diff --git a/eng/common/templates/1es-official.yml b/eng/common/templates/1es-official.yml
index 91bb72ef3..357ab811d 100644
--- a/eng/common/templates/1es-official.yml
+++ b/eng/common/templates/1es-official.yml
@@ -17,6 +17,9 @@ parameters:
 - name: stages
   type: stageList
   default: []
+- name: serviceConnections
+  type: object
+  default: []
 - name: pool
   type: object
   default:
@@ -59,4 +62,9 @@ extends:
         sourceAnalysisPool: ${{ parameters.sourceAnalysisPool }}
         tsa:
           enabled: true
-    stages: ${{ parameters.stages }}
+    stages:
+    - template: /eng/common/templates/stages/setup-service-connections.yml@self
+      parameters:
+        pool: ${{ parameters.pool }}
+        serviceConnections: ${{ parameters.serviceConnections }}
+    - ${{ parameters.stages }}
diff --git a/eng/common/templates/1es-unofficial.yml b/eng/common/templates/1es-unofficial.yml
index f0867abd2..64dc53134 100644
--- a/eng/common/templates/1es-unofficial.yml
+++ b/eng/common/templates/1es-unofficial.yml
@@ -20,6 +20,9 @@ parameters:
   type: stageList
   default: []
   # 1ES Pipeline Template parameters
+- name: serviceConnections
+  type: object
+  default: []
 - name: pool
   type: object
   default:
@@ -67,4 +70,9 @@ extends:
         sourceAnalysisPool: ${{ parameters.sourceAnalysisPool }}
         tsa:
           enabled: true
-    stages: ${{ parameters.stages }}
+    stages:
+    - template: /eng/common/templates/stages/setup-service-connections.yml@self
+      parameters:
+        pool: ${{ parameters.pool }}
+        serviceConnections: ${{ parameters.serviceConnections }}
+    - ${{ parameters.stages }}
diff --git a/eng/common/templates/jobs/build-images.yml b/eng/common/templates/jobs/build-images.yml
index a1063904d..6d2482e9b 100644
--- a/eng/common/templates/jobs/build-images.yml
+++ b/eng/common/templates/jobs/build-images.yml
@@ -65,10 +65,14 @@ jobs:
     parameters:
       name: BuildImages
       displayName: Build Images
-      serviceConnection: $(build.serviceConnectionName)
+      serviceConnections:
+      - name: acr
+        id: $(build.serviceConnection.id)
+        tenantId: $(build.serviceConnection.tenantId)
+        clientId: $(build.serviceConnection.clientId)
       internalProjectName: ${{ parameters.internalProjectName }}
       dockerClientOS: ${{ parameters.dockerClientOS }}
-      args: >
+      args: >-
         build
         --manifest $(manifest)
         $(imageBuilderPaths)
diff --git a/eng/common/templates/jobs/copy-base-images-staging.yml b/eng/common/templates/jobs/copy-base-images-staging.yml
index 169eeb144..71ddb4a56 100644
--- a/eng/common/templates/jobs/copy-base-images-staging.yml
+++ b/eng/common/templates/jobs/copy-base-images-staging.yml
@@ -24,7 +24,10 @@ jobs:
     additionalOptions: ${{ parameters.additionalOptions }}
     acr:
       server: $(acr-staging.server)
-      serviceConnection: $(internal-mirror.serviceConnectionName)
+      serviceConnection:
+        tenantId: $(internal-mirror.serviceConnection.tenantId)
+        clientId: $(internal-mirror.serviceConnection.clientId)
+        id: $(internal-mirror.serviceConnection.id)
       subscription: $(acr-staging.subscription)
       resourceGroup: $(acr-staging.resourceGroup)
     repoPrefix: $(mirrorRepoPrefix)
diff --git a/eng/common/templates/jobs/copy-base-images.yml b/eng/common/templates/jobs/copy-base-images.yml
index c75974216..3068a43cb 100644
--- a/eng/common/templates/jobs/copy-base-images.yml
+++ b/eng/common/templates/jobs/copy-base-images.yml
@@ -32,7 +32,7 @@ jobs:
   - ${{ parameters.customInitSteps }}
   - template: /eng/common/templates/steps/copy-base-images.yml@self
     parameters:
-      acr: ${{ parameters.acr }} 
+      acr: ${{ parameters.acr }}
       repoPrefix: ${{ parameters.repoPrefix }}
       additionalOptions: ${{ parameters.additionalOptions }}
       continueOnError: ${{ parameters.continueOnError }}
diff --git a/eng/common/templates/jobs/generate-matrix.yml b/eng/common/templates/jobs/generate-matrix.yml
index f4fb75c0b..8037aca56 100644
--- a/eng/common/templates/jobs/generate-matrix.yml
+++ b/eng/common/templates/jobs/generate-matrix.yml
@@ -8,6 +8,7 @@ parameters:
   noCache: false
   customInitSteps: []
   commonInitStepsForMatrixAndBuild: []
+  sourceBuildPipelineRunId: ""
 
 jobs:
 - job: ${{ parameters.name }}
@@ -28,9 +29,10 @@ jobs:
       parameters:
         targetPath: $(Build.ArtifactStagingDirectory)
         artifactName: image-info
+        pipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
   - powershell: |
       $additionalGenerateBuildMatrixOptions = "$(additionalGenerateBuildMatrixOptions)"
-      
+
       if ("${{ parameters.isTestStage}}" -eq "true") {
         $additionalGenerateBuildMatrixOptions = "$additionalGenerateBuildMatrixOptions --image-info $(artifactsPath)/image-info.json"
       }
@@ -59,6 +61,10 @@ jobs:
     parameters:
       name: matrix
       displayName: Generate ${{ parameters.matrixType }} Matrix
-      serviceConnection: $(build.serviceConnectionName)
+      serviceConnections:
+      - name: acr
+        tenantId: $(build.serviceConnection.tenantId)
+        clientId: $(build.serviceConnection.clientId)
+        id: $(build.serviceConnection.id)
       internalProjectName: internal
       args: $(generateBuildMatrixCommand)
diff --git a/eng/common/templates/jobs/publish.yml b/eng/common/templates/jobs/publish.yml
index 9dfbc5e70..612a1d3a5 100644
--- a/eng/common/templates/jobs/publish.yml
+++ b/eng/common/templates/jobs/publish.yml
@@ -3,14 +3,17 @@ parameters:
   internalProjectName: null
   customInitSteps: []
   customPublishVariables: []
+  sourceBuildPipelineDefinitionId: ""
+  sourceBuildPipelineRunId: ""
 
