diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
index 99b707568e..c558dd8021 100644
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@@ -3,9 +3,9 @@
   <ProductDependencies>
   </ProductDependencies>
   <ToolsetDependencies>
-    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="11.0.0-beta.26177.6">
+    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="11.0.0-beta.26204.1">
       <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>30f8bf581e0e0d7e1de30898de8fa9c4008d2f5e</Sha>
+      <Sha>1f7eece09d5c6fc2a1319d04f6ae4b7d18455e2d</Sha>
     </Dependency>
   </ToolsetDependencies>
 </Dependencies>
diff --git a/eng/common/core-templates/job/job.yml b/eng/common/core-templates/job/job.yml
index 748c4f07a6..66c7988f22 100644
--- a/eng/common/core-templates/job/job.yml
+++ b/eng/common/core-templates/job/job.yml
@@ -26,12 +26,12 @@ parameters:
   enablePublishBuildArtifacts: false
   enablePublishBuildAssets: false
   enablePublishTestResults: false
+  enablePublishing: false
   enableBuildRetry: false
   mergeTestResults: false
   testRunTitle: ''
   testResultsFormat: ''
   name: ''
-  componentGovernanceSteps: []
   preSteps: []
   artifactPublishSteps: []
   runAsPublic: false
@@ -152,9 +152,6 @@ jobs:
   - ${{ each step in parameters.steps }}:
     - ${{ step }}
 
-  - ${{ each step in parameters.componentGovernanceSteps }}:
-    - ${{ step }}
-
   - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
     - template: /eng/common/core-templates/steps/cleanup-microbuild.yml
       parameters:
diff --git a/eng/common/core-templates/job/publish-build-assets.yml b/eng/common/core-templates/job/publish-build-assets.yml
index 9d7490518c..700f771146 100644
--- a/eng/common/core-templates/job/publish-build-assets.yml
+++ b/eng/common/core-templates/job/publish-build-assets.yml
@@ -172,17 +172,18 @@ jobs:
             targetPath: '$(Build.ArtifactStagingDirectory)/MergedManifest.xml'
             artifactName: AssetManifests
             displayName: 'Publish Merged Manifest'
-            retryCountOnTaskFailure: 10 # for any logs being locked
-            sbomEnabled: false # we don't need SBOM for logs
+            retryCountOnTaskFailure: 10 # for any files being locked
+            isProduction: false # just metadata for publishing
 
-    - template: /eng/common/core-templates/steps/publish-build-artifacts.yml
+    - template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml
       parameters:
         is1ESPipeline: ${{ parameters.is1ESPipeline }}
         args:
           displayName: Publish ReleaseConfigs Artifact
-          pathToPublish: '$(Build.StagingDirectory)/ReleaseConfigs'
-          publishLocation: Container
+          targetPath: '$(Build.StagingDirectory)/ReleaseConfigs'
           artifactName: ReleaseConfigs
+          retryCountOnTaskFailure: 10 # for any files being locked
+          isProduction: false # just metadata for publishing
 
     - ${{ if or(eq(parameters.publishAssetsImmediately, 'true'), eq(parameters.isAssetlessBuild, 'true')) }}:
       - template: /eng/common/core-templates/post-build/setup-maestro-vars.yml
@@ -218,4 +219,5 @@ jobs:
       - template: /eng/common/core-templates/steps/publish-logs.yml
         parameters:
           is1ESPipeline: ${{ parameters.is1ESPipeline }}
+          StageLabel: 'BuildAssetRegistry'
           JobLabel: 'Publish_Artifacts_Logs'
diff --git a/eng/common/core-templates/job/renovate.yml b/eng/common/core-templates/job/renovate.yml
index ab233539b5..ff86c80b46 100644
--- a/eng/common/core-templates/job/renovate.yml
+++ b/eng/common/core-templates/job/renovate.yml
@@ -135,7 +135,7 @@ jobs:
       condition: succeededOrFailed()
       targetPath: $(Build.ArtifactStagingDirectory)
       artifactName: $(Agent.JobName)_Logs_Attempt$(System.JobAttempt)
-      sbomEnabled: false
+      isProduction: false # logs are non-production artifacts
 
   steps:
   - checkout: self
diff --git a/eng/common/core-templates/jobs/jobs.yml b/eng/common/core-templates/jobs/jobs.yml
index 01ada74766..cc8cce4527 100644
--- a/eng/common/core-templates/jobs/jobs.yml
+++ b/eng/common/core-templates/jobs/jobs.yml
@@ -43,6 +43,10 @@ parameters:
 
   artifacts: {}
   is1ESPipeline: ''
+
+  # Publishing version w/default.
+  publishingVersion: 3
+
   repositoryAlias: self
   officialBuildId: ''
 
@@ -102,6 +106,7 @@ jobs:
       parameters:
         is1ESPipeline: ${{ parameters.is1ESPipeline }}
         continueOnError: ${{ parameters.continueOnError }}
+        publishingVersion: ${{ parameters.publishingVersion }}
         dependsOn:
         - ${{ if ne(parameters.publishBuildAssetsDependsOn, '') }}:
           - ${{ each job in parameters.publishBuildAssetsDependsOn }}:
diff --git a/eng/common/core-templates/post-build/common-variables.yml b/eng/common/core-templates/post-build/common-variables.yml
index d5627a994a..db298ae16b 100644
--- a/eng/common/core-templates/post-build/common-variables.yml
+++ b/eng/common/core-templates/post-build/common-variables.yml
@@ -11,8 +11,6 @@ variables:
   - name: MaestroApiVersion
     value: "2020-02-20"
 
-  - name: SourceLinkCLIVersion
-    value: 3.0.0
   - name: SymbolToolVersion
     value: 1.0.1
   - name: BinlogToolVersion
diff --git a/eng/common/core-templates/post-build/post-build.yml b/eng/common/core-templates/post-build/post-build.yml
index 0994189969..fcf40d1d2e 100644
--- a/eng/common/core-templates/post-build/post-build.yml
+++ b/eng/common/core-templates/post-build/post-build.yml
@@ -9,6 +9,7 @@ parameters:
   default: 3
   values:
   - 3
+  - 4
 
 - name: BARBuildId
   displayName: BAR Build Id
@@ -130,16 +131,30 @@ stages:
           PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }}
           is1ESPipeline: ${{ parameters.is1ESPipeline }}
 
-      - task: DownloadBuildArtifacts@0
-        displayName: Download Package Artifacts
-        inputs:
-          buildType: specific
-          buildVersionToDownload: specific
-          project: $(AzDOProjectName)
-          pipeline: $(AzDOPipelineId)
-          buildId: $(AzDOBuildId)
-          artifactName: PackageArtifacts
-          checkDownloadedFiles: true
+      - ${{ if ne(parameters.publishingInfraVersion, 4) }}:
+        - task: DownloadBuildArtifacts@0
+          displayName: Download Package Artifacts
+          inputs:
+            buildType: specific
+            buildVersionToDownload: specific
+            project: $(AzDOProjectName)
+            pipeline: $(AzDOPipelineId)
+            buildId: $(AzDOBuildId)
+            artifactName: PackageArtifacts
+            checkDownloadedFiles: true
+      - ${{ if eq(parameters.publishingInfraVersion, 4) }}:
+        - task: DownloadPipelineArtifact@2
+          displayName: Download Pipeline Artifacts (V4)
+          inputs:
+            itemPattern: '*/packages/**/*.nupkg'
+            targetPath: '$(Build.ArtifactStagingDirectory)/PipelineArtifactsDownload'
+        - task: CopyFiles@2
+          displayName: Flatten packages to PackageArtifacts
+          inputs:
+            SourceFolder: '$(Build.ArtifactStagingDirectory)/PipelineArtifactsDownload'
+            Contents: '**/*.nupkg'
+            TargetFolder: '$(Build.ArtifactStagingDirectory)/PackageArtifacts'
+            flattenFolders: true
 
       - task: PowerShell@2
         displayName: Validate
@@ -173,16 +188,30 @@ stages:
           PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }}
           is1ESPipeline: ${{ parameters.is1ESPipeline }}
 
