diff --git a/src/apps/monero/xmr/bulletproof.py b/src/apps/monero/xmr/bulletproof.py
index 383505286..173465b3a 100644
--- a/src/apps/monero/xmr/bulletproof.py
+++ b/src/apps/monero/xmr/bulletproof.py
@@ -805,6 +805,7 @@ def prove_s2(self, x_ip, y, hash_cache, l, r, L, R, aprime0, bprime0):
                 aprime.slice(_tmp_vct_1, nprime, aprime.size),
                 bprime.slice(_tmp_vct_2, 0, nprime),
             )
+            self.gc(23)
 
             # PAPER LINES 18-19
             vector_exponent_custom(
@@ -825,7 +826,7 @@ def prove_s2(self, x_ip, y, hash_cache, l, r, L, R, aprime0, bprime0):
                 bprime.slice(_tmp_vct_4, 0, nprime),
                 R[round],
             )
-            self.gc(23)
+            self.gc(24)
 
             sc_mul(tmp, cR, x_ip)
             add_keys(R[round], R[round], scalarmult_key(_tmp_k_1, XMR_H, tmp))
@@ -835,7 +836,7 @@ def prove_s2(self, x_ip, y, hash_cache, l, r, L, R, aprime0, bprime0):
 
             # PAPER LINES 24-25
             invert(winv, w[round])
-            self.gc(24)
+            self.gc(25)
 
             hadamard2(
                 vector_scalar2(Gprime.slice(_tmp_vct_1, 0, nprime), winv, _tmp_vct_3),
@@ -854,7 +855,7 @@ def prove_s2(self, x_ip, y, hash_cache, l, r, L, R, aprime0, bprime0):
                 ),
                 Hprime,
             )
-            self.gc(25)
+            self.gc(26)
 
             # PAPER LINES 28-29
             vector_add(
@@ -876,7 +877,7 @@ def prove_s2(self, x_ip, y, hash_cache, l, r, L, R, aprime0, bprime0):
             )
 
             round += 1
-            self.gc(26)
+            self.gc(27)
 
         copy_key(aprime0, aprime[0])
         copy_key(bprime0, bprime[0])