 jobs:
 - job: Publish
   pool: ${{ parameters.pool }}
   timeoutInMinutes: 90
+
   variables:
   - name: imageBuilder.commonCmdArgs
-    value: >
+    value: >-
       --manifest '$(manifest)'
       --registry-override '$(acr.server)'
       $(manifestVariables)
@@ -29,39 +32,56 @@ jobs:
   - name: sourceBuildIdOutputDir
     value: $(Build.ArtifactStagingDirectory)/sourceBuildId
   - ${{ parameters.customPublishVariables }}
+
   steps:
   - template: /eng/common/templates/steps/retain-build.yml@self
+
   - template: /eng/common/templates/steps/init-docker-linux.yml@self
+
   - pwsh: |
       $azdoOrgName = Split-Path -Leaf $Env:SYSTEM_COLLECTIONURI
       echo "##vso[task.setvariable variable=azdoOrgName]$azdoOrgName"
     displayName: Set Publish Variables
+
   - ${{ parameters.customInitSteps }}
+
   - template: /eng/common/templates/steps/validate-branch.yml@self
     parameters:
       internalProjectName: ${{ parameters.internalProjectName }}
+
   - template: /eng/common/templates/steps/download-build-artifact.yml@self
     parameters:
       targetPath: $(imageInfoHostDir)
       artifactName: image-info
+      piplineDefinitionId: ${{ parameters.sourceBuildPipelineDefinitionId }}
+      pipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
       # This can fail in scenarios where no build jobs have run to produce any artifacts
       continueOnError: true
+
   - template: /eng/common/templates/steps/set-image-info-path-var.yml@self
     parameters:
       publicSourceBranch: $(publicSourceBranch)
+
   - template: /eng/common/templates/steps/set-dry-run.yml@self
+
   - script: echo "##vso[task.setvariable variable=imageQueueTime]$(date --rfc-2822)"
     displayName: Set Publish Variables
+
   - script: >
       $(runImageBuilderCmd) trimUnchangedPlatforms
       '$(imageInfoContainerDir)/image-info.json'
     displayName: Trim Unchanged Images
+
   - template: /eng/common/templates/steps/run-imagebuilder.yml@self
     parameters:
       displayName: Copy Images
-      serviceConnection: $(publish.serviceConnectionName)
+      serviceConnections:
+      - name: acr
+        id: $(publish.serviceConnection.id)
+        tenantId: $(publish.serviceConnection.tenantId)
+        clientId: $(publish.serviceConnection.clientId)
       internalProjectName: ${{ parameters.internalProjectName }}
-      args: >
+      args: >-
         copyAcrImages
         '$(acr.subscription)'
         '$(acr.resourceGroup)'
@@ -74,13 +94,18 @@ jobs:
         $(dryRunArg)
         $(imageBuilder.pathArgs)
         $(imageBuilder.commonCmdArgs)
+
   - template: /eng/common/templates/steps/run-imagebuilder.yml@self
     parameters:
       displayName: Publish Manifest
-      serviceConnection: $(publish.serviceConnectionName)
+      serviceConnections:
+      - name: acr
+        id: $(publish.serviceConnection.id)
+        tenantId: $(publish.serviceConnection.tenantId)
+        clientId: $(publish.serviceConnection.clientId)
       internalProjectName: ${{ parameters.internalProjectName }}
       dockerClientOS: ${{ parameters.dockerClientOS }}
-      args: >
+      args: >-
         publishManifest
         '$(imageInfoContainerDir)/image-info.json'
         --repo-prefix '$(publishRepoPrefix)'
@@ -89,6 +114,7 @@ jobs:
         $(dryRunArg)
         $(imageBuilder.pathArgs)
         $(imageBuilder.commonCmdArgs)
+
   - template: /eng/common/templates/steps/publish-artifact.yml@self
     parameters:
       path: $(imageInfoHostDir)
@@ -96,24 +122,29 @@ jobs:
       displayName: Publish Image Info File Artifact
       internalProjectName: ${{ parameters.internalProjectName }}
       publicProjectName: ${{ parameters.publicProjectName }}
+
   - template: /eng/common/templates/steps/wait-for-mcr-image-ingestion.yml@self
     parameters:
       imageInfoPath: '$(imageinfoContainerDir)/image-info.json'
       minQueueTime: $(imageQueueTime)
       dryRunArg: $(dryRunArg)
       condition: succeeded()
+
   - template: /eng/common/templates/steps/publish-readmes.yml@self
     parameters:
       dryRunArg: $(dryRunArg)
       condition: and(succeeded(), eq(variables['publishReadme'], 'true'))
+
   - script: mkdir -p $(Build.ArtifactStagingDirectory)/eol-annotation-data
     displayName: Create EOL Annotation Data Directory
+
   - script: >
       curl -fSL
       --output $(imageInfoHostDir)/full-image-info-orig.json
       https://raw.githubusercontent.com/$(gitHubVersionsRepoInfo.org)/$(gitHubVersionsRepoInfo.repo)/refs/heads/$(gitHubVersionsRepoInfo.branch)/$(gitHubImageInfoVersionsPath)
     condition: and(succeeded(), eq(variables['publishImageInfo'], 'true'))
     displayName: Download Latest Image Info
+
   - script: >
       $(runImageBuilderCmd) mergeImageInfo
       $(imageInfoContainerDir)
@@ -125,13 +156,18 @@ jobs:
       --initial-image-info-path $(imageInfoContainerDir)/full-image-info-orig.json
     condition: and(succeeded(), eq(variables['publishImageInfo'], 'true'))
     displayName: Merge Image Info
+
   - template: /eng/common/templates/steps/run-imagebuilder.yml@self
     parameters:
       displayName: Ingest Kusto Image Info
-      serviceConnection: $(kusto.serviceConnectionName)
+      serviceConnections:
+      - name: kusto
+        id: $(kusto.serviceConnection.id)
+        tenantId: $(kusto.serviceConnection.tenantId)
+        clientId: $(kusto.serviceConnection.clientId)
       internalProjectName: ${{ parameters.internalProjectName }}
       condition: and(succeeded(), eq(variables['ingestKustoImageInfo'], 'true'))
-      args: >
+      args: >-
         ingestKustoImageInfo
         '$(imageInfoContainerDir)/image-info.json'
         '$(kusto.cluster)'
@@ -142,13 +178,18 @@ jobs:
         --architecture '*'
         $(dryRunArg)
         $(imageBuilder.commonCmdArgs)
+
   - template: /eng/common/templates/steps/run-imagebuilder.yml@self
     parameters:
       displayName: Generate EOL Annotation Data
-      serviceConnection: $(publish.serviceConnectionName)
+      serviceConnections:
+      - name: acr
+        id: $(publish.serviceConnection.id)
+        tenantId: $(publish.serviceConnection.tenantId)
+        clientId: $(publish.serviceConnection.clientId)
       internalProjectName: internal
       condition: and(succeeded(), eq(variables['publishEolAnnotations'], 'true'))
-      args: >
+      args: >-
         generateEolAnnotationData
         '$(artifactsPath)/eol-annotation-data/eol-annotation-data.json'
         '$(imageInfoContainerDir)/full-image-info-orig.json'
@@ -157,6 +198,7 @@ jobs:
         '$(publishRepoPrefix)'
         $(generateEolAnnotationDataExtraOptions)
         $(dryRunArg)
+
   - template: /eng/common/templates/steps/publish-artifact.yml@self
     parameters:
       path: $(Build.ArtifactStagingDirectory)/eol-annotation-data
@@ -165,10 +207,12 @@ jobs:
       internalProjectName: internal
       publicProjectName: public
       condition: and(succeeded(), eq(variables['publishEolAnnotations'], 'true'))
+
   - template: /eng/common/templates/steps/annotate-eol-digests.yml@self
     parameters:
       internalProjectName: ${{ parameters.internalProjectName }}
       dataFile: $(artifactsPath)/eol-annotation-data/eol-annotation-data.json
+
   - script: >
       $(runImageBuilderCmd) publishImageInfo
       '$(imageInfoContainerDir)/full-image-info-new.json'
@@ -183,6 +227,7 @@ jobs:
       $(imageBuilder.commonCmdArgs)
     condition: and(succeeded(), eq(variables['publishImageInfo'], 'true'))
     displayName: Publish Image Info
+
   # Task displayNames names are hardcoded to reference the task prefix used by 1ES official
   # pipelines in eng/common/templates/1es-official.yml.
   #
@@ -205,25 +250,33 @@ jobs:
       '$(gitHubNotificationsRepoInfo.org)'
       '$(gitHubNotificationsRepoInfo.repo)'
       --repo-prefix '$(publishRepoPrefix)'
-      --task "🟪 Copy Images (Authenticated)"
-      --task "🟪 Publish Manifest (Authenticated)"
-      --task "🟪 Wait for Image Ingestion (Authenticated)"
+      --task "🟪 Copy Images"
+      --task "🟪 Publish Manifest"
+      --task "🟪 Wait for Image Ingestion"
       --task "🟪 Publish Readmes"
-      --task "🟪 Wait for MCR Doc Ingestion (Authenticated)"
+      --task "🟪 Wait for MCR Doc Ingestion"
       --task "🟪 Publish Image Info"
-      --task "🟪 Ingest Kusto Image Info (Authenticated)"
-      --task "🟪 Generate EOL Annotation Data (Authenticated)"
-      --task "🟪 Annotate EOL Images (Authenticated)"
-      --task "🟪 Wait for Annotation Ingestion (Authenticated)"
+      --task "🟪 Ingest Kusto Image Info"
+      --task "🟪 Generate EOL Annotation Data"
+      --task "🟪 Annotate EOL Images"
+      --task "🟪 Wait for Annotation Ingestion"
       $(dryRunArg)
       $(imageBuilder.commonCmdArgs)
     displayName: Post Publish Notification
     condition: and(always(), eq(variables['publishNotificationsEnabled'], 'true'))
+
   - powershell: |
+      # Default to current build number if parameter was not overridden
+      $buildId = "${{ parameters.sourceBuildPipelineRunId }}"
+      if ($buildId -eq "") {
+        $buildId = "$(Build.BuildNumber)"
+      }
+
       New-Item -ItemType Directory -Path $(sourceBuildIdOutputDir)
-      Set-Content -Path $(sourceBuildIdOutputDir)/source-build-id.txt -Value $(sourceBuildId)
+      Set-Content -Path $(sourceBuildIdOutputDir)/source-build-id.txt -Value "$buildId"
     condition: succeeded()
     displayName: Write Source Build ID to File
+
   - template: /eng/common/templates/steps/publish-artifact.yml@self
     parameters:
       path: $(sourceBuildIdOutputDir)
diff --git a/eng/common/templates/jobs/test-images-linux-client.yml b/eng/common/templates/jobs/test-images-linux-client.yml
index 4e1c0fd44..2e9319f2c 100644
--- a/eng/common/templates/jobs/test-images-linux-client.yml
+++ b/eng/common/templates/jobs/test-images-linux-client.yml
@@ -6,6 +6,7 @@ parameters:
   preBuildValidation: false
   internalProjectName: null
   customInitSteps: []
+  sourceBuildPipelineRunId: ""
 