-      - task: DownloadBuildArtifacts@0
-        displayName: Download Package Artifacts
-        inputs:
-          buildType: specific
-          buildVersionToDownload: specific
-          project: $(AzDOProjectName)
-          pipeline: $(AzDOPipelineId)
-          buildId: $(AzDOBuildId)
-          artifactName: PackageArtifacts
-          checkDownloadedFiles: true
+      - ${{ if ne(parameters.publishingInfraVersion, 4) }}:
+        - task: DownloadBuildArtifacts@0
+          displayName: Download Package Artifacts
+          inputs:
+            buildType: specific
+            buildVersionToDownload: specific
+            project: $(AzDOProjectName)
+            pipeline: $(AzDOPipelineId)
+            buildId: $(AzDOBuildId)
+            artifactName: PackageArtifacts
+            checkDownloadedFiles: true
+      - ${{ if eq(parameters.publishingInfraVersion, 4) }}:
+        - task: DownloadPipelineArtifact@2
+          displayName: Download Pipeline Artifacts (V4)
+          inputs:
+            itemPattern: '*/packages/**/*.nupkg'
+            targetPath: '$(Build.ArtifactStagingDirectory)/PipelineArtifactsDownload'
+        - task: CopyFiles@2
+          displayName: Flatten packages to PackageArtifacts
+          inputs:
+            SourceFolder: '$(Build.ArtifactStagingDirectory)/PipelineArtifactsDownload'
+            Contents: '**/*.nupkg'
+            TargetFolder: '$(Build.ArtifactStagingDirectory)/PackageArtifacts'
+            flattenFolders: true
 
       # This is necessary whenever we want to publish/restore to an AzDO private feed
       # Since sdk-task.ps1 tries to restore packages we need to do this authentication here
@@ -208,53 +237,20 @@ stages:
           JobLabel: 'Signing'
           BinlogToolVersion: $(BinlogToolVersion)
 
-    - job:
-      displayName: SourceLink Validation
-      condition: eq( ${{ parameters.enableSourceLinkValidation }}, 'true')
-      pool:
-        # We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com)
-        ${{ if eq(variables['System.TeamProject'], 'DevDiv') }}:
-          name: AzurePipelines-EO
-          image: 1ESPT-Windows2025
-          demands: Cmd
-          os: windows
-        # If it's not devdiv, it's dnceng
-        ${{ else }}:
-          ${{ if eq(parameters.is1ESPipeline, true) }}:
-            name: $(DncEngInternalBuildPool)
-            image: windows.vs2026.amd64
-            os: windows
-          ${{ else }}:
-            name: $(DncEngInternalBuildPool)
-            demands: ImageOverride -equals windows.vs2026.amd64
-      steps:
-      - template: /eng/common/core-templates/post-build/setup-maestro-vars.yml
-        parameters:
-          BARBuildId: ${{ parameters.BARBuildId }}
-          PromoteToChannelIds: ${{ parameters.PromoteToChannelIds }}
-          is1ESPipeline: ${{ parameters.is1ESPipeline }}
-
-      - task: DownloadBuildArtifacts@0
-        displayName: Download Blob Artifacts
-        inputs:
-          buildType: specific
-          buildVersionToDownload: specific
-          project: $(AzDOProjectName)
-          pipeline: $(AzDOPipelineId)
-          buildId: $(AzDOBuildId)
-          artifactName: BlobArtifacts
-          checkDownloadedFiles: true
-
-      - task: PowerShell@2
-        displayName: Validate
-        inputs:
-          filePath: $(System.DefaultWorkingDirectory)/eng/common/post-build/sourcelink-validation.ps1
-          arguments: -InputPath $(Build.ArtifactStagingDirectory)/BlobArtifacts/ 
-            -ExtractPath $(Agent.BuildDirectory)/Extract/ 
-            -GHRepoName $(Build.Repository.Name) 
-            -GHCommit $(Build.SourceVersion)
-            -SourcelinkCliVersion $(SourceLinkCLIVersion)
-        continueOnError: true
+    # SourceLink validation has been removed — the underlying CLI tool
+    # (targeting netcoreapp2.1) has not functioned for years.
+    # The enableSourceLinkValidation parameter is kept but ignored so
+    # existing pipelines that pass it are not broken.
+    # See https://github.com/dotnet/arcade/issues/16647
+    - ${{ if eq(parameters.enableSourceLinkValidation, 'true') }}:
+      - job:
+        displayName: 'SourceLink Validation Removed - please remove enableSourceLinkValidation from your pipeline'
+        pool: server
+        steps:
+        - task: Delay@1
+          displayName: 'Warning: SourceLink validation removed (see https://github.com/dotnet/arcade/issues/16647)'
+          inputs:
+            delayForMinutes: '0'
 
 - ${{ if ne(parameters.publishAssetsImmediately, 'true') }}:
   - stage: publish_using_darc
@@ -317,7 +313,7 @@ stages:
           scriptPath: $(System.DefaultWorkingDirectory)/eng/common/post-build/publish-using-darc.ps1
           arguments: >
               -BuildId $(BARBuildId)
-              -PublishingInfraVersion ${{ parameters.publishingInfraVersion }}
+              -PublishingInfraVersion 3
               -AzdoToken '$(System.AccessToken)'
               -WaitPublishingFinish true
               -RequireDefaultChannels ${{ parameters.requireDefaultChannels }}
diff --git a/eng/common/core-templates/post-build/setup-maestro-vars.yml b/eng/common/core-templates/post-build/setup-maestro-vars.yml
index a7abd58c4b..6dfa99ec5e 100644
--- a/eng/common/core-templates/post-build/setup-maestro-vars.yml
+++ b/eng/common/core-templates/post-build/setup-maestro-vars.yml
@@ -8,12 +8,11 @@ steps:
     - 'Illegal entry point, is1ESPipeline is not defined. Repository yaml should not directly reference templates in core-templates folder.': error
 
   - ${{ if eq(coalesce(parameters.PromoteToChannelIds, 0), 0) }}:
-    - task: DownloadBuildArtifacts@0
+    - task: DownloadPipelineArtifact@2
       displayName: Download Release Configs
       inputs:
-        buildType: current
         artifactName: ReleaseConfigs
-        checkDownloadedFiles: true
+        targetPath: '$(Build.StagingDirectory)/ReleaseConfigs'
 
   - task: AzureCLI@2
     name: setReleaseVars
diff --git a/eng/common/core-templates/steps/component-governance.yml b/eng/common/core-templates/steps/component-governance.yml
deleted file mode 100644
index cf0649aa95..0000000000
--- a/eng/common/core-templates/steps/component-governance.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-parameters:
-  disableComponentGovernance: false
-  componentGovernanceIgnoreDirectories: ''
-  is1ESPipeline: false
-  displayName: 'Component Detection'
-
-steps:
-- ${{ if eq(parameters.disableComponentGovernance, 'true') }}:
-  - script: echo "##vso[task.setvariable variable=skipComponentGovernanceDetection]true"
-    displayName: Set skipComponentGovernanceDetection variable
-- ${{ if ne(parameters.disableComponentGovernance, 'true') }}:
-  - task: ComponentGovernanceComponentDetection@0
-    continueOnError: true
-    displayName: ${{ parameters.displayName }}
-    inputs:
-      ignoreDirectories: ${{ parameters.componentGovernanceIgnoreDirectories }}
diff --git a/eng/common/core-templates/steps/generate-sbom.yml b/eng/common/core-templates/steps/generate-sbom.yml
index 003f7eae0f..aad0a8aeda 100644
--- a/eng/common/core-templates/steps/generate-sbom.yml
+++ b/eng/common/core-templates/steps/generate-sbom.yml
@@ -1,54 +1,14 @@
-# BuildDropPath - The root folder of the drop directory for which the manifest file will be generated.
-# PackageName - The name of the package this SBOM represents.
-# PackageVersion - The version of the package this SBOM represents. 
-# ManifestDirPath - The path of the directory where the generated manifest files will be placed
-# IgnoreDirectories - Directories to ignore for SBOM generation. This will be passed through to the CG component detector.
-
 parameters:
-  PackageVersion: 11.0.0
-  BuildDropPath: '$(System.DefaultWorkingDirectory)/artifacts'
-  PackageName: '.NET'
-  ManifestDirPath: $(Build.ArtifactStagingDirectory)/sbom
-  IgnoreDirectories: ''
-  sbomContinueOnError: true
-  is1ESPipeline: false
-  # disable publishArtifacts if some other step is publishing the artifacts (like job.yml).
-  publishArtifacts: true
+  PackageVersion: unused
+  BuildDropPath: unused
+  PackageName: unused
+  ManifestDirPath: unused
+  IgnoreDirectories: unused
+  sbomContinueOnError: unused
+  is1ESPipeline: unused
+  publishArtifacts: unused
 
