original="1"/>
-          <utilization id="pu4" score="70" original="1"/>
           <utilization id="pu1" score="+INFINITY" original="1"/>
-          <instance_attributes id="pia7" score="-30" original="1"/>
-          <meta_attributes id="pma6" score="0" original="1"/>
-          <utilization id="pu8" score="-INFINITY" original="1"/>
           <meta_attributes id="pma1" score="+INFINITY" original="1"/>
-          <instance_attributes id="pia8" score="-INFINITY" original="1"/>
-          <instance_attributes id="pia4" score="70" original="1"/>
           <meta_attributes id="pma2" score="INFINITY" original="1"/>
+          <utilization id="pu2" score="INFINITY" original="1"/>
+          <utilization id="pu3" score="120" original="1"/>
+          <meta_attributes id="pma3" score="120" original="1"/>
+          <instance_attributes id="pia3" score="120" original="1"/>
+          <meta_attributes id="pma4" score="70" original="1"/>
+          <utilization id="pu4" score="70" original="1"/>
+          <instance_attributes id="pia4" score="70" original="1"/>
+          <instance_attributes id="pia5" original="1"/>
+          <utilization id="pu5" original="1"/>
+          <meta_attributes id="pma5" original="1"/>
+          <meta_attributes id="pma6" score="0" original="1"/>
           <utilization id="pu6" score="0" original="1"/>
           <instance_attributes id="pia6" score="0" original="1"/>
-          <utilization id="pu2" score="INFINITY" original="1"/>
+          <meta_attributes id="pma7" score="-30" original="1"/>
+          <utilization id="pu7" score="-30" original="1"/>
+          <instance_attributes id="pia7" score="-30" original="1"/>
+          <meta_attributes id="pma8" score="-INFINITY" original="1"/>
+          <utilization id="pu8" score="-INFINITY" original="1"/>
+          <instance_attributes id="pia8" score="-INFINITY" original="1"/>
         </primitive>
-        <meta_attributes id="cma4" score="70" original="1"/>
-        <meta_attributes id="cma6" score="0" original="1"/>
         <meta_attributes id="cma1" score="+INFINITY" original="1"/>
         <meta_attributes id="cma2" score="INFINITY" original="1"/>
+        <meta_attributes id="cma3" score="120" original="1"/>
+        <meta_attributes id="cma4" score="70" original="1"/>
+        <meta_attributes id="cma5" original="1"/>
+        <meta_attributes id="cma6" score="0" original="1"/>
+        <meta_attributes id="cma7" score="-30" original="1"/>
+        <meta_attributes id="cma8" score="-INFINITY" original="1"/>
       </clone>
     </resources>
     <constraints original="1"/>
     <rsc_defaults original="1">
-      <meta_attributes id="rdma7" score="-30" original="1"/>
+      <meta_attributes id="rdma1" score="INFINITY" original="1"/>
+      <meta_attributes id="rdma2" score="+INFINITY" original="1"/>
       <meta_attributes id="rdma3" score="120" original="1">
         <nvpair id="rdma3-option1" name="option1" value="value1" original="1"/>
       </meta_attributes>
+      <meta_attributes id="rdma4" score="70" original="1"/>
       <meta_attributes id="rdma5" score="0" original="1"/>
       <meta_attributes id="rdma6" original="1"/>
+      <meta_attributes id="rdma7" score="-30" original="1"/>
       <meta_attributes id="rdma8" score="-INFINITY" original="1"/>
-      <meta_attributes id="rdma4" score="70" original="1"/>
-      <meta_attributes id="rdma1" score="INFINITY" original="1"/>
-      <meta_attributes id="rdma2" score="+INFINITY" original="1"/>
     </rsc_defaults>
     <op_defaults original="1">
-      <meta_attributes id="rdma7" score="-30" original="0"/>
+      <meta_attributes id="rdma1" score="INFINITY" original="0"/>
+      <meta_attributes id="rdma2" score="+INFINITY" original="0"/>
       <meta_attributes id="rdma3" score="120" original="0">
         <nvpair id="rdma3-option1" name="option1" value="value1" original="0"/>
       </meta_attributes>
-      <meta_attributes id="rdma5" score="0" original="0"/>
-      <meta_attributes id="rdma8" score="-INFINITY" original="0"/>
       <meta_attributes id="rdma4" score="70" original="0"/>
+      <meta_attributes id="rdma5" score="0" original="0"/>
       <meta_attributes id="rdma6" original="0"/>
-      <meta_attributes id="rdma1" score="INFINITY" original="0"/>
-      <meta_attributes id="rdma2" score="+INFINITY" original="0"/>
+      <meta_attributes id="rdma7" score="-30" original="0"/>
+      <meta_attributes id="rdma8" score="-INFINITY" original="0"/>
     </op_defaults>
   </configuration>
   <status original="1"/>
 </cib>
diff --git a/cts/schemas/test-3/ref/sort-nvsets.ref-99 b/cts/schemas/test-3/ref/sort-nvsets.ref-99
index 69ac9aacbb..26d18812f7 100644
--- a/cts/schemas/test-3/ref/sort-nvsets.ref-99
+++ b/cts/schemas/test-3/ref/sort-nvsets.ref-99
@@ -1,113 +1,113 @@
 <cib crm_feature_set="3.19.7" validate-with="pacemaker-4.0" epoch="8" num_updates="0" admin_epoch="0">
   <configuration>
     <!-- The essential elements of this test are:
          * There are several nvset elements (cluster_property_set,
            instance_attributes, meta_attributes, utilization) distributed among
            various parent element types.
          * Many of the nvsets have score attributes.
          * Each of the nvsets has an id attribute with a number that indicates
            its sort order relative to its siblings of the same element type, or
            an id-ref to the same.
          * One cluster_property_set has id "cib-bootstrap-options" and score
            "-INFINITY".
          * One meta_attributes set has an nvpair child, to verify that children
            are preserved. Otherwise, children are omitted, for readability.
          * The document orders of 0 vs. empty score and of "INFINITY" vs.
            "+INFINITY" are reversed in rsc_defaults and op_defaults compared to
            the other elements.
 