 jobs:
 - job: ${{ parameters.name }}
@@ -24,3 +25,4 @@ jobs:
       preBuildValidation: ${{ parameters.preBuildValidation }}
       internalProjectName: ${{ parameters.internalProjectName }}
       customInitSteps: ${{ parameters.customInitSteps }}
+      sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
diff --git a/eng/common/templates/jobs/test-images-windows-client.yml b/eng/common/templates/jobs/test-images-windows-client.yml
index 3a0b2fd91..498fee6cb 100644
--- a/eng/common/templates/jobs/test-images-windows-client.yml
+++ b/eng/common/templates/jobs/test-images-windows-client.yml
@@ -5,6 +5,7 @@ parameters:
   testJobTimeout: 60
   internalProjectName: null
   customInitSteps: []
+  sourceBuildPipelineRunId: ""
 
 jobs:
 - job: ${{ parameters.name }}
@@ -19,3 +20,4 @@ jobs:
     parameters:
       internalProjectName: ${{ parameters.internalProjectName }}
       customInitSteps: ${{ parameters.customInitSteps }}
+      sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
diff --git a/eng/common/templates/stages/build-and-test.yml b/eng/common/templates/stages/build-and-test.yml
index 2f4249a28..1b5d4a8f7 100644
--- a/eng/common/templates/stages/build-and-test.yml
+++ b/eng/common/templates/stages/build-and-test.yml
@@ -7,6 +7,7 @@ parameters:
   customGenerateMatrixInitSteps: []
   customBuildInitSteps: []
   customTestInitSteps: []
+  sourceBuildPipelineRunId: ""
 