 steps:
-- task: PowerShell@2 
-  displayName: Prep for SBOM generation in (Non-linux)
-  condition: or(eq(variables['Agent.Os'], 'Windows_NT'), eq(variables['Agent.Os'], 'Darwin'))
-  inputs: 
-    filePath: ./eng/common/generate-sbom-prep.ps1
-    arguments: ${{parameters.manifestDirPath}}
-
-# Chmodding is a workaround for https://github.com/dotnet/arcade/issues/8461
 - script: |
-    chmod +x ./eng/common/generate-sbom-prep.sh
-    ./eng/common/generate-sbom-prep.sh ${{parameters.manifestDirPath}}
-  displayName: Prep for SBOM generation in (Linux)
-  condition: eq(variables['Agent.Os'], 'Linux')
-  continueOnError: ${{ parameters.sbomContinueOnError }}
-
-- task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
-  displayName: 'Generate SBOM manifest'
-  continueOnError: ${{ parameters.sbomContinueOnError }}
-  inputs:
-      PackageName: ${{ parameters.packageName }}
-      BuildDropPath: ${{ parameters.buildDropPath }}
-      PackageVersion: ${{ parameters.packageVersion }}
-      ManifestDirPath: ${{ parameters.manifestDirPath }}/$(ARTIFACT_NAME)
-      ${{ if ne(parameters.IgnoreDirectories, '') }}:
-        AdditionalComponentDetectorArgs: '--IgnoreDirectories ${{ parameters.IgnoreDirectories }}'
-
-- ${{ if eq(parameters.publishArtifacts, 'true')}}:
-  - template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml
-    parameters:
-      is1ESPipeline: ${{ parameters.is1ESPipeline }}
-      args:
-        displayName: Publish SBOM manifest
-        continueOnError: ${{parameters.sbomContinueOnError}}
-        targetPath: '${{ parameters.manifestDirPath }}'
-        artifactName: $(ARTIFACT_NAME)
-
+    echo "##vso[task.logissue type=warning]Including generate-sbom.yml is deprecated, SBOM generation is handled 1ES PT now. Remove this include."
+  displayName: Issue generate-sbom.yml deprecation warning
diff --git a/eng/common/core-templates/steps/publish-logs.yml b/eng/common/core-templates/steps/publish-logs.yml
index a9ea99ba6a..84a1922c73 100644
--- a/eng/common/core-templates/steps/publish-logs.yml
+++ b/eng/common/core-templates/steps/publish-logs.yml
@@ -50,13 +50,15 @@ steps:
     TargetFolder: '$(Build.ArtifactStagingDirectory)/PostBuildLogs'
   condition: always()
 
-- template: /eng/common/core-templates/steps/publish-build-artifacts.yml
+- template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml
   parameters:
     is1ESPipeline: ${{ parameters.is1ESPipeline }}
     args:
       displayName: Publish Logs
-      pathToPublish: '$(Build.ArtifactStagingDirectory)/PostBuildLogs'
-      publishLocation: Container
-      artifactName: PostBuildLogs
+      targetPath: '$(Build.ArtifactStagingDirectory)/PostBuildLogs'
+      artifactName: PostBuildLogs_${{ parameters.StageLabel }}_${{ parameters.JobLabel }}_Attempt$(System.JobAttempt)
       continueOnError: true
       condition: always()
+      retryCountOnTaskFailure: 10 # for any files being locked
+      isProduction: false # logs are non-production artifacts
+
diff --git a/eng/common/core-templates/steps/source-build.yml b/eng/common/core-templates/steps/source-build.yml
index acf16ed349..b75f59c428 100644
--- a/eng/common/core-templates/steps/source-build.yml
+++ b/eng/common/core-templates/steps/source-build.yml
@@ -62,4 +62,4 @@ steps:
       artifactName: BuildLogs_SourceBuild_${{ parameters.platform.name }}_Attempt$(System.JobAttempt)
       continueOnError: true
       condition: succeededOrFailed()
-      sbomEnabled: false  # we don't need SBOM for logs
+      isProduction: false # logs are non-production artifacts
diff --git a/eng/common/darc-init.ps1 b/eng/common/darc-init.ps1
index e337431056..a5be41db69 100644
--- a/eng/common/darc-init.ps1
+++ b/eng/common/darc-init.ps1
@@ -29,11 +29,11 @@ function InstallDarcCli ($darcVersion, $toolpath) {
   Write-Host "Installing Darc CLI version $darcVersion..."
   Write-Host 'You may need to restart your command window if this is the first dotnet tool you have installed.'
   if (-not $toolpath) {
-    Write-Host "'$dotnet' tool install $darcCliPackageName --version $darcVersion --add-source '$arcadeServicesSource' -v $verbosity -g"
-    & "$dotnet" tool install $darcCliPackageName --version $darcVersion --add-source "$arcadeServicesSource" -v $verbosity -g
+    Write-Host "'$dotnet' tool install $darcCliPackageName --version $darcVersion --source '$arcadeServicesSource' -v $verbosity -g"
+    & "$dotnet" tool install $darcCliPackageName --version $darcVersion --source "$arcadeServicesSource" -v $verbosity -g
   }else {
-    Write-Host "'$dotnet' tool install $darcCliPackageName --version $darcVersion --add-source '$arcadeServicesSource' -v $verbosity --tool-path '$toolpath'"
-    & "$dotnet" tool install $darcCliPackageName --version $darcVersion --add-source "$arcadeServicesSource" -v $verbosity --tool-path "$toolpath"
+    Write-Host "'$dotnet' tool install $darcCliPackageName --version $darcVersion --source '$arcadeServicesSource' -v $verbosity --tool-path '$toolpath'"
+    & "$dotnet" tool install $darcCliPackageName --version $darcVersion --source "$arcadeServicesSource" -v $verbosity --tool-path "$toolpath"
   }
 }
 
diff --git a/eng/common/darc-init.sh b/eng/common/darc-init.sh
index 9f5ad6b763..b56d40e570 100755
--- a/eng/common/darc-init.sh
+++ b/eng/common/darc-init.sh
@@ -73,9 +73,9 @@ function InstallDarcCli {
   echo "Installing Darc CLI version $darcVersion..."
   echo "You may need to restart your command shell if this is the first dotnet tool you have installed."
   if [ -z "$toolpath" ]; then
-    echo $($dotnet_root/dotnet tool install $darc_cli_package_name --version $darcVersion --add-source "$arcadeServicesSource" -v $verbosity -g)
+    echo $($dotnet_root/dotnet tool install $darc_cli_package_name --version $darcVersion --source "$arcadeServicesSource" -v $verbosity -g)
   else
-    echo $($dotnet_root/dotnet tool install $darc_cli_package_name --version $darcVersion --add-source "$arcadeServicesSource" -v $verbosity --tool-path "$toolpath")
+    echo $($dotnet_root/dotnet tool install $darc_cli_package_name --version $darcVersion --source "$arcadeServicesSource" -v $verbosity --tool-path "$toolpath")
   fi
 }
 
