diff --git a/.vsts-dotnet.yml b/.vsts-dotnet.yml
index 852eb5ab0dd..f8ac96da992 100644
--- a/.vsts-dotnet.yml
+++ b/.vsts-dotnet.yml
@@ -6,7 +6,6 @@ trigger:
 # Once they exist, we should define these as "runtime parameters"
 # https://github.com/Microsoft/azure-pipelines-yaml/pull/129
 # variables:
-#   SignType: real
 #   SkipApplyOptimizationData: false
 
 parameters:
@@ -18,6 +17,10 @@ parameters:
   displayName: Enable Signing Validation
   type: boolean
   default: true
+- name: signTypeParameter
+  displayName: Sign Type
+  type: string
+  default: 'real'
 
 variables:
   # if OptProfDrop is not set, string '$(OptProfDrop)' will be passed to the build script.
@@ -39,6 +42,11 @@ variables:
     value: .NETCore
   - name: _DotNetValidationArtifactsCategory
     value: .NETCoreValidation
+  # For now skipping apply optimization data for vs16.11, because the run with real signed bits requires being fully automated
+  # while there is no available optimization data for vs16.11.
+  - ${{ if startsWith(variables['Build.SourceBranch'], 'refs/heads/vs16.11') }}:
+    - name: SkipApplyOptimizationData
+      value: true
   - name: EnableReleaseOneLocBuild
     value: false
   - name: Codeql.Enabled
@@ -103,6 +111,7 @@ extends:
         parameters:
           isExperimental: false
           enableComponentGovernance: true
+          signTypeParameter: ${{ parameters.signTypeParameter }}
 
     - template: /eng/common/templates-official/post-build/post-build.yml@self
       parameters:
diff --git a/azure-pipelines/.vsts-dotnet-build-jobs.yml b/azure-pipelines/.vsts-dotnet-build-jobs.yml
index 7fc4ab946d1..4ce453e23ef 100644
--- a/azure-pipelines/.vsts-dotnet-build-jobs.yml
+++ b/azure-pipelines/.vsts-dotnet-build-jobs.yml
@@ -6,6 +6,9 @@ parameters:
 - name: enableComponentGovernance
   type: boolean
   default: false
+- name: signTypeParameter
+  type: string
+  default: 'test'
 
 jobs:
 - job: Windows_NT
@@ -43,14 +46,14 @@ jobs:
   - task: MicroBuildSigningPlugin@4
     displayName: Install MicroBuild plugin
     inputs:
-      signType: $(SignType)
+      signType: ${{ parameters.signTypeParameter }}
       zipSources: false
       feedSource: https://devdiv.pkgs.visualstudio.com/_packaging/MicroBuildToolset/nuget/v3/index.json
-      ${{ if and(eq(variables['SignType'], 'real'), eq(variables['System.TeamProject'], 'DevDiv')) }}:
+      ${{ if and(eq(parameters.signTypeParameter, 'real'), eq(variables['System.TeamProject'], 'DevDiv')) }}:
         ConnectedPMEServiceName: 6cc74545-d7b9-4050-9dfa-ebefcc8961ea
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
-    condition: and(succeeded(), in(variables['SignType'], 'test', 'real'))
+    condition: and(succeeded(), in('${{ parameters.signTypeParameter }}', 'test', 'real'))
 
   - task: MicroBuildOptProfPlugin@6
     inputs:
@@ -73,7 +76,7 @@ jobs:
               /p:VisualStudioIbcSourceBranchName=$(SourceBranch)
               /p:VisualStudioDropAccessToken=$(System.AccessToken)
               /p:VisualStudioDropName=$(VisualStudio.DropName)
-              /p:DotNetSignType=$(SignType)
+              /p:DotNetSignType=${{ parameters.signTypeParameter }}
               /p:DotNetPublishToBlobFeed=true
               /p:DotNetPublishBlobFeedKey=$(dotnetfeed-storage-access-key-1)
               /p:DotNetPublishBlobFeedUrl=https://dotnetfeed.blob.core.windows.net/dotnet-core/index.json
@@ -85,6 +88,8 @@ jobs:
               /p:VisualStudioIbcDrop=$(OptProfDrop)
               /p:GenerateSbom=true
               /p:SuppressFinalPackageVersion=${{ parameters.isExperimental }}
+              /p:IsExperimental=${{ parameters.isExperimental }}
+
     displayName: Build
     condition: succeeded()
 
diff --git a/azure-pipelines/.vsts-dotnet-exp-perf.yml b/azure-pipelines/.vsts-dotnet-exp-perf.yml
index 33ea1e6fc91..c5fb9cd2e97 100644
--- a/azure-pipelines/.vsts-dotnet-exp-perf.yml
+++ b/azure-pipelines/.vsts-dotnet-exp-perf.yml
@@ -5,7 +5,6 @@ trigger:
 # Once they exist, we should define these as "runtime parameters"
 # https://github.com/Microsoft/azure-pipelines-yaml/pull/129
 # variables:
-#   SignType: test
 #   SkipApplyOptimizationData: false
 
 parameters:
@@ -17,6 +16,10 @@ parameters:
   displayName: Enable Signing Validation
   type: boolean
   default: false
+- name: signTypeParameter
+  displayName: Sign Type
+  type: string
+  default: 'test'
 
 variables:
   # if OptProfDrop is not set, string '$(OptProfDrop)' will be passed to the build script.
@@ -72,6 +75,7 @@ extends:
         parameters:
           isExperimental: true
           enableComponentGovernance: false
+          signTypeParameter: ${{ parameters.signTypeParameter }}
 
     - template: /eng/common/templates/post-build/post-build.yml@self
       parameters:
diff --git a/eng/Versions.props b/eng/Versions.props
index 9f0038dd6e1..5552fee9868 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -2,11 +2,15 @@
 <!-- Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the MIT license. See License.txt in the project root for full license information. -->
 <Project>
   <PropertyGroup>
-    <VersionPrefix>17.8.39</VersionPrefix>
+    <VersionPrefix>17.8.40</VersionPrefix>
     <DotNetFinalVersionKind>release</DotNetFinalVersionKind>
     <PackageValidationBaselineVersion>17.7.0</PackageValidationBaselineVersion>
     <AssemblyVersion>15.1.0.0</AssemblyVersion>
     <PreReleaseVersionLabel>servicing</PreReleaseVersionLabel>
+
+    <!-- differentiate experimental insertions to avoid package id conflicts, 
+    it has to be alphabetically after "preview" to avoid downgrade errors in VS -->
+    <PreReleaseVersionLabel Condition="'$(IsExperimental)' == 'true'">test</PreReleaseVersionLabel>
     <DotNetUseShippingVersions>true</DotNetUseShippingVersions>
     <!-- Workaround for https://github.com/dotnet/roslyn/issues/35793 -->
     <SemanticVersioningV1>true</SemanticVersioningV1>
diff --git a/eng/common/cross/build-rootfs.sh b/eng/common/cross/build-rootfs.sh
old mode 100644
new mode 100755
diff --git a/eng/common/tools.sh b/eng/common/tools.sh
old mode 100644
new mode 100755