   linuxAmdBuildJobTimeout: 60
   linuxArmBuildJobTimeout: 60
@@ -48,6 +49,7 @@ parameters:
 stages:
 - stage: Build
   condition: and(succeeded(), contains(variables['stages'], 'build'))
+  dependsOn: []
   jobs:
   - template: /eng/common/templates/jobs/test-images-linux-client.yml@self
     parameters:
@@ -266,6 +268,7 @@ stages:
         internalProjectName: ${{ parameters.internalProjectName }}
         publicProjectName: ${{ parameters.publicProjectName }}
         customInitSteps: ${{ parameters.customGenerateMatrixInitSteps }}
+        sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
         commonInitStepsForMatrixAndBuild:
         - template: /eng/common/templates/steps/common-init-for-matrix-and-build.yml@self
           parameters:
@@ -280,6 +283,7 @@ stages:
         testJobTimeout: ${{ parameters.linuxAmdTestJobTimeout }}
         internalProjectName: ${{ parameters.internalProjectName }}
         customInitSteps: ${{ parameters.customTestInitSteps }}
+        sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
     - template: /eng/common/templates/jobs/test-images-linux-client.yml@self
       parameters:
         name: Linux_arm64
@@ -288,6 +292,7 @@ stages:
         testJobTimeout: ${{ parameters.linuxArmTestJobTimeout }}
         internalProjectName: ${{ parameters.internalProjectName }}
         customInitSteps: ${{ parameters.customTestInitSteps }}
+        sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
     - template: /eng/common/templates/jobs/test-images-linux-client.yml@self
       parameters:
         name: Linux_arm32
@@ -296,6 +301,7 @@ stages:
         testJobTimeout: ${{ parameters.linuxArmTestJobTimeout }}
         internalProjectName: ${{ parameters.internalProjectName }}
         customInitSteps: ${{ parameters.customTestInitSteps }}
+        sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
     - template: /eng/common/templates/jobs/test-images-windows-client.yml@self
       parameters:
         name: Windows1809_amd64
@@ -304,6 +310,7 @@ stages:
         testJobTimeout: ${{ parameters.windowsAmdTestJobTimeout }}
         internalProjectName: ${{ parameters.internalProjectName }}
         customInitSteps: ${{ parameters.customTestInitSteps }}
+        sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
     - template: /eng/common/templates/jobs/test-images-windows-client.yml@self
       parameters:
         name: Windows2022_amd64
@@ -312,6 +319,7 @@ stages:
         testJobTimeout: ${{ parameters.windowsAmdTestJobTimeout }}
         internalProjectName: ${{ parameters.internalProjectName }}
         customInitSteps: ${{ parameters.customTestInitSteps }}
+        sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
     - template: /eng/common/templates/jobs/test-images-windows-client.yml@self
       parameters:
         name: Windows2025_amd64
@@ -320,6 +328,7 @@ stages:
         testJobTimeout: ${{ parameters.windowsAmdTestJobTimeout }}
         internalProjectName: ${{ parameters.internalProjectName }}
         customInitSteps: ${{ parameters.customTestInitSteps }}
+        sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
     - template: /eng/common/templates/jobs/test-images-windows-client.yml@self
       parameters:
         name: WindowsLtsc2016_amd64
@@ -328,3 +337,4 @@ stages:
         testJobTimeout: ${{ parameters.windowsAmdTestJobTimeout }}
         internalProjectName: ${{ parameters.internalProjectName }}
         customInitSteps: ${{ parameters.customTestInitSteps }}
+        sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
diff --git a/eng/common/templates/stages/dotnet/build-and-test.yml b/eng/common/templates/stages/dotnet/build-and-test.yml
index 1ca876bb5..03bcaf372 100644
--- a/eng/common/templates/stages/dotnet/build-and-test.yml
+++ b/eng/common/templates/stages/dotnet/build-and-test.yml
@@ -25,6 +25,7 @@ parameters:
   linuxArmTestJobTimeout: 60
   windowsAmdTestJobTimeout: 60
   customTestInitSteps: []
+  sourceBuildPipelineRunId: ""
 
   internalProjectName: null
   publicProjectName: null
@@ -48,6 +49,7 @@ stages:
     linuxArmBuildJobTimeout: ${{ parameters.linuxArmBuildJobTimeout }}
     buildMatrixType: ${{ parameters.buildMatrixType }}
     testMatrixType: ${{ parameters.testMatrixType }}
+    sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
 
     internalVersionsRepoRef: InternalVersionsRepo
     publicVersionsRepoRef: PublicVersionsRepo
diff --git a/eng/common/templates/stages/dotnet/build-test-publish-repo.yml b/eng/common/templates/stages/dotnet/build-test-publish-repo.yml
index 40ea5550e..65bc54584 100644
--- a/eng/common/templates/stages/dotnet/build-test-publish-repo.yml
+++ b/eng/common/templates/stages/dotnet/build-test-publish-repo.yml
@@ -24,6 +24,7 @@ parameters:
   linuxArmTestJobTimeout: 60
   windowsAmdTestJobTimeout: 60
   customTestInitSteps: []
+  sourceBuildPipelineRunId: ""
 
   # Publish parameters
   customPublishInitSteps: []
@@ -50,6 +51,7 @@ stages:
     windowsAmdBuildJobTimeout: ${{ parameters.windowsAmdBuildJobTimeout }}
     customBuildInitSteps: ${{ parameters.customBuildInitSteps }}
     # Test
+    sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
     testMatrixType: ${{ parameters.testMatrixType }}
     testMatrixCustomBuildLegGroupArgs: ${{ parameters.testMatrixCustomBuildLegGroupArgs }}
     linuxAmdTestJobTimeout: ${{ parameters.linuxAmdTestJobTimeout }}
@@ -67,3 +69,4 @@ stages:
     customPublishInitSteps: ${{ parameters.customPublishInitSteps }}
     internalProjectName: ${{ parameters.internalProjectName }}
     publicProjectName: ${{ parameters.publicProjectName }}
+    sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
diff --git a/eng/common/templates/stages/dotnet/publish.yml b/eng/common/templates/stages/dotnet/publish.yml
index 0bfbcfabf..a8a9170a6 100644
--- a/eng/common/templates/stages/dotnet/publish.yml
+++ b/eng/common/templates/stages/dotnet/publish.yml
@@ -6,7 +6,10 @@ parameters:
   publicProjectName: null
   pool: ""
   isInternalServicingValidation: false
+  isStandalonePublish: false
   customPublishInitSteps: []
+  sourceBuildPipelineDefinitionId: ''
+  sourceBuildPipelineRunId: ''
 
 stages:
 - template: /eng/common/templates/stages/publish.yml@self
@@ -14,6 +17,9 @@ stages:
     internalProjectName: ${{ parameters.internalProjectName }}
     publicProjectName: ${{ parameters.publicProjectName }}
     isInternalServicingValidation: ${{ parameters.isInternalServicingValidation }}
+    isStandalonePublish: ${{ parameters.isStandalonePublish }}
+    sourceBuildPipelineDefinitionId: ${{ parameters.sourceBuildPipelineDefinitionId }}
+    sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
 
     customPublishInitSteps:
     - pwsh: |
diff --git a/eng/common/templates/stages/publish.yml b/eng/common/templates/stages/publish.yml
index 9cb7cd802..e1a3ec9ca 100644
--- a/eng/common/templates/stages/publish.yml
+++ b/eng/common/templates/stages/publish.yml
@@ -6,20 +6,25 @@ parameters:
   publicProjectName: null
 
   isInternalServicingValidation: false
+  isStandalonePublish: false
 
   pool:
     vmImage: $(defaultLinuxAmd64PoolImage)
 