diff --git a/eng/common/generate-sbom-prep.ps1 b/eng/common/generate-sbom-prep.ps1
deleted file mode 100644
index a0c7d792a7..0000000000
--- a/eng/common/generate-sbom-prep.ps1
+++ /dev/null
@@ -1,29 +0,0 @@
-Param(
-    [Parameter(Mandatory=$true)][string] $ManifestDirPath    # Manifest directory where sbom will be placed
-)
-
-. $PSScriptRoot\pipeline-logging-functions.ps1
-
-# Normally - we'd listen to the manifest path given, but 1ES templates will overwrite if this level gets uploaded directly
-# with their own overwriting ours. So we create it as a sub directory of the requested manifest path.
-$ArtifactName = "${env:SYSTEM_STAGENAME}_${env:AGENT_JOBNAME}_SBOM"
-$SafeArtifactName = $ArtifactName -replace '["/:<>\\|?@*"() ]', '_'
-$SbomGenerationDir = Join-Path $ManifestDirPath $SafeArtifactName
-
-Write-Host "Artifact name before : $ArtifactName"
-Write-Host "Artifact name after : $SafeArtifactName"
-
-Write-Host "Creating dir $ManifestDirPath"
-
-# create directory for sbom manifest to be placed
-if (!(Test-Path -path $SbomGenerationDir))
-{
-  New-Item -ItemType Directory -path $SbomGenerationDir
-  Write-Host "Successfully created directory $SbomGenerationDir"
-}
-else{
-  Write-PipelineTelemetryError -category 'Build'  "Unable to create sbom folder."
-}
-
-Write-Host "Updating artifact name"
-Write-Host "##vso[task.setvariable variable=ARTIFACT_NAME]$SafeArtifactName"
diff --git a/eng/common/generate-sbom-prep.sh b/eng/common/generate-sbom-prep.sh
deleted file mode 100644
index b8ecca72bb..0000000000
--- a/eng/common/generate-sbom-prep.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/usr/bin/env bash
-
-source="${BASH_SOURCE[0]}"
-
-# resolve $SOURCE until the file is no longer a symlink
-while [[ -h $source ]]; do
-  scriptroot="$( cd -P "$( dirname "$source" )" && pwd )"
-  source="$(readlink "$source")"
-
-  # if $source was a relative symlink, we need to resolve it relative to the path where the
-  # symlink file was located
-  [[ $source != /* ]] && source="$scriptroot/$source"
-done
-scriptroot="$( cd -P "$( dirname "$source" )" && pwd )"
-. $scriptroot/pipeline-logging-functions.sh
-
-
-# replace all special characters with _, some builds use special characters like : in Agent.Jobname, that is not a permissible name while uploading artifacts.
-artifact_name=$SYSTEM_STAGENAME"_"$AGENT_JOBNAME"_SBOM"
-safe_artifact_name="${artifact_name//["/:<>\\|?@*$" ]/_}"
-manifest_dir=$1
-
-# Normally - we'd listen to the manifest path given, but 1ES templates will overwrite if this level gets uploaded directly
-# with their own overwriting ours. So we create it as a sub directory of the requested manifest path.
-sbom_generation_dir="$manifest_dir/$safe_artifact_name"
-
-if [ ! -d "$sbom_generation_dir" ] ; then
-  mkdir -p "$sbom_generation_dir"
-  echo "Sbom directory created." $sbom_generation_dir
-else
-  Write-PipelineTelemetryError -category 'Build'  "Unable to create sbom folder."
-fi
-
-echo "Artifact name before : "$artifact_name
-echo "Artifact name after : "$safe_artifact_name
-export ARTIFACT_NAME=$safe_artifact_name
-echo "##vso[task.setvariable variable=ARTIFACT_NAME]$safe_artifact_name"
-
-exit 0
diff --git a/eng/common/post-build/redact-logs.ps1 b/eng/common/post-build/redact-logs.ps1
index fc0218a013..672f4e2652 100644
--- a/eng/common/post-build/redact-logs.ps1
+++ b/eng/common/post-build/redact-logs.ps1
@@ -49,8 +49,8 @@ try {
     Write-Host "Installing Binlog redactor CLI..."
     Write-Host "'$dotnet' new tool-manifest"
     & "$dotnet" new tool-manifest
-    Write-Host "'$dotnet' tool install $packageName --local --add-source '$PackageFeed' -v $verbosity --version $BinlogToolVersion"
-    & "$dotnet" tool install $packageName --local --add-source "$PackageFeed" -v $verbosity --version $BinlogToolVersion
+    Write-Host "'$dotnet' tool install $packageName --local --source '$PackageFeed' -v $verbosity --version $BinlogToolVersion"
+    & "$dotnet" tool install $packageName --local --source "$PackageFeed" -v $verbosity --version $BinlogToolVersion
 