          In this situation:
          * All nvset elements should be moved below their non-nvset siblings.
          * The cluster_property_set with id "cib-bootstrap-options" should be
            ordered before all its siblings. "cib-bootstrap-options" always sorts
            first regardless of score.
          * Otherwise, nvset elements of a given type under a given parent should
            be ordered according to their score attribute (using document order
            in case of a tie), which corresponds to the numbers in their IDs.
 
          This doesn't test every possible location where a nvset elements may
          occur, but it should be exhaustive enough to be satisfactory.
       -->
     <crm_config>
-      <cluster_property_set id="cps7" score="-30"/>
-      <cluster_property_set id="cps3" score="120"/>
-      <cluster_property_set id="cps5"/>
-      <cluster_property_set id="cps8" score="-INFINITY"/>
       <cluster_property_set id="cib-bootstrap-options" score="-INFINITY"/>
-      <cluster_property_set id="cps4" score="70"/>
-      <cluster_property_set id="cps6" score="0"/>
       <cluster_property_set id="cps1" score="+INFINITY"/>
       <cluster_property_set id="cps2" score="INFINITY"/>
+      <cluster_property_set id="cps3" score="120"/>
+      <cluster_property_set id="cps4" score="70"/>
+      <cluster_property_set id="cps5"/>
+      <cluster_property_set id="cps6" score="0"/>
+      <cluster_property_set id="cps7" score="-30"/>
+      <cluster_property_set id="cps8" score="-INFINITY"/>
     </crm_config>
     <nodes/>
     <resources>
       <clone id="clone1">
-        <meta_attributes id="cma7" score="-30"/>
-        <meta_attributes id="cma3" score="120"/>
-        <meta_attributes id="cma5"/>
-        <meta_attributes id="cma8" score="-INFINITY"/>
         <primitive class="ocf" id="rsc1" provider="heartbeat" type="apache">
-          <utilization id="pu3" score="120"/>
-          <instance_attributes id="pia5"/>
-          <meta_attributes id="pma7" score="-30"/>
-          <meta_attributes id="pma3" score="120"/>
-          <utilization id="pu5"/>
-          <instance_attributes id="pia3" score="120"/>
-          <meta_attributes id="pma5"/>
-          <utilization id="pu7" score="-30"/>
           <operations>
             <op id="rsc1_monitor_20000" interval="20s" name="monitor">
+              <meta_attributes id="oma1" score="120"/>
               <meta_attributes id="oma2"/>
               <meta_attributes id="oma3" score="-30"/>
-              <meta_attributes id="oma1" score="120"/>
             </op>
           </operations>
           <instance_attributes id="pia1" score="+INFINITY"/>
-          <meta_attributes id="pma8" score="-INFINITY"/>
           <instance_attributes id="pia2" score="INFINITY"/>
-          <meta_attributes id="pma4" score="70"/>
-          <utilization id="pu4" score="70"/>
           <utilization id="pu1" score="+INFINITY"/>
-          <instance_attributes id="pia7" score="-30"/>
-          <meta_attributes id="pma6" score="0"/>
-          <utilization id="pu8" score="-INFINITY"/>
           <meta_attributes id="pma1" score="+INFINITY"/>
-          <instance_attributes id="pia8" score="-INFINITY"/>