+  sourceBuildPipelineDefinitionId: ''
+  sourceBuildPipelineRunId: ''
+
 ################################################################################
 # Publish Images
 ################################################################################
 stages:
 - ${{ if eq(parameters.isInternalServicingValidation, 'false') }}:
   - stage: Publish
-    ${{ if and(eq(variables['System.TeamProject'], parameters.internalProjectName), ne(variables['Build.Reason'], 'PullRequest')) }}:
-      dependsOn: Test
-    ${{ else }}:
-      dependsOn: Post_Build
+    ${{ if not(parameters.isStandalonePublish) }}:
+      ${{ if and(eq(variables['System.TeamProject'], parameters.internalProjectName), ne(variables['Build.Reason'], 'PullRequest')) }}:
+        dependsOn: Test
+      ${{ else }}:
+        dependsOn: Post_Build
     condition: "
       and(
         not(canceled()),
@@ -56,3 +61,5 @@ stages:
         internalProjectName: ${{ parameters.internalProjectName }}
         customPublishVariables: ${{ parameters.customPublishVariables }}
         customInitSteps: ${{ parameters.customPublishInitSteps }}
+        sourceBuildPipelineDefinitionId: ${{ parameters.sourceBuildPipelineDefinitionId }}
+        sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
diff --git a/eng/common/templates/stages/setup-service-connections.yml b/eng/common/templates/stages/setup-service-connections.yml
new file mode 100644
index 000000000..7d1251258
--- /dev/null
+++ b/eng/common/templates/stages/setup-service-connections.yml
@@ -0,0 +1,34 @@
+# This stage exists to tell Azure DevOps about all of the service connections
+# that will be used in the pipeline. A service connection will not work unless
+# it is declared in this stage's parameters, even if your pipeline has already
+# been granted access to the service connection. This stage also does not need
+# to complete before the service connection is used.
+parameters:
+- name: pool
+  type: object
+# serviceConnections object shape:
+# - name: string
+- name: serviceConnections
+  type: object
+  default: []
+
+stages:
+
+- stage: SetupServiceConnectionsStage
+  displayName: Setup service connections
+  jobs:
+
+  - job: SetupServiceConnectionsJob
+    displayName: Setup service connections
+    pool: ${{ parameters.pool }}
+    steps:
+
+    - ${{ each serviceConnection in parameters.serviceConnections }}:
+      - task: AzureCLI@2
+        displayName: Setup ${{ serviceConnection.name }}
+        inputs:
+          azureSubscription: ${{ serviceConnection.name }}
+          scriptType: pscore
+          scriptLocation: inlineScript
+          inlineScript: |
+            az account show
diff --git a/eng/common/templates/steps/annotate-eol-digests.yml b/eng/common/templates/steps/annotate-eol-digests.yml
index 3f01cad02..35646b260 100644
--- a/eng/common/templates/steps/annotate-eol-digests.yml
+++ b/eng/common/templates/steps/annotate-eol-digests.yml
@@ -7,10 +7,14 @@ steps:
     parameters:
       name: AnnotateEOLImages
       displayName: Annotate EOL Images
-      serviceConnection: $(publish.serviceConnectionName)
+      serviceConnections:
+      - name: acr
+        id: $(publish.serviceConnection.id)
+        tenantId: $(publish.serviceConnection.tenantId)
+        clientId: $(publish.serviceConnection.clientId)
       internalProjectName: internal
       condition: and(succeeded(), eq(variables['publishEolAnnotations'], 'true'))
-      args: >
+      args: >-
         annotateEolDigests
         ${{ parameters.dataFile }}
         $(acr.server)
@@ -28,9 +32,13 @@ steps:
   - template: /eng/common/templates/steps/run-imagebuilder.yml@self
     parameters:
       displayName: Wait for Annotation Ingestion
-      serviceConnection: $(marStatus.serviceConnectionName)
+      serviceConnections:
+      - name: mar
+        id: $(marStatus.serviceConnection.id)
+        tenantId: $(marStatus.serviceConnection.tenantId)
+        clientId: $(marStatus.serviceConnection.clientId)
       internalProjectName: internal
       condition: and(succeeded(), eq(variables['publishEolAnnotations'], 'true'))
-      args: >
+      args: >-
         waitForMarAnnotationIngestion
         $(artifactsPath)/annotation-digests/annotation-digests.txt
diff --git a/eng/common/templates/steps/clean-acr-images.yml b/eng/common/templates/steps/clean-acr-images.yml
index f02b02251..abfb9fb94 100644
--- a/eng/common/templates/steps/clean-acr-images.yml
+++ b/eng/common/templates/steps/clean-acr-images.yml
@@ -11,9 +11,13 @@ steps:
   - template: /eng/common/templates/steps/run-imagebuilder.yml@self
     parameters:
       displayName: Clean ACR Images - ${{ parameters.repo }}
-      serviceConnection: $(clean.serviceConnectionName)
+      serviceConnections:
+      - name: acr
+        id: $(clean.serviceConnection.id)
+        tenantId: $(clean.serviceConnection.tenantId)
+        clientId: $(clean.serviceConnection.clientId)
       internalProjectName: ${{ parameters.internalProjectName }}
-      args: >
+      args: >-
         cleanAcrImages
         ${{ parameters.repo }}
         ${{ parameters.subscription }}
diff --git a/eng/common/templates/steps/copy-base-images.yml b/eng/common/templates/steps/copy-base-images.yml
index e24fc0306..f78b1c5dc 100644
--- a/eng/common/templates/steps/copy-base-images.yml
+++ b/eng/common/templates/steps/copy-base-images.yml
@@ -3,7 +3,10 @@ parameters:
   type: object
   default:
     server: ""
-    serviceConnection: ""
+    serviceConnection:
+      tenantId: ""
+      clientId: ""
+      id: ""
     subscription: ""
     resourceGroup: ""
 - name: repoPrefix
@@ -25,13 +28,17 @@ steps:
 - template: /eng/common/templates/steps/run-imagebuilder.yml@self
   parameters:
     displayName: Copy Base Images
-    serviceConnection: ${{ parameters.acr.serviceConnection }}
+    serviceConnections:
+    - name: "acr"
+      tenantId: ${{ parameters.acr.serviceConnection.tenantId }}
+      clientId: ${{ parameters.acr.serviceConnection.clientId }}
+      id: ${{ parameters.acr.serviceConnection.id }}
     continueOnError: ${{ parameters.continueOnError }}
     internalProjectName: 'internal'
     # Use environment variable to reference $(dryRunArg). Since $(dryRunArg) might be undefined,
     # PowerShell will treat the Azure Pipelines variable macro syntax as a command and throw an
     # error
-    args: >
+    args: >-
       copyBaseImages
       '${{ parameters.acr.subscription }}'
       '${{ parameters.acr.resourceGroup }}'
diff --git a/eng/common/templates/steps/download-build-artifact.yml b/eng/common/templates/steps/download-build-artifact.yml
index ed68ef5b3..965f49320 100644
--- a/eng/common/templates/steps/download-build-artifact.yml
+++ b/eng/common/templates/steps/download-build-artifact.yml
@@ -1,17 +1,38 @@
 parameters:
+  # Destination directory on the pipeline agent's filesystem, relative or absolute.
   targetPath: ""
+  # The build/pipeline artifact to download. If the value is left empty,
+  # the task downloads all artifacts associated with the pipeline run.
   artifactName: ""
+  # AKA pipeline/definition - optional.
+  # If this is left empty, use the current pipeline's definition ID.
+  # You can get this from the URL of the pipeline's overview page on Azure DevOps.
+  # Example: https://dev.azure.com/$org/$project/_build?definitionId=373
+  pipelineDefinitionId: ""
+  # AKA runId/buildId/pipelineId - optional.
+  # The identifier of the pipeline run from which to download the artifacts.
+  # If this is left empty, then always download from the current pipeline
+  # You can get this from the URL of the specific pipeline run, for example:
+  # https://dev.azure.com/$org/$project/_build/results?buildId=2709155&view=results
+  pipelineRunId: ""
   condition: true
   continueOnError: false
 