     if (Test-Path $TokensFilePath) {
         Write-Host "Adding additional sensitive data for redaction from file: " $TokensFilePath
diff --git a/eng/common/post-build/sourcelink-validation.ps1 b/eng/common/post-build/sourcelink-validation.ps1
deleted file mode 100644
index 1976ef70fb..0000000000
--- a/eng/common/post-build/sourcelink-validation.ps1
+++ /dev/null
@@ -1,327 +0,0 @@
-param(
-  [Parameter(Mandatory=$true)][string] $InputPath,              # Full path to directory where Symbols.NuGet packages to be checked are stored
-  [Parameter(Mandatory=$true)][string] $ExtractPath,            # Full path to directory where the packages will be extracted during validation
-  [Parameter(Mandatory=$false)][string] $GHRepoName,            # GitHub name of the repo including the Org. E.g., dotnet/arcade
-  [Parameter(Mandatory=$false)][string] $GHCommit,              # GitHub commit SHA used to build the packages
-  [Parameter(Mandatory=$true)][string] $SourcelinkCliVersion    # Version of SourceLink CLI to use
-)
-
-$ErrorActionPreference = 'Stop'
-Set-StrictMode -Version 2.0
-
-# `tools.ps1` checks $ci to perform some actions. Since the post-build
-# scripts don't necessarily execute in the same agent that run the
-# build.ps1/sh script this variable isn't automatically set.
-$ci = $true
-$disableConfigureToolsetImport = $true
-. $PSScriptRoot\..\tools.ps1
-
-# Cache/HashMap (File -> Exist flag) used to consult whether a file exist 
-# in the repository at a specific commit point. This is populated by inserting
-# all files present in the repo at a specific commit point.
-$global:RepoFiles = @{}
-
-# Maximum number of jobs to run in parallel
-$MaxParallelJobs = 16
-
-$MaxRetries = 5
-$RetryWaitTimeInSeconds = 30
-
-# Wait time between check for system load
-$SecondsBetweenLoadChecks = 10
-
-if (!$InputPath -or !(Test-Path $InputPath)){
-  Write-Host "No files to validate."
-  ExitWithExitCode 0
-}
-
-$ValidatePackage = {
-  param( 
-    [string] $PackagePath                                 # Full path to a Symbols.NuGet package
-  )
-
-  . $using:PSScriptRoot\..\tools.ps1
-
-  # Ensure input file exist
-  if (!(Test-Path $PackagePath)) {
-    Write-Host "Input file does not exist: $PackagePath"
-    return [pscustomobject]@{
-      result = 1
-      packagePath = $PackagePath
-    }
-  }
-
-  # Extensions for which we'll look for SourceLink information
-  # For now we'll only care about Portable & Embedded PDBs
-  $RelevantExtensions = @('.dll', '.exe', '.pdb')
- 
-  Write-Host -NoNewLine 'Validating ' ([System.IO.Path]::GetFileName($PackagePath)) '...'
-
-  $PackageId = [System.IO.Path]::GetFileNameWithoutExtension($PackagePath)
-  $ExtractPath = Join-Path -Path $using:ExtractPath -ChildPath $PackageId
-  $FailedFiles = 0
-
-  Add-Type -AssemblyName System.IO.Compression.FileSystem
-
-  [System.IO.Directory]::CreateDirectory($ExtractPath)  | Out-Null
-
-  try {
-    $zip = [System.IO.Compression.ZipFile]::OpenRead($PackagePath)
-
-    $zip.Entries | 
-      Where-Object {$RelevantExtensions -contains [System.IO.Path]::GetExtension($_.Name)} |
-        ForEach-Object {
-          $FileName = $_.FullName
-          $Extension = [System.IO.Path]::GetExtension($_.Name)
-          $FakeName = -Join((New-Guid), $Extension)
-          $TargetFile = Join-Path -Path $ExtractPath -ChildPath $FakeName 
-
-          # We ignore resource DLLs
-          if ($FileName.EndsWith('.resources.dll')) {
-            return [pscustomobject]@{
-              result = 0
-              packagePath = $PackagePath
-            }
-          }
-
-          [System.IO.Compression.ZipFileExtensions]::ExtractToFile($_, $TargetFile, $true)
-
-          $ValidateFile = {
-            param( 
-              [string] $FullPath,                                # Full path to the module that has to be checked
-              [string] $RealPath,
-              [ref] $FailedFiles
-            )
-
-            $sourcelinkExe = "$env:USERPROFILE\.dotnet\tools"
-            $sourcelinkExe = Resolve-Path "$sourcelinkExe\sourcelink.exe"
-            $SourceLinkInfos = & $sourcelinkExe print-urls $FullPath | Out-String
-
-            if ($LASTEXITCODE -eq 0 -and -not ([string]::IsNullOrEmpty($SourceLinkInfos))) {
-              $NumFailedLinks = 0
-
-              # We only care about Http addresses
-              $Matches = (Select-String '(http[s]?)(:\/\/)([^\s,]+)' -Input $SourceLinkInfos -AllMatches).Matches
-
-              if ($Matches.Count -ne 0) {
-                $Matches.Value |
-                  ForEach-Object {
-                    $Link = $_
-                    $CommitUrl = "https://raw.githubusercontent.com/${using:GHRepoName}/${using:GHCommit}/"
-                    
-                    $FilePath = $Link.Replace($CommitUrl, "")
-                    $Status = 200
-                    $Cache = $using:RepoFiles
-
-                    $attempts = 0
-
-                    while ($attempts -lt $using:MaxRetries) {
-                      if ( !($Cache.ContainsKey($FilePath)) ) {
-                        try {
-                          $Uri = $Link -as [System.URI]
-                        
-                          if ($Link -match "submodules") {
-                            # Skip submodule links until sourcelink properly handles submodules
-                            $Status = 200
-                          }
-                          elseif ($Uri.AbsoluteURI -ne $null -and ($Uri.Host -match 'github' -or $Uri.Host -match 'githubusercontent')) {
-                            # Only GitHub links are valid
-                            $Status = (Invoke-WebRequest -Uri $Link -UseBasicParsing -Method HEAD -TimeoutSec 5).StatusCode
-                          }
-                          else {
-                            # If it's not a github link, we want to break out of the loop and not retry.
-                            $Status = 0
-                            $attempts = $using:MaxRetries
-                          }
-                        }
-                        catch {
-                          Write-Host $_
-                          $Status = 0
-                        }
-                      }
-
-                      if ($Status -ne 200) {
-                        $attempts++
-                        
-                        if  ($attempts -lt $using:MaxRetries)
-                        {
-                          $attemptsLeft = $using:MaxRetries - $attempts
-                          Write-Warning "Download failed, $attemptsLeft attempts remaining, will retry in $using:RetryWaitTimeInSeconds seconds"
-                          Start-Sleep -Seconds $using:RetryWaitTimeInSeconds
-                        }
-                        else {
-                          if ($NumFailedLinks -eq 0) {
-                            if ($FailedFiles.Value -eq 0) {
-                              Write-Host
-                            }
-  
-                            Write-Host "`tFile $RealPath has broken links:"
-                          }
-  
-                          Write-Host "`t`tFailed to retrieve $Link"
-  
-                          $NumFailedLinks++
-                        }
-                      }
-                      else {
-                        break
-                      }
-                    }
-                  }
-              }
-
-              if ($NumFailedLinks -ne 0) {
-                $FailedFiles.value++
-                $global:LASTEXITCODE = 1
-              }
-            }
-          }
-        
-          &$ValidateFile $TargetFile $FileName ([ref]$FailedFiles)
-        }
-  }
-  catch {
-    Write-Host $_
-  }
-  finally {
-    $zip.Dispose() 
-  }
-
-  if ($FailedFiles -eq 0) {
-    Write-Host 'Passed.'
-    return [pscustomobject]@{
-      result = 0
-      packagePath = $PackagePath
-    }
-  }
-  else {
-    Write-PipelineTelemetryError -Category 'SourceLink' -Message "$PackagePath has broken SourceLink links."
-    return [pscustomobject]@{
-      result = 1
-      packagePath = $PackagePath
-    }
-  }
-}
-
-function CheckJobResult(
-    $result, 
-    $packagePath,
-    [ref]$ValidationFailures,
-    [switch]$logErrors) {
-  if ($result -ne '0') {
-    if ($logErrors) {
-      Write-PipelineTelemetryError -Category 'SourceLink' -Message "$packagePath has broken SourceLink links."
-    }
-    $ValidationFailures.Value++
-  }
-}
-
-function ValidateSourceLinkLinks {
-  if ($GHRepoName -ne '' -and !($GHRepoName -Match '^[^\s\/]+/[^\s\/]+$')) {
-    if (!($GHRepoName -Match '^[^\s-]+-[^\s]+$')) {
-      Write-PipelineTelemetryError -Category 'SourceLink' -Message "GHRepoName should be in the format <org>/<repo> or <org>-<repo>. '$GHRepoName'"
-      ExitWithExitCode 1
-    }
-    else {
-      $GHRepoName = $GHRepoName -replace '^([^\s-]+)-([^\s]+)$', '$1/$2';
-    }
-  }
-
-  if ($GHCommit -ne '' -and !($GHCommit -Match '^[0-9a-fA-F]{40}$')) {
-    Write-PipelineTelemetryError -Category 'SourceLink' -Message "GHCommit should be a 40 chars hexadecimal string. '$GHCommit'"
-    ExitWithExitCode 1
-  }
-
-  if ($GHRepoName -ne '' -and $GHCommit -ne '') {
-    $RepoTreeURL = -Join('http://api.github.com/repos/', $GHRepoName, '/git/trees/', $GHCommit, '?recursive=1')
-    $CodeExtensions = @('.cs', '.vb', '.fs', '.fsi', '.fsx', '.fsscript')
-
-    try {
-      # Retrieve the list of files in the repo at that particular commit point and store them in the RepoFiles hash
-      $Data = Invoke-WebRequest $RepoTreeURL -UseBasicParsing | ConvertFrom-Json | Select-Object -ExpandProperty tree
-  
-      foreach ($file in $Data) {
-        $Extension = [System.IO.Path]::GetExtension($file.path)
-
-        if ($CodeExtensions.Contains($Extension)) {
-          $RepoFiles[$file.path] = 1
-        }
-      }
-    }
-    catch {
-      Write-Host "Problems downloading the list of files from the repo. Url used: $RepoTreeURL . Execution will proceed without caching."
-    }
-  }
-  elseif ($GHRepoName -ne '' -or $GHCommit -ne '') {
-    Write-Host 'For using the http caching mechanism both GHRepoName and GHCommit should be informed.'
-  }
-  
-  if (Test-Path $ExtractPath) {
-    Remove-Item $ExtractPath -Force -Recurse -ErrorAction SilentlyContinue
-  }
-
-  $ValidationFailures = 0
-
-  # Process each NuGet package in parallel
-  Get-ChildItem "$InputPath\*.symbols.nupkg" |
-    ForEach-Object {
-      Write-Host "Starting $($_.FullName)"
-      Start-Job -ScriptBlock $ValidatePackage -ArgumentList $_.FullName | Out-Null
-      $NumJobs = @(Get-Job -State 'Running').Count
-      
-      while ($NumJobs -ge $MaxParallelJobs) {
-        Write-Host "There are $NumJobs validation jobs running right now. Waiting $SecondsBetweenLoadChecks seconds to check again."
-        sleep $SecondsBetweenLoadChecks
-        $NumJobs = @(Get-Job -State 'Running').Count
-      }
-
-      foreach ($Job in @(Get-Job -State 'Completed')) {
-        $jobResult = Wait-Job -Id $Job.Id | Receive-Job
-        CheckJobResult $jobResult.result $jobResult.packagePath ([ref]$ValidationFailures) -LogErrors
-        Remove-Job -Id $Job.Id
-      }
-    }
-
-  foreach ($Job in @(Get-Job)) {
-    $jobResult = Wait-Job -Id $Job.Id | Receive-Job
-    CheckJobResult $jobResult.result $jobResult.packagePath ([ref]$ValidationFailures)
-    Remove-Job -Id $Job.Id
-  }
-  if ($ValidationFailures -gt 0) {
-    Write-PipelineTelemetryError -Category 'SourceLink' -Message "$ValidationFailures package(s) failed validation."
-    ExitWithExitCode 1
-  }
-}
-
-function InstallSourcelinkCli {
-  $sourcelinkCliPackageName = 'sourcelink'
-
-  $dotnetRoot = InitializeDotNetCli -install:$true
-  $dotnet = "$dotnetRoot\dotnet.exe"
-  $toolList = & "$dotnet" tool list --global
-
-  if (($toolList -like "*$sourcelinkCliPackageName*") -and ($toolList -like "*$sourcelinkCliVersion*")) {
-    Write-Host "SourceLink CLI version $sourcelinkCliVersion is already installed."
-  }
-  else {
-    Write-Host "Installing SourceLink CLI version $sourcelinkCliVersion..."
-    Write-Host 'You may need to restart your command window if this is the first dotnet tool you have installed.'
-    & "$dotnet" tool install $sourcelinkCliPackageName --version $sourcelinkCliVersion --verbosity "minimal" --global 
-  }
-}
-
-try {
-  InstallSourcelinkCli
-
-  foreach ($Job in @(Get-Job)) {
-    Remove-Job -Id $Job.Id
-  }
-
-  ValidateSourceLinkLinks 
-}
-catch {
-  Write-Host $_.Exception
-  Write-Host $_.ScriptStackTrace
-  Write-PipelineTelemetryError -Category 'SourceLink' -Message $_
-  ExitWithExitCode 1
-}
diff --git a/eng/common/sdk-task.ps1 b/eng/common/sdk-task.ps1
index b64b66a627..64fd2f8abe 100644
--- a/eng/common/sdk-task.ps1
+++ b/eng/common/sdk-task.ps1
@@ -66,20 +66,7 @@ try {
 
