diff --git a/.github/workflows/duvet-test-server.yml b/.github/workflows/duvet-test-server.yml
index 58ae19a2..75020275 100644
--- a/.github/workflows/duvet-test-server.yml
+++ b/.github/workflows/duvet-test-server.yml
@@ -24,11 +24,9 @@ jobs:
         id: cpu-count
         run: echo "count=$(node -p 'require("os").cpus().length')" >> $GITHUB_OUTPUT
 
-      - name: Setup git submodules with PAT
+      - name: Rewrite SSH submodule URLs to HTTPS
         run: |
           git config --global url."https://github.com/".insteadOf "git@github.com:"
-          git config --global credential.helper store
-          echo "https://x-token-auth:${{ secrets.PAT_FOR_SPEC }}@github.com" > ~/.git-credentials
 
       - name: Optimize git for performance
         run: |
diff --git a/.github/workflows/test-server.yml b/.github/workflows/test-server.yml
index b60c2167..40caf29e 100644
--- a/.github/workflows/test-server.yml
+++ b/.github/workflows/test-server.yml
@@ -22,7 +22,6 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: false
-          token: ${{ secrets.PAT_FOR_SPEC }}
 
       # There are a lot of submodules here
       # This initializes the checkouts in parallel (--jobs)
@@ -32,11 +31,9 @@ jobs:
         id: cpu-count
         run: echo "count=$(node -p 'require("os").cpus().length')" >> $GITHUB_OUTPUT
 
-      - name: Setup git submodules with PAT
+      - name: Rewrite SSH submodule URLs to HTTPS
         run: |
           git config --global url."https://github.com/".insteadOf "git@github.com:"
-          git config --global credential.helper store
-          echo "https://x-token-auth:${{ secrets.PAT_FOR_SPEC }}@github.com" > ~/.git-credentials
 
       - name: Optimize git for performance
         run: |
diff --git a/.gitmodules b/.gitmodules
index 1e3a2922..1d7114e5 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -24,8 +24,8 @@
 	branch = main
 [submodule "test-server/specification"]
 	path = test-server/specification
-	url = git@github.com:awslabs/private-aws-encryption-sdk-specification-staging.git
-	branch = fire-egg-staging
+	url = https://github.com/awslabs/aws-encryption-sdk-specification.git
+	branch = master
 [submodule "test-server/net-v4-server/s3ec-net-v4-improved"]
     path = test-server/net-v4-server/s3ec-net-v4-improved
 	url = https://github.com/aws/amazon-s3-encryption-client-dotnet.git
diff --git a/test-server/specification b/test-server/specification
index 1f1ae8bb..e8f2cb0e 160000
--- a/test-server/specification
+++ b/test-server/specification
@@ -1 +1 @@
-Subproject commit 1f1ae8bb2b7b082b87ffbf4916a9723e531b2052
+Subproject commit e8f2cb0e403cd911f353ea0889064c599eebb66f