 steps:
-- task: DownloadPipelineArtifact@1
+# https://learn.microsoft.com/azure/devops/pipelines/tasks/reference/download-pipeline-artifact-v2
+- task: DownloadPipelineArtifact@2
   inputs:
-    buildType: specific
-    project: $(System.TeamProject)
-    pipline: $(System.DefinitionId)
-    buildVersionToDownload: specific
-    buildId: $(sourceBuildId)
+    ${{ if ne(parameters.pipelineRunId, '') }}:
+      buildType: specific
+      project: $(System.TeamProject)
+      ${{ if ne(parameters.pipelineDefinitionId, '') }}:
+        definition: ${{ parameters.pipelineDefinitionId }}
+      ${{ else }}:
+        definition: $(System.DefinitionId)
+      buildId: ${{ parameters.pipelineRunId }}
+      buildVersionToDownload: specific
+    ${{ else }}:
+      buildType: current
     targetPath: ${{ parameters.targetPath }}
     artifactName: ${{ parameters.artifactName }}
   displayName: Download Build Artifact(s)
diff --git a/eng/common/templates/steps/init-common.yml b/eng/common/templates/steps/init-common.yml
index ed73a179e..c22ad449c 100644
--- a/eng/common/templates/steps/init-common.yml
+++ b/eng/common/templates/steps/init-common.yml
@@ -3,7 +3,7 @@ parameters:
 
 steps:
 - powershell: |
-    $sourceBranch=$Env:BUILD_SOURCEBRANCH -replace "refs/heads/","" -replace "refs/tags/","" -replace "refs/pull/","" 
+    $sourceBranch=$Env:BUILD_SOURCEBRANCH -replace "refs/heads/","" -replace "refs/tags/","" -replace "refs/pull/",""
     echo "##vso[task.setvariable variable=sourceBranch]$sourceBranch"
   displayName: Define Source Branch Variable
   condition: and(succeeded(), ${{ parameters.condition }})
diff --git a/eng/common/templates/steps/init-docker-linux.yml b/eng/common/templates/steps/init-docker-linux.yml
index aa74ac002..729546a38 100644
--- a/eng/common/templates/steps/init-docker-linux.yml
+++ b/eng/common/templates/steps/init-docker-linux.yml
@@ -24,26 +24,27 @@ steps:
   # Setup Image Builder (Optional)
   ################################################################################
 - ${{ if eq(parameters.setupImageBuilder, 'true') }}:
+
   - script: $(engCommonPath)/pull-image.sh $(imageNames.imageBuilder)
     displayName: Pull Image Builder
     condition: and(succeeded(), ${{ parameters.condition }})
-  - script: >
+
+  - script: >-
       docker build
       -t $(imageNames.imageBuilder.withrepo)
       --build-arg IMAGE=$(imageNames.imageBuilder)
       -f $(engCommonPath)/Dockerfile.WithRepo .
     displayName: Build Image for Image Builder
     condition: and(succeeded(), ${{ parameters.condition }})
+
   - task: PowerShell@2
     displayName: Define ImageBuilder Command Variables
     condition: and(succeeded(), ${{ parameters.condition }})
     inputs:
       targetType: 'inline'
       script: |
-        $tokenHostPath = '$(Agent.TempDirectory)'
-        $tokenHostFilePath = "${tokenHostPath}/token"
-        $tokenContainerPath = "/tmp"
-        $tokenContainerFilePath = "${tokenContainerPath}/token"
+        $imageBuilderImageName = "$(imageNames.imageBuilder.withrepo)"
+        Write-Host "##vso[task.setvariable variable=imageBuilderImageName]$imageBuilderImageName"
 
         $dockerRunBaseCmd = @(
           "docker run --rm"
@@ -58,10 +59,10 @@ steps:
         )
 
         $authedDockerRunArgs = @(
-          '-e AZURE_TENANT_ID=$env:tenantId'
-          '-e AZURE_CLIENT_ID=$env:servicePrincipalId'
-          "-e AZURE_FEDERATED_TOKEN_FILE=$tokenContainerFilePath"
-          "-v ${tokenHostPath}:${tokenContainerPath}"
+          '-e'
+          'SYSTEM_ACCESSTOKEN=$env:SYSTEM_ACCESSTOKEN'
+          '-e'
+          'SYSTEM_OIDCREQUESTURI=$env:SYSTEM_OIDCREQUESTURI'
         )
 
         $dockerRunCmd = $dockerRunBaseCmd + $dockerRunArgs
@@ -72,7 +73,6 @@ steps:
 
         Write-Host "##vso[task.setvariable variable=runImageBuilderCmd]$runImageBuilderCmd"
         Write-Host "##vso[task.setvariable variable=runAuthedImageBuilderCmd]$runAuthedImageBuilderCmd"
-        Write-Host "##vso[task.setvariable variable=tokenHostFilePath]$tokenHostFilePath"
 
   ################################################################################
   # Setup Test Runner (Optional)
diff --git a/eng/common/templates/steps/init-docker-windows.yml b/eng/common/templates/steps/init-docker-windows.yml
index a6fbaead6..ae867f9e8 100644
--- a/eng/common/templates/steps/init-docker-windows.yml
+++ b/eng/common/templates/steps/init-docker-windows.yml
@@ -43,20 +43,6 @@ steps:
     inputs:
       targetType: 'inline'
       script: |
-        $tokenHostPath = '$(Agent.TempDirectory)'
-        $tokenHostFilePath = "$tokenHostPath\token"
-
         $runImageBuilderCmd = "$(Build.BinariesDirectory)\.Microsoft.DotNet.ImageBuilder\Microsoft.DotNet.ImageBuilder.exe"
-
-        $authedImageBuilderCmds = @(
-          '$env:AZURE_TENANT_ID = $env:tenantId'
-          '$env:AZURE_CLIENT_ID = $env:servicePrincipalId'
-          '$env:AZURE_FEDERATED_TOKEN_FILE = ' + "'" + "$tokenHostFilePath" + "'"
-          $runImageBuilderCmd
-        )
-
-        $runAuthedImageBuilderCmd = $($authedImageBuilderCmds -join "; ")
-
         Write-Host "##vso[task.setvariable variable=runImageBuilderCmd]$runImageBuilderCmd"
-        Write-Host "##vso[task.setvariable variable=runAuthedImageBuilderCmd]$runAuthedImageBuilderCmd"
-        Write-Host "##vso[task.setvariable variable=tokenHostFilePath]$tokenHostFilePath"
+        Write-Host "##vso[task.setvariable variable=runAuthedImageBuilderCmd]$runImageBuilderCmd"
diff --git a/eng/common/templates/steps/run-imagebuilder.yml b/eng/common/templates/steps/run-imagebuilder.yml
index ae20464ce..3613d809b 100644
--- a/eng/common/templates/steps/run-imagebuilder.yml
+++ b/eng/common/templates/steps/run-imagebuilder.yml
@@ -5,9 +5,18 @@ parameters:
 - name: displayName
   type: string
   default: "Run ImageBuilder"
-- name: serviceConnection
-  type: string
-  default: ""
+- name: serviceConnections
+  type: object
+  default:
+  # name: the name of the service connection argument that will be passed to the ImageBuilder command.
+  #   For example, if the argument is --acr-service-connection, the name would be "acr".
+  - name: ""
+    # The service connection's ID (GUID).
+    id: ""
+    # The client ID of the Managed Idendity backing the service connection (GUID).
+    clientId: ""
+    # The ID of the tenant that the Managed Identity is in (GUID).
+    tenantId: ""
 - name: internalProjectName
   type: string
   default: null
@@ -25,21 +34,36 @@ parameters:
   default: "linux"
 