   if( $msbuildEngine -eq "vs") {
     # Ensure desktop MSBuild is available for sdk tasks.
-    if( -not ($GlobalJson.tools.PSObject.Properties.Name -contains "vs" )) {
-      $GlobalJson.tools | Add-Member -Name "vs" -Value (ConvertFrom-Json "{ `"version`": `"16.5`" }") -MemberType NoteProperty
-    }
-    if( -not ($GlobalJson.tools.PSObject.Properties.Name -match "xcopy-msbuild" )) {
-      $GlobalJson.tools | Add-Member -Name "xcopy-msbuild" -Value "18.0.0" -MemberType NoteProperty
-    }
-    if ($GlobalJson.tools."xcopy-msbuild".Trim() -ine "none") {
-        $xcopyMSBuildToolsFolder = InitializeXCopyMSBuild $GlobalJson.tools."xcopy-msbuild" -install $true
-    }
-    if ($xcopyMSBuildToolsFolder -eq $null) {
-      throw 'Unable to get xcopy downloadable version of msbuild'
-    }
-
-    $global:_MSBuildExe = "$($xcopyMSBuildToolsFolder)\MSBuild\Current\Bin\MSBuild.exe"
+    $global:_MSBuildExe = InitializeVisualStudioMSBuild
   }
 
   $taskProject = GetSdkTaskProject $task
diff --git a/eng/common/template-guidance.md b/eng/common/template-guidance.md
index cdc62e72b0..f772aa3d78 100644
--- a/eng/common/template-guidance.md
+++ b/eng/common/template-guidance.md
@@ -81,7 +81,6 @@ eng\common\
             publish-build-artifacts.yml      (logic)
             publish-pipeline-artifacts.yml   (logic)
             component-governance.yml         (shim)
-            generate-sbom.yml                (shim)
             publish-logs.yml                 (shim)
             retain-build.yml                 (shim)
             send-to-helix.yml                (shim)
@@ -104,7 +103,6 @@ eng\common\
             setup-maestro-vars.yml           (logic)
         steps\
             component-governance.yml         (logic)
-            generate-sbom.yml                (logic)
             publish-build-artifacts.yml      (redirect)
             publish-logs.yml                 (logic)
             publish-pipeline-artifacts.yml   (redirect)
diff --git a/eng/common/templates-official/job/job.yml b/eng/common/templates-official/job/job.yml
index f70224eaa4..d68e9fbc26 100644
--- a/eng/common/templates-official/job/job.yml
+++ b/eng/common/templates-official/job/job.yml
@@ -1,24 +1,15 @@
 parameters:
-# Sbom related params
-  enableSbom: true
   runAsPublic: false
-  PackageVersion: 9.0.0
-  BuildDropPath: '$(System.DefaultWorkingDirectory)/artifacts'
+# Sbom related params, unused now and can eventually be removed
+  enableSbom: unused
+  PackageVersion: unused
+  BuildDropPath: unused
 
 jobs:
 - template: /eng/common/core-templates/job/job.yml
   parameters:
     is1ESPipeline: true
 
-    componentGovernanceSteps:
-    - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(parameters.enableSbom, 'true')) }}:
-      - template: /eng/common/templates/steps/generate-sbom.yml
-        parameters:
-          PackageVersion: ${{ parameters.packageVersion }}
-          BuildDropPath: ${{ parameters.buildDropPath }}
-          ManifestDirPath: $(Build.ArtifactStagingDirectory)/sbom
-          publishArtifacts: false
-
     # publish artifacts
     # for 1ES managed templates, use the templateContext.output to handle multiple outputs.
     templateContext:
@@ -26,12 +17,19 @@ jobs:
       outputs:
       - ${{ if ne(parameters.artifacts.publish, '') }}:
         - ${{ if and(ne(parameters.artifacts.publish.artifacts, 'false'), ne(parameters.artifacts.publish.artifacts, '')) }}:
-          - output: buildArtifacts
+          - output: pipelineArtifact
             displayName: Publish pipeline artifacts
-            PathtoPublish: '$(Build.ArtifactStagingDirectory)/artifacts'
-            ArtifactName: ${{ coalesce(parameters.artifacts.publish.artifacts.name , 'Artifacts_$(Agent.Os)_$(_BuildConfig)') }}
-            condition: always()
-            retryCountOnTaskFailure: 10 # for any logs being locked
+            targetPath: '$(Build.ArtifactStagingDirectory)/artifacts'
+            artifactName: ${{ coalesce(parameters.artifacts.publish.artifacts.name , 'Artifacts_$(Agent.Os)_$(_BuildConfig)') }}
+            condition: succeeded()
+            retryCountOnTaskFailure: 10 # for any files being locked
+            continueOnError: true
+          - output: pipelineArtifact
+            displayName: Publish pipeline artifacts
+            targetPath: '$(Build.ArtifactStagingDirectory)/artifacts'
+            artifactName: ${{ coalesce(parameters.artifacts.publish.artifacts.name , 'Artifacts_$(Agent.Os)_$(_BuildConfig)') }}_Attempt$(System.JobAttempt)
+            condition: not(succeeded())
+            retryCountOnTaskFailure: 10 # for any files being locked
             continueOnError: true
         - ${{ if and(ne(parameters.artifacts.publish.logs, 'false'), ne(parameters.artifacts.publish.logs, '')) }}:
           - output: pipelineArtifact
@@ -40,8 +38,8 @@ jobs:
             displayName: 'Publish logs'
             continueOnError: true
             condition: always()
-            retryCountOnTaskFailure: 10 # for any logs being locked
-            sbomEnabled: false  # we don't need SBOM for logs
+            retryCountOnTaskFailure: 10 # for any files being locked
+            isProduction: false # logs are non-production artifacts
 
       - ${{ if eq(parameters.enablePublishBuildArtifacts, true) }}:
         - output: pipelineArtifact
@@ -50,7 +48,8 @@ jobs:
           artifactName: ${{ coalesce(parameters.enablePublishBuildArtifacts.artifactName, '$(Agent.Os)_$(Agent.JobName)_Attempt$(System.JobAttempt)' ) }}
           continueOnError: true
           condition: always()
-          sbomEnabled: false  # we don't need SBOM for logs
+          retryCountOnTaskFailure: 10 # for any files being locked
+          isProduction: false # logs are non-production artifacts
 