-          <instance_attributes id="pia4" score="70"/>
           <meta_attributes id="pma2" score="INFINITY"/>
+          <utilization id="pu2" score="INFINITY"/>
+          <utilization id="pu3" score="120"/>
+          <meta_attributes id="pma3" score="120"/>
+          <instance_attributes id="pia3" score="120"/>
+          <meta_attributes id="pma4" score="70"/>
+          <utilization id="pu4" score="70"/>
+          <instance_attributes id="pia4" score="70"/>
+          <instance_attributes id="pia5"/>
+          <utilization id="pu5"/>
+          <meta_attributes id="pma5"/>
+          <meta_attributes id="pma6" score="0"/>
           <utilization id="pu6" score="0"/>
           <instance_attributes id="pia6" score="0"/>
-          <utilization id="pu2" score="INFINITY"/>
+          <meta_attributes id="pma7" score="-30"/>
+          <utilization id="pu7" score="-30"/>
+          <instance_attributes id="pia7" score="-30"/>
+          <meta_attributes id="pma8" score="-INFINITY"/>
+          <utilization id="pu8" score="-INFINITY"/>
+          <instance_attributes id="pia8" score="-INFINITY"/>
         </primitive>
-        <meta_attributes id="cma4" score="70"/>
-        <meta_attributes id="cma6" score="0"/>
         <meta_attributes id="cma1" score="+INFINITY"/>
         <meta_attributes id="cma2" score="INFINITY"/>
+        <meta_attributes id="cma3" score="120"/>
+        <meta_attributes id="cma4" score="70"/>
+        <meta_attributes id="cma5"/>
+        <meta_attributes id="cma6" score="0"/>
+        <meta_attributes id="cma7" score="-30"/>
+        <meta_attributes id="cma8" score="-INFINITY"/>
       </clone>
     </resources>
     <constraints/>
     <rsc_defaults>
-      <meta_attributes id="rdma7" score="-30"/>
+      <meta_attributes id="rdma1" score="INFINITY"/>
+      <meta_attributes id="rdma2" score="+INFINITY"/>
       <meta_attributes id="rdma3" score="120">
         <nvpair id="rdma3-option1" name="option1" value="value1"/>
       </meta_attributes>
+      <meta_attributes id="rdma4" score="70"/>
       <meta_attributes id="rdma5" score="0"/>
       <meta_attributes id="rdma6"/>
+      <meta_attributes id="rdma7" score="-30"/>
       <meta_attributes id="rdma8" score="-INFINITY"/>
-      <meta_attributes id="rdma4" score="70"/>
-      <meta_attributes id="rdma1" score="INFINITY"/>
-      <meta_attributes id="rdma2" score="+INFINITY"/>
     </rsc_defaults>
     <op_defaults>
-      <meta_attributes id-ref="rdma7"/>
+      <meta_attributes id-ref="rdma1"/>
+      <meta_attributes id-ref="rdma2"/>
       <meta_attributes id-ref="rdma3"/>
-      <meta_attributes id-ref="rdma5"/>
-      <meta_attributes id-ref="rdma8"/>
       <meta_attributes id-ref="rdma4"/>
+      <meta_attributes id-ref="rdma5"/>
       <meta_attributes id-ref="rdma6"/>
-      <meta_attributes id-ref="rdma1"/>
-      <meta_attributes id-ref="rdma2"/>
+      <meta_attributes id-ref="rdma7"/>
+      <meta_attributes id-ref="rdma8"/>
     </op_defaults>
   </configuration>
   <status/>
 </cib>
diff --git a/xml/upgrade-3.10-1.xsl b/xml/upgrade-3.10-1.xsl
index 790d99f073..d5993e7d3c 100644
--- a/xml/upgrade-3.10-1.xsl
+++ b/xml/upgrade-3.10-1.xsl
@@ -1,36 +1,109 @@
 <?xml version="1.0" encoding="UTF-8"?>
 