 steps:
-- ${{ if and(eq(variables['System.TeamProject'], parameters.internalProjectName), ne(variables['Build.Reason'], 'PullRequest'), ne(parameters.serviceConnection, '')) }}:
-  - template: /eng/common/templates/steps/run-pwsh-with-auth.yml@self
-    parameters:
-      ${{ if ne(parameters.name, '') }}:
-        name: ${{ parameters.name }}
-      displayName: ${{ parameters.displayName }}
-      serviceConnection: ${{ parameters.serviceConnection }}
-      continueOnError: ${{ parameters.continueOnError }}
-      dockerClientOS: ${{ parameters.dockerClientOS }}
-      condition: ${{ parameters.condition }}
-      command: >
-        $env:idToken | Out-File -FilePath $(tokenHostFilePath);
-        $(runAuthedImageBuilderCmd) ${{ parameters.args }};
-        Remove-Item -Path $(tokenHostFilePath) -Force
+- ${{ if and(eq(variables['System.TeamProject'], parameters.internalProjectName), ne(variables['Build.Reason'], 'PullRequest')) }}:
+
+  - task: PowerShell@2
+    ${{ if ne(parameters.name, '') }}:
+      name: ${{ parameters.name }}
+    displayName: ${{ parameters.displayName }}
+    continueOnError: ${{ parameters.continueOnError }}
+    condition: ${{ parameters.condition }}
+    env:
+      SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+      SYSTEM_OIDCREQUESTURI: $(System.OidcRequestUri)
+    inputs:
+      targetType: 'inline'
+      script: |
+        $serviceConnections = '${{ convertToJson(parameters.serviceConnections) }}'
+
+        Write-Host "Service connections:"
+        Write-Host "${serviceConnections}"
+
+        $serviceConnectionsJson = $serviceConnections | ConvertFrom-Json
+        $serviceConnectionsArgs = @()
+        foreach ($connection in $serviceConnectionsJson) {
+            $serviceConnectionsArgs += "--$($connection.name)-service-connection"
+            $serviceConnectionsArgs += "$($connection.tenantId):$($connection.clientId):$($connection.id)"
+        }
+
+        $(runAuthedImageBuilderCmd) ${{ parameters.args }} @serviceConnectionsArgs
+
 - ${{ else }}:
+
   - task: PowerShell@2
     ${{ if ne(parameters.name, '') }}:
       name: ${{ parameters.name }}
@@ -48,5 +72,5 @@ steps:
     condition: ${{ parameters.condition }}
     inputs:
       targetType: 'inline'
-      script: >
+      script: >-
         $(runImageBuilderCmd) ${{ parameters.args }}
diff --git a/eng/common/templates/steps/test-images-linux-client.yml b/eng/common/templates/steps/test-images-linux-client.yml
index 6a747016c..1af54d0c1 100644
--- a/eng/common/templates/steps/test-images-linux-client.yml
+++ b/eng/common/templates/steps/test-images-linux-client.yml
@@ -3,6 +3,7 @@ parameters:
   internalProjectName: null
   condition: true
   customInitSteps: []
+  sourceBuildPipelineRunId: ""
 
 steps:
 - template: /eng/common/templates/steps/init-docker-linux.yml@self
@@ -47,7 +48,7 @@ steps:
       displayName: Docker login
       serviceConnection: $(test.serviceConnectionName)
       condition: and(succeeded(), ${{ parameters.condition }})
-      command: >
+      command: >-
         $azLoginArgs = '--service-principal --tenant $env:AZURE_TENANT_ID -u $env:AZURE_CLIENT_ID --federated-token $env:AZURE_FEDERATED_TOKEN';
         docker exec -e AZURE_TENANT_ID=$env:tenantId -e AZURE_CLIENT_ID=$env:servicePrincipalId -e AZURE_FEDERATED_TOKEN=$env:idToken $(testRunner.container) pwsh
         -File $(engCommonRelativePath)/Invoke-WithRetry.ps1
@@ -58,6 +59,7 @@ steps:
         targetPath: $(Build.ArtifactStagingDirectory)
         artifactName: image-info
         condition: ${{ parameters.condition }}
+        pipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
 - template: /eng/common/templates/steps/parse-test-arg-arrays.yml@self
 - powershell: >
     $(test.init);
diff --git a/eng/common/templates/steps/test-images-windows-client.yml b/eng/common/templates/steps/test-images-windows-client.yml
index 04b099d52..d53a42b66 100644
--- a/eng/common/templates/steps/test-images-windows-client.yml
+++ b/eng/common/templates/steps/test-images-windows-client.yml
@@ -2,6 +2,7 @@ parameters:
   internalProjectName: null
   condition: true
   customInitSteps: []
+  sourceBuildPipelineRunId: ""
 