       - ${{ if eq(parameters.enableBuildRetry, 'true') }}:
         - output: pipelineArtifact
@@ -58,14 +57,20 @@ jobs:
           artifactName: 'BuildConfiguration'
           displayName: 'Publish build retry configuration'
           continueOnError: true
-          sbomEnabled: false  # we don't need SBOM for BuildConfiguration
+          retryCountOnTaskFailure: 10 # for any files being locked
+          isProduction: false # BuildConfiguration is a non-production artifact
 
-      - ${{ if and(eq(parameters.runAsPublic, 'false'), ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(parameters.enableSbom, 'true')) }}:
+      # V4 publishing: automatically publish staged artifacts as a pipeline artifact.
+      # The artifact name matches the SDK's FutureArtifactName ($(System.PhaseName)_Artifacts),
+      # which is encoded in the asset manifest for downstream publishing to discover.
+      # Jobs can opt in by setting enablePublishing: true.
+      - ${{ if and(eq(parameters.publishingVersion, 4), eq(parameters.enablePublishing, 'true')) }}:
         - output: pipelineArtifact
-          displayName: Publish SBOM manifest
+          displayName: 'Publish V4 pipeline artifacts'
+          targetPath: '$(Build.ArtifactStagingDirectory)/artifacts'
+          artifactName: '$(System.PhaseName)_Artifacts'
           continueOnError: true
-          targetPath: $(Build.ArtifactStagingDirectory)/sbom
-          artifactName: $(ARTIFACT_NAME)
+          retryCountOnTaskFailure: 10 # for any files being locked
 
       # add any outputs provided via root yaml
       - ${{ if ne(parameters.templateContext.outputs, '') }}:
diff --git a/eng/common/templates-official/steps/component-governance.yml b/eng/common/templates-official/steps/component-governance.yml
deleted file mode 100644
index 30bb3985ca..0000000000
--- a/eng/common/templates-official/steps/component-governance.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-steps:
-- template: /eng/common/core-templates/steps/component-governance.yml
-  parameters:
-    is1ESPipeline: true
-
-    ${{ each parameter in parameters }}:
-      ${{ parameter.key }}: ${{ parameter.value }}
diff --git a/eng/common/templates-official/steps/publish-pipeline-artifacts.yml b/eng/common/templates-official/steps/publish-pipeline-artifacts.yml
index 172f9f0fdc..9e5981365e 100644
--- a/eng/common/templates-official/steps/publish-pipeline-artifacts.yml
+++ b/eng/common/templates-official/steps/publish-pipeline-artifacts.yml
@@ -24,5 +24,7 @@ steps:
       artifactName: ${{ parameters.args.artifactName }}
     ${{ if parameters.args.properties }}:
       properties: ${{ parameters.args.properties }}
-    ${{ if parameters.args.sbomEnabled }}:
+    ${{ if ne(parameters.args.sbomEnabled, '') }}:
       sbomEnabled: ${{ parameters.args.sbomEnabled }}
+    ${{ if ne(parameters.args.isProduction, '') }}:
+      isProduction: ${{ parameters.args.isProduction }}
diff --git a/eng/common/templates/job/job.yml b/eng/common/templates/job/job.yml
index 7f1b5d97d1..5e261f34db 100644
--- a/eng/common/templates/job/job.yml
+++ b/eng/common/templates/job/job.yml
@@ -1,12 +1,12 @@
 parameters: 
   enablePublishBuildArtifacts: false
-  disableComponentGovernance: ''
-  componentGovernanceIgnoreDirectories: ''
-# Sbom related params
-  enableSbom: true
   runAsPublic: false
-  PackageVersion: 9.0.0
-  BuildDropPath: '$(System.DefaultWorkingDirectory)/artifacts'
+# CG related params, unused now and can eventually be removed
+  disableComponentGovernance: unused
+# Sbom related params, unused now and can eventually be removed
+  enableSbom: unused
+  PackageVersion: unused
+  BuildDropPath: unused
 
 jobs:
 - template: /eng/common/core-templates/job/job.yml
@@ -21,32 +21,34 @@ jobs:
     - ${{ each step in parameters.steps }}:
       - ${{ step }}
 
-    componentGovernanceSteps:
-    - template: /eng/common/templates/steps/component-governance.yml
-      parameters:
-        ${{ if eq(parameters.disableComponentGovernance, '') }}:
-          ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest'), eq(parameters.runAsPublic, 'false'), or(startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), startsWith(variables['Build.SourceBranch'], 'refs/heads/dotnet/'), startsWith(variables['Build.SourceBranch'], 'refs/heads/microsoft/'), eq(variables['Build.SourceBranch'], 'refs/heads/main'))) }}:
-            disableComponentGovernance: false
-          ${{ else }}:
-            disableComponentGovernance: true
-        ${{ else }}:
-          disableComponentGovernance: ${{ parameters.disableComponentGovernance }}
-        componentGovernanceIgnoreDirectories: ${{ parameters.componentGovernanceIgnoreDirectories }}
+    # we don't run CG in public
+    - ${{ if eq(variables['System.TeamProject'], 'public') }}:
+      - script: echo "##vso[task.setvariable variable=skipComponentGovernanceDetection]true"
+        displayName: Set skipComponentGovernanceDetection variable
 
     artifactPublishSteps:
     - ${{ if ne(parameters.artifacts.publish, '') }}:
       - ${{ if and(ne(parameters.artifacts.publish.artifacts, 'false'), ne(parameters.artifacts.publish.artifacts, '')) }}:
-        - template: /eng/common/core-templates/steps/publish-build-artifacts.yml
+        - template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml
           parameters:
             is1ESPipeline: false
             args:
               displayName: Publish pipeline artifacts
-              pathToPublish: '$(Build.ArtifactStagingDirectory)/artifacts'
-              publishLocation: Container
+              targetPath: '$(Build.ArtifactStagingDirectory)/artifacts'
               artifactName: ${{ coalesce(parameters.artifacts.publish.artifacts.name , 'Artifacts_$(Agent.Os)_$(_BuildConfig)') }}
               continueOnError: true
-              condition: always()
-              retryCountOnTaskFailure: 10 # for any logs being locked
+              condition: succeeded()
+              retryCountOnTaskFailure: 10 # for any files being locked
+        - template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml
+          parameters:
+            is1ESPipeline: false
+            args:
+              displayName: Publish pipeline artifacts
+              targetPath: '$(Build.ArtifactStagingDirectory)/artifacts'
+              artifactName: ${{ coalesce(parameters.artifacts.publish.artifacts.name , 'Artifacts_$(Agent.Os)_$(_BuildConfig)') }}_Attempt$(System.JobAttempt)
+              continueOnError: true
+              condition: not(succeeded())
+              retryCountOnTaskFailure: 10 # for any files being locked
       - ${{ if and(ne(parameters.artifacts.publish.logs, 'false'), ne(parameters.artifacts.publish.logs, '')) }}:
         - template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml
           parameters:
@@ -57,8 +59,7 @@ jobs:
               displayName: 'Publish logs'
               continueOnError: true
               condition: always()
-              retryCountOnTaskFailure: 10 # for any logs being locked
-              sbomEnabled: false  # we don't need SBOM for logs
+              retryCountOnTaskFailure: 10 # for any files being locked
 
     - ${{ if ne(parameters.enablePublishBuildArtifacts, 'false') }}:
       - template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml
@@ -70,7 +71,7 @@ jobs:
             artifactName: ${{ coalesce(parameters.enablePublishBuildArtifacts.artifactName, '$(Agent.Os)_$(Agent.JobName)_Attempt$(System.JobAttempt)' ) }}
             continueOnError: true
             condition: always()
-            sbomEnabled: false
+            retryCountOnTaskFailure: 10 # for any files being locked
 
