diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a0c70608..df8c131c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,10 +98,21 @@ jobs:
           path: leanSpec/packages/testing/src/consensus_testing/test_keys/prod_scheme
           key: prod-keys-${{ steps.prod-keys-url.outputs.hash }}
 
+      # Download + extract the keys ourselves rather than via
+      # `consensus_testing.keys --download`. The pinned leanSpec commit predates
+      # leanSpec PR #745, whose `download_keys` reads the still-open (unflushed)
+      # download tempfile, intermittently truncating the gzip tail and aborting
+      # with EOFError. curl+tar fully writes the archive before reading it.
+      # Remove once the pin moves past PR #745.
       - name: Download production keys
         if: steps.cache-fixtures.outputs.cache-hit != 'true' && steps.cache-prod-keys.outputs.cache-hit != 'true'
         working-directory: leanSpec
-        run: uv run python -m consensus_testing.keys --download --scheme prod
+        run: |
+          KEYS_URL=$(uv run python -c "from consensus_testing.keys import KEY_DOWNLOAD_URLS; print(KEY_DOWNLOAD_URLS['prod'])")
+          KEYS_DIR=packages/testing/src/consensus_testing/test_keys
+          mkdir -p "$KEYS_DIR"
+          curl -sSL "$KEYS_URL" -o /tmp/prod_scheme.tar.gz
+          tar -xzf /tmp/prod_scheme.tar.gz -C "$KEYS_DIR"
 
       # Save production keys even if a later step fails, so a re-run does
       # not have to re-download. See: https://github.com/actions/cache/tree/main/save#always-save-cache
@@ -120,7 +131,7 @@ jobs:
       - name: Generate test fixtures
         if: steps.cache-fixtures.outputs.cache-hit != 'true'
         working-directory: leanSpec
-        run: uv run fill --fork=Devnet --scheme prod -o fixtures -n auto
+        run: uv run fill --fork=Lstar --scheme prod -o fixtures -n auto
 
       # Save fixtures even if a later step fails, so a re-run does not
       # have to regenerate them. See: https://github.com/actions/cache/tree/main/save#always-save-cache
diff --git a/Makefile b/Makefile
index 74901c8d..d1234c3f 100644
--- a/Makefile
+++ b/Makefile
@@ -24,15 +24,27 @@ docker-build: ## 🐳 Build the Docker image
 		-t ghcr.io/lambdaclass/ethlambda:$(DOCKER_TAG) .
 	@echo
 
-# 2026-04-29
-LEAN_SPEC_COMMIT_HASH:=18fe71fee49f8865a5c8a4cb8b1787b0cbc9e25b
+# 2026-05-17
+LEAN_SPEC_COMMIT_HASH:=f12000bd68a9640cffdfbd9a07503c9112d32bee
 
 leanSpec:
 	git clone https://github.com/leanEthereum/leanSpec.git --single-branch
 	cd leanSpec && git checkout $(LEAN_SPEC_COMMIT_HASH)
 
+# Pre-download the prod keys ourselves before `fill`. The pinned leanSpec
+# commit predates leanSpec PR #745, whose `download_keys` reads the still-open
+# (unflushed) download tempfile, intermittently truncating the gzip tail and
+# aborting with EOFError. A plain curl+tar fully writes the archive before
+# reading it, sidestepping the bug. `fill` then sees the keys already present
+# and skips its own download. Remove once the pin moves past PR #745.
 leanSpec/fixtures: leanSpec
-	cd leanSpec && uv run fill --fork devnet -n auto --scheme=prod -o fixtures
+	cd leanSpec && \
+		KEYS_URL=$$(uv run python -c "from consensus_testing.keys import KEY_DOWNLOAD_URLS; print(KEY_DOWNLOAD_URLS['prod'])") && \
+		KEYS_DIR=packages/testing/src/consensus_testing/test_keys && \
+		mkdir -p $$KEYS_DIR && \
+		curl -sSL "$$KEYS_URL" -o /tmp/prod_scheme.tar.gz && \
+		tar -xzf /tmp/prod_scheme.tar.gz -C $$KEYS_DIR && \
+		uv run fill --fork Lstar -n auto --scheme prod -o fixtures
 
 lean-quickstart:
 	git clone https://github.com/blockblaz/lean-quickstart.git --depth 1 --single-branch