 steps:
 - ${{ if and(eq(variables['System.TeamProject'], parameters.internalProjectName), ne(variables['Build.Reason'], 'PullRequest')) }}:
@@ -16,7 +17,7 @@ steps:
       serviceConnection: $(test.serviceConnectionName)
       dockerClientOS: windows
       condition: and(succeeded(), ${{ parameters.condition }})
-      command: >
+      command: >-
         az login --service-principal --tenant $env:tenantId -u $env:servicePrincipalId --federated-token $env:idToken;
         $accessToken = $(az acr login -n $(acr-staging.server) --expose-token --query accessToken --output tsv);
         docker login $(acr-staging.server) -u 00000000-0000-0000-0000-000000000000 -p $accessToken
@@ -37,6 +38,7 @@ steps:
       targetPath: $(Build.ArtifactStagingDirectory)
       artifactName: image-info
       condition: ${{ parameters.condition }}
+      pipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
 - template: /eng/common/templates/steps/parse-test-arg-arrays.yml@self
 - powershell: >
     $(test.init);
diff --git a/eng/common/templates/steps/wait-for-mcr-doc-ingestion.yml b/eng/common/templates/steps/wait-for-mcr-doc-ingestion.yml
index a0be54d2f..05112cc5b 100644
--- a/eng/common/templates/steps/wait-for-mcr-doc-ingestion.yml
+++ b/eng/common/templates/steps/wait-for-mcr-doc-ingestion.yml
@@ -8,9 +8,13 @@ steps:
   parameters:
     displayName: Wait for MCR Doc Ingestion
     condition: and(${{ parameters.condition }}, eq(variables['waitForIngestionEnabled'], 'true'))
-    serviceConnection: $(marStatus.serviceConnectionName)
+    serviceConnections:
+    - name: mar
+      id: $(marStatus.serviceConnection.id)
+      tenantId: $(marStatus.serviceConnection.tenantId)
+      clientId: $(marStatus.serviceConnection.clientId)
     internalProjectName: 'internal'
-    args: >
+    args: >-
       waitForMcrDocIngestion
       '${{ parameters.commitDigest }}'
       --timeout '$(mcrDocIngestionTimeout)'
diff --git a/eng/common/templates/steps/wait-for-mcr-image-ingestion.yml b/eng/common/templates/steps/wait-for-mcr-image-ingestion.yml
index 83263c7f2..a3c84ddfe 100644
--- a/eng/common/templates/steps/wait-for-mcr-image-ingestion.yml
+++ b/eng/common/templates/steps/wait-for-mcr-image-ingestion.yml
@@ -9,9 +9,13 @@ steps:
   parameters:
     displayName: Wait for Image Ingestion
     condition: and(${{ parameters.condition }}, eq(variables['waitForIngestionEnabled'], 'true'))
-    serviceConnection: $(marStatus.serviceConnectionName)
+    serviceConnections:
+    - name: mar
+      id: $(marStatus.serviceConnection.id)
+      tenantId: $(marStatus.serviceConnection.tenantId)
+      clientId: $(marStatus.serviceConnection.clientId)
     internalProjectName: 'internal'
-    args: >
+    args: >-
       waitForMcrImageIngestion
       '${{ parameters.imageInfoPath }}'
       --manifest '$(manifest)'
diff --git a/eng/common/templates/variables/common.yml b/eng/common/templates/variables/common.yml
index 38a62317a..65d4ce9d8 100644
--- a/eng/common/templates/variables/common.yml
+++ b/eng/common/templates/variables/common.yml
@@ -1,8 +1,24 @@
+parameters:
+# sourceBuildPipelineRunId should be overridden when skipping a build to run
+# tests or publish images that were produced in a different pipeline run.
+# Defaults to $(Build.BuildId) which refers to the current pipeline run.
+- name: sourceBuildPipelineRunId
+  type: string
+  default: ""
+
 variables:
 - template: /eng/common/templates/variables/docker-images.yml@self
 - template: /eng/common/templates/variables/common-paths.yml@self
-- name: stagingRepoPrefix
-  value: build-staging/$(sourceBuildId)/
+
+# stagingRepoPrefix defines where images will be pushed to in the staging repo,
+# which is defined in the $(acr-staging.server) variable.
+- ${{ if ne(parameters.sourceBuildPipelineRunId, '') }}:
+  - name: stagingRepoPrefix
+    value: build-staging/${{ parameters.sourceBuildPipelineRunId }}/
+- ${{ else }}:
+  - name: stagingRepoPrefix
+    value: build-staging/$(Build.BuildId)/
+
 - name: publishReadme
   value: true
 - name: publishImageInfo
diff --git a/eng/common/templates/variables/docker-images.yml b/eng/common/templates/variables/docker-images.yml
index 38d247d37..4f0246d1f 100644
--- a/eng/common/templates/variables/docker-images.yml
+++ b/eng/common/templates/variables/docker-images.yml
@@ -1,5 +1,5 @@
 variables:
-  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder:2708614
+  imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder:2740300
   imageNames.imageBuilder: $(imageNames.imageBuilderName)
   imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId)
   imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner
diff --git a/eng/common/templates/variables/dotnet/build-test-publish.yml b/eng/common/templates/variables/dotnet/build-test-publish.yml
index 51ff99d1c..49e3a9f21 100644
--- a/eng/common/templates/variables/dotnet/build-test-publish.yml
+++ b/eng/common/templates/variables/dotnet/build-test-publish.yml
@@ -1,7 +1,16 @@
 # Common variables for building/testing/publishing in the .NET team's pipelines
+parameters:
+# sourceBuildPipelineRunId should be overridden when skipping a build to run
+# tests or publish images that were produced in a different pipeline run.
+# Defaults to $(Build.BuildId) which refers to the current pipeline run.
+- name: sourceBuildPipelineRunId
+  type: string
+  default: ""
 
 variables:
 - template: /eng/common/templates/variables/dotnet/common.yml@self
+  parameters:
+    sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
 
 - name: commonVersionsImageInfoPath
   value: build-info/docker
diff --git a/eng/common/templates/variables/dotnet/common.yml b/eng/common/templates/variables/dotnet/common.yml
index f9d52677b..895dbd469 100644
--- a/eng/common/templates/variables/dotnet/common.yml
+++ b/eng/common/templates/variables/dotnet/common.yml
@@ -1,5 +1,16 @@
+parameters:
+# sourceBuildPipelineRunId should be overridden when skipping a build to run
+# tests or publish images that were produced in a different pipeline run.
+# Defaults to $(Build.BuildId) which refers to the current pipeline run.
+- name: sourceBuildPipelineRunId
+  type: string
+  default: ""
+
 variables:
 - template: /eng/common/templates/variables/common.yml@self
+  parameters:
+    sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
+
 - name: publicProjectName
   value: public
 - name: internalProjectName
diff --git a/src/opensuse/15.6/helix/amd64/Dockerfile b/src/opensuse/15.6/helix/amd64/Dockerfile
index aca58128b..c67610a49 100644
--- a/src/opensuse/15.6/helix/amd64/Dockerfile
+++ b/src/opensuse/15.6/helix/amd64/Dockerfile
@@ -37,7 +37,6 @@ ENV LANG=en_US.utf8
 
 # Install MsQuic from official GitHub releases
 RUN wget https://packages.microsoft.com/keys/microsoft.asc \
-    && echo 2cfd20a306b2fa5e25522d78f2ef50a1f429d35fd30bd983e2ebffc2b80944fa microsoft.asc | sha256sum --check - \
     && rpm --import microsoft.asc \
     && rm microsoft.asc \
     && zypper addrepo https://packages.microsoft.com/opensuse/15/prod/ "MS Packages" \
diff --git a/src/ubuntu/22.04/helix/Dockerfile b/src/ubuntu/22.04/helix/Dockerfile
index 8adaad16e..15ba5757e 100644
--- a/src/ubuntu/22.04/helix/Dockerfile
+++ b/src/ubuntu/22.04/helix/Dockerfile
@@ -44,7 +44,6 @@ RUN ln -sf /usr/bin/python3 /usr/bin/python
 
 # Add MsQuic
 RUN curl -LO https://packages.microsoft.com/keys/microsoft.asc && \
-    echo 2cfd20a306b2fa5e25522d78f2ef50a1f429d35fd30bd983e2ebffc2b80944fa microsoft.asc| sha256sum --check - && \
     apt-key add microsoft.asc && \
     rm microsoft.asc && \
     apt-add-repository https://packages.microsoft.com/ubuntu/22.04/prod && \
diff --git a/src/ubuntu/24.04/helix/Dockerfile b/src/ubuntu/24.04/helix/Dockerfile
index c9dbba9e1..f548ed2e1 100644
--- a/src/ubuntu/24.04/helix/Dockerfile
+++ b/src/ubuntu/24.04/helix/Dockerfile
@@ -66,7 +66,6 @@ ENV LANG=en_US.utf8
 
 # Add MsQuic
 RUN curl -LO https://packages.microsoft.com/keys/microsoft.asc && \
-    echo 2cfd20a306b2fa5e25522d78f2ef50a1f429d35fd30bd983e2ebffc2b80944fa microsoft.asc| sha256sum --check - && \
     apt-key add microsoft.asc && \
     rm microsoft.asc && \
     apt-add-repository https://packages.microsoft.com/ubuntu/24.04/prod && \