 <!--
  Use comments liberally as future maintainers may be unfamiliar with XSLT.
  -->
 
 <!--
  upgrade-3.10-1.xsl
 
  Guarantees after this transformation:
  * The validate-with attribute of the cib element is set to "pacemaker-4.0".
+ * All nvset elements are sorted by score within their respective parent
+   elements (remaining in document order in the case of a tie) and placed below
+   all non-nvset siblings. Exception: a cluster_property_set with id
+   "cib-bootstrap-options" always sorts first relative to its siblings.
+
+ nvset elements include the following:
+ * cluster_property_set
+ * instance_attributes
+ * meta_attributes
+ * utilization
+
+ Any template that matches an element (for example, "primitive") that may
+ contain an nvset should be placed in a later stylesheet. If such a template is
+ placed in this stylesheet, its nvsets will not be sorted. We could avoid this
+ with some refactoring, but it's cleaner this way.
  -->
 
 <xsl:stylesheet version="1.0"
                 xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
 
 <xsl:import href="upgrade-3.10-common.xsl"/>
 
-<!-- Copy everything unaltered by default -->
+<!--
+ Copy everything unaltered by default, except sort nvset elements by score.
+
+ This doesn't affect behavior. nvset elements of a given type within a given
+ parent element are processed in order of their score attributes, with a
+ nonexistent score treated as 0. In the event of a tie, elements are processed
+ in document order. The sort here preserves document order in the event of a
+ tie.
+
+ The order of nvset elements relative to non-nvset elements does not matter. So
+ this template puts existing nvset elements after existing non-nvset elements.
+
+ This facilitates later transformations, allowing us to more easily drop nvpairs
+ with unsupported values without changing behavior.
+ -->
 <xsl:template match="/|@*|node()">
-    <xsl:call-template name="identity"/>
+    <xsl:copy>
+        <xsl:variable name="nvsets"
+                      select="cluster_property_set
+                              |instance_attributes
+                              |meta_attributes
+                              |utilization"/>
+
+        <!-- XPath 1.0 set difference idiom -->
+        <xsl:variable name="non_nvsets"
+                      select="@*|node()[count(.|$nvsets) != count($nvsets)]"/>
+
+        <xsl:apply-templates select="$non_nvsets"/>
+        <xsl:apply-templates select="$nvsets">
+            <!--
+             Order cluster_property_set with id "cib-bootstrap-options" before
+             siblings
+             -->
+            <xsl:sort select="self::cluster_property_set
+                              and (@id = 'cib-bootstrap-options')"
+                      order="descending"/>
+
+            <!--
+             Sort remaining elements by score.
+
+             First, score="INFINITY" (including "+INFINITY").
+             -->
+            <xsl:sort select="@score[. = 'INFINITY'] or @score[. = '+INFINITY']"
+                      order="descending"/>
+
+            <!-- Then finite positive scores -->
+            <xsl:sort select="@score[. &gt; 0]" data-type="number"
+                      order="descending"/>
+
+            <!-- Then score 0 (including implicit) -->
+            <xsl:sort select="number(not(@score) or @score[. = 0])"
+                      data-type="number" order="descending"/>
+
+            <!-- Then finite negative scores -->
+            <xsl:sort select="@score[. &lt; 0]" data-type="number"
+                      order="descending"/>
+
+            <!-- Then score="-INFINITY" -->
+            <xsl:sort select="@score[. = '-INFINITY']" order="descending"/>
+        </xsl:apply-templates>
+    </xsl:copy>
 </xsl:template>
 
 <!--
  Bump cib/@validate-with, or set it if not already set. Pacemaker does this, but
  doing it in the transformation is helpful for testing.
  -->
 <xsl:template match="cib">
     <xsl:copy>
         <xsl:apply-templates select="@*"/>
         <xsl:attribute name="validate-with">pacemaker-4.0</xsl:attribute>
         <xsl:apply-templates select="node()"/>
     </xsl:copy>
 </xsl:template>
 
 </xsl:stylesheet>