diff --git a/hdl/hazard3_frontend.v b/hdl/hazard3_frontend.v
index 527ada0..603a8c7 100644
--- a/hdl/hazard3_frontend.v
+++ b/hdl/hazard3_frontend.v
@@ -565,7 +565,7 @@ wire [4:0] zcmp_pushpop_rs1 =
 wire [4:0] zcmp_sa01_r1s  = {|next_instr[9:8], ~&next_instr[9:8], next_instr[9:7]};
 wire [4:0] zcmp_sa01_r2s  = {|next_instr[2:1], ~&next_instr[2:1], next_instr[2:0]};
 
-wire [4:0] zcmp_mvsa01_rs1 = {4'h4, uop_ctr[0]};
+wire [4:0] zcmp_mvsa01_rs1 = {4'h5, uop_ctr[0]};
 wire [4:0] zcmp_mva01s_rs1 = uop_ctr[0] ? zcmp_sa01_r2s : zcmp_sa01_r1s;
 
 always @ (*) begin
diff --git a/hdl/hazard3_instr_decompress.v b/hdl/hazard3_instr_decompress.v
index 41649a0..cc3e4b7 100644
--- a/hdl/hazard3_instr_decompress.v
+++ b/hdl/hazard3_instr_decompress.v
@@ -129,8 +129,11 @@ wire [6:0] zcmp_stack_adj_base =
 	zcmp_rlist[3:2] == 2'h2 ? 7'h20 :
 	zcmp_rlist[3:0] == 4'hf ? 7'h40 : 7'h30;
 
-wire [11:0] zcmp_stack_lw_offset = {6'h00, uop_ctr, 2'h0};
-wire [11:0] zcmp_stack_sw_offset = zcmp_stack_lw_offset - {5'h00, zcmp_stack_adj_base};
+wire [6:0] zcmp_stack_adj_extra = {1'b0, instr_in[3:2], 4'h0};
+
+// Note we perform all load/stores before moving the stack pointer.
+wire [11:0] zcmp_stack_lw_offset = {6'h00, uop_ctr, 2'h0} + {5'h00, zcmp_stack_adj_extra};
+wire [11:0] zcmp_stack_sw_offset = {6'h00, uop_ctr, 2'h0} - {5'h00, zcmp_stack_adj_base};
 
 wire [4:0] zcmp_ls_reg =
 	uop_ctr == 4'h0 ? 5'd01 : // ra
@@ -146,7 +149,7 @@ wire [31:0] zcmp_pop_lw_instr = `RVOPC_NOZ_LW | rfmt_rd(zcmp_ls_reg) | rfmt_rs1(
 	zcmp_stack_lw_offset[11:0], 20'h00000
 };
 
-wire [11:0] zcmp_abs_stack_adj = {5'h00, zcmp_stack_adj_base} + {6'h00, instr_in[3:2], 4'h0};
+wire [11:0] zcmp_abs_stack_adj = {5'h00, zcmp_stack_adj_base} + {5'h00, zcmp_stack_adj_extra};
 
 wire [31:0] zcmp_push_stack_adj_instr = `RVOPC_NOZ_ADDI | rfmt_rd(5'd2) | rfmt_rs1(5'd2) | {
 	-zcmp_abs_stack_adj,