     - ${{ if eq(parameters.enableBuildRetry, 'true') }}:
       - template: /eng/common/core-templates/steps/publish-pipeline-artifacts.yml
@@ -81,4 +82,4 @@ jobs:
             artifactName: 'BuildConfiguration'
             displayName: 'Publish build retry configuration'
             continueOnError: true
-            sbomEnabled: false  # we don't need SBOM for BuildConfiguration
+            retryCountOnTaskFailure: 10 # for any files being locked
diff --git a/eng/common/templates/steps/component-governance.yml b/eng/common/templates/steps/component-governance.yml
deleted file mode 100644
index c12a5f8d21..0000000000
--- a/eng/common/templates/steps/component-governance.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-steps:
-- template: /eng/common/core-templates/steps/component-governance.yml
-  parameters:
-    is1ESPipeline: false
-
-    ${{ each parameter in parameters }}:
-      ${{ parameter.key }}: ${{ parameter.value }}
diff --git a/eng/common/tools.ps1 b/eng/common/tools.ps1
index c96f5018fe..b678799176 100644
--- a/eng/common/tools.ps1
+++ b/eng/common/tools.ps1
@@ -375,12 +375,11 @@ function InstallDotNet([string] $dotnetRoot,
 #
 #   1. MSBuild from an active VS command prompt
 #   2. MSBuild from a compatible VS installation
-#   3. MSBuild from the xcopy tool package
 #
 # Returns full path to msbuild.exe.
 # Throws on failure.
 #
-function InitializeVisualStudioMSBuild([bool]$install, [object]$vsRequirements = $null) {
+function InitializeVisualStudioMSBuild([object]$vsRequirements = $null) {
   if (-not (IsWindowsPlatform)) {
     throw "Cannot initialize Visual Studio on non-Windows"
   }
@@ -390,13 +389,7 @@ function InitializeVisualStudioMSBuild([bool]$install, [object]$vsRequirements =
   }
 
   # Minimum VS version to require.
-  $vsMinVersionReqdStr = '17.7'
-  $vsMinVersionReqd = [Version]::new($vsMinVersionReqdStr)
-
-  # If the version of msbuild is going to be xcopied,
-  # use this version. Version matches a package here:
-  # https://dev.azure.com/dnceng/public/_artifacts/feed/dotnet-eng/NuGet/Microsoft.DotNet.Arcade.MSBuild.Xcopy/versions/18.0.0
-  $defaultXCopyMSBuildVersion = '18.0.0'
+  $vsMinVersionReqdStr = '18.0'
 
   if (!$vsRequirements) {
     if (Get-Member -InputObject $GlobalJson.tools -Name 'vs') {
@@ -426,46 +419,16 @@ function InitializeVisualStudioMSBuild([bool]$install, [object]$vsRequirements =
     }
   }
 
-  # Locate Visual Studio installation or download x-copy msbuild.
+  # Locate Visual Studio installation.
   $vsInfo = LocateVisualStudio $vsRequirements
-  if ($vsInfo -ne $null -and $env:ForceUseXCopyMSBuild -eq $null) {
+  if ($vsInfo -ne $null) {
     # Ensure vsInstallDir has a trailing slash
     $vsInstallDir = Join-Path $vsInfo.installationPath "\"
     $vsMajorVersion = $vsInfo.installationVersion.Split('.')[0]
 
     InitializeVisualStudioEnvironmentVariables $vsInstallDir $vsMajorVersion
   } else {
-    if (Get-Member -InputObject $GlobalJson.tools -Name 'xcopy-msbuild') {
-      $xcopyMSBuildVersion = $GlobalJson.tools.'xcopy-msbuild'
-      $vsMajorVersion = $xcopyMSBuildVersion.Split('.')[0]
-    } else {
-      #if vs version provided in global.json is incompatible (too low) then use the default version for xcopy msbuild download
-      if($vsMinVersion -lt $vsMinVersionReqd){
-        Write-Host "Using xcopy-msbuild version of $defaultXCopyMSBuildVersion since VS version $vsMinVersionStr provided in global.json is not compatible"
-        $xcopyMSBuildVersion = $defaultXCopyMSBuildVersion
-        $vsMajorVersion = $xcopyMSBuildVersion.Split('.')[0]
-      }
-      else{
-        # If the VS version IS compatible, look for an xcopy msbuild package
-        # with a version matching VS.
-        # Note: If this version does not exist, then an explicit version of xcopy msbuild
-        # can be specified in global.json. This will be required for pre-release versions of msbuild.
-        $vsMajorVersion = $vsMinVersion.Major
-        $vsMinorVersion = $vsMinVersion.Minor
-        $xcopyMSBuildVersion = "$vsMajorVersion.$vsMinorVersion.0"
-      }
-    }
-
-    $vsInstallDir = $null
-    if ($xcopyMSBuildVersion.Trim() -ine "none") {
-        $vsInstallDir = InitializeXCopyMSBuild $xcopyMSBuildVersion $install
-        if ($vsInstallDir -eq $null) {
-            throw "Could not xcopy msbuild. Please check that package 'Microsoft.DotNet.Arcade.MSBuild.Xcopy @ $xcopyMSBuildVersion' exists on feed 'dotnet-eng'."
-        }
-    }
-    if ($vsInstallDir -eq $null) {
-      throw 'Unable to find Visual Studio that has required version and components installed'
-    }
+    throw 'Unable to find Visual Studio that has required version and components installed'
   }
 
   $msbuildVersionDir = if ([int]$vsMajorVersion -lt 16) { "$vsMajorVersion.0" } else { "Current" }
@@ -492,38 +455,6 @@ function InitializeVisualStudioEnvironmentVariables([string] $vsInstallDir, [str
   }
 }
 
-function InstallXCopyMSBuild([string]$packageVersion) {
-  return InitializeXCopyMSBuild $packageVersion -install $true
-}
-
-function InitializeXCopyMSBuild([string]$packageVersion, [bool]$install) {
-  $packageName = 'Microsoft.DotNet.Arcade.MSBuild.Xcopy'
-  $packageDir = Join-Path $ToolsDir "msbuild\$packageVersion"
-  $packagePath = Join-Path $packageDir "$packageName.$packageVersion.nupkg"
-
-  if (!(Test-Path $packageDir)) {
-    if (!$install) {
-      return $null
-    }
-
-    Create-Directory $packageDir
-
-    Write-Host "Downloading $packageName $packageVersion"
-    $ProgressPreference = 'SilentlyContinue' # Don't display the console progress UI - it's a huge perf hit
-    Retry({
-      Invoke-WebRequest "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/flat2/$packageName/$packageVersion/$packageName.$packageVersion.nupkg" -UseBasicParsing -OutFile $packagePath
-    })
-
-    if (!(Test-Path $packagePath)) {
-      Write-PipelineTelemetryError -Category 'InitializeToolset' -Message "See https://dev.azure.com/dnceng/internal/_wiki/wikis/DNCEng%20Services%20Wiki/1074/Updating-Microsoft.DotNet.Arcade.MSBuild.Xcopy-WAS-RoslynTools.MSBuild-(xcopy-msbuild)-generation?anchor=troubleshooting for help troubleshooting issues with XCopy MSBuild"
-      throw
-    }
-    Unzip $packagePath $packageDir
-  }
-
-  return Join-Path $packageDir 'tools'
-}
-
 #
 # Locates Visual Studio instance that meets the minimal requirements specified by tools.vs object in global.json.
 #
@@ -633,7 +564,7 @@ function InitializeBuildTool() {
     $buildTool = @{ Path = $dotnetPath; Command = 'msbuild'; Tool = 'dotnet'; Framework = 'net' }
   } elseif ($msbuildEngine -eq "vs") {
     try {
-      $msbuildPath = InitializeVisualStudioMSBuild -install:$restore
+      $msbuildPath = InitializeVisualStudioMSBuild
     } catch {
       Write-PipelineTelemetryError -Category 'InitializeToolset' -Message $_
       ExitWithExitCode 1
diff --git a/global.json b/global.json
index b6a65e2b8e..522b71af1f 100644
--- a/global.json
+++ b/global.json
@@ -8,7 +8,7 @@
     "dotnet": "11.0.100-preview.3.26170.106"
   },
   "msbuild-sdks": {
-    "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26177.6",
+    "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26204.1",
     "Microsoft.Build.NoTargets": "3.7.0",
     "Microsoft.Build.Traversal": "3.4.0"
   }