diff --git a/eng/pipelines/azure-pipelines-codeql.yml b/eng/pipelines/azure-pipelines-codeql.yml
index d49804f6ed5..1fe37a94a97 100644
--- a/eng/pipelines/azure-pipelines-codeql.yml
+++ b/eng/pipelines/azure-pipelines-codeql.yml
@@ -74,7 +74,9 @@ jobs:
     inputs:
       targetType: 'inline'
       script: |
-        npm install -g @vscode/vsce@3.7.1
+        # Pin Azure Identity explicitly so VSCE's transitive dependency graph
+        # remains stable across npm feed updates.
+        npm install -g @vscode/vsce@3.7.1 @azure/identity@4.13.1
         vsce --version
       workingDirectory: '$(Build.SourcesDirectory)'
 
diff --git a/eng/pipelines/azure-pipelines-unofficial.yml b/eng/pipelines/azure-pipelines-unofficial.yml
index e9166310d4e..42ebe2c5aa0 100644
--- a/eng/pipelines/azure-pipelines-unofficial.yml
+++ b/eng/pipelines/azure-pipelines-unofficial.yml
@@ -226,7 +226,9 @@ extends:
                 inputs:
                   targetType: 'inline'
                   script: |
-                    npm install -g @vscode/vsce@3.7.1
+                    # Pin Azure Identity explicitly so VSCE's transitive dependency graph
+                    # remains stable across npm feed updates.
+                    npm install -g @vscode/vsce@3.7.1 @azure/identity@4.13.1
                     vsce --version
                   workingDirectory: '$(Build.SourcesDirectory)'
 
diff --git a/eng/pipelines/azure-pipelines.yml b/eng/pipelines/azure-pipelines.yml
index c49dbe1a760..d1d6794d846 100644
--- a/eng/pipelines/azure-pipelines.yml
+++ b/eng/pipelines/azure-pipelines.yml
@@ -505,13 +505,12 @@ extends:
           # not recognized."
           enableMicrobuild: true
           enablePublishUsingPipelines: true
-          # Asset_Registry_Publish (BAR publish) needs MaestroAccessToken from
-          # the Publish-Build-Assets variable group, which is only loaded on
-          # main / release / internal-release branches because of the AzDO
-          # ACL on that group. Skip the publish job entirely on contributor
-          # branches so jobs.yml does not inject Asset_Registry_Publish and
-          # fail at runtime for a missing token (and so the assemble stage
-          # does not trip an additional 1ES Branch control checkpoint).
+          # Asset_Registry_Publish (BAR publish) loads Publish-Build-Assets at
+          # job scope for MaestroAccessToken. The group has an AzDO ACL for
+          # main / release / internal-release branches, so skip the publish
+          # job entirely on contributor branches. This avoids injecting a job
+          # that cannot load its token and prevents another 1ES Branch control
+          # checkpoint on the assemble stage.
           ${{ if or(eq(variables['Build.SourceBranch'], 'refs/heads/main'), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), startsWith(variables['Build.SourceBranch'], 'refs/heads/internal/release/')) }}:
             enablePublishBuildAssets: true
             publishAssetsImmediately: true
diff --git a/eng/pipelines/common-variables.yml b/eng/pipelines/common-variables.yml
index 411eb9b8272..3c314da03ac 100644
--- a/eng/pipelines/common-variables.yml
+++ b/eng/pipelines/common-variables.yml
@@ -32,7 +32,6 @@ variables:
       value: True
     - name: _SignType
       value: real
-    # Publish-Build-Assets provides: MaestroAccessToken, BotAccount-dotnet-maestro-bot-PAT
     # DotNet-HelixApi-Access provides: HelixApiAccessToken
     # SDL_Settings provides Guardian/SDL tooling credentials
     #
@@ -41,13 +40,11 @@ variables:
     # scope causes 1ES to inject a per-stage Branch control check that blocks
     # every stage on contributor branches before any work can start.
     #
-    # Only the BAR publish job (assemble stage's Asset_Registry_Publish) and
-    # helix telemetry actually need these tokens, and neither runs as a real
-    # publish on a contributor branch. Skip the group load when we're not on
-    # a branch the ACLs accept so manual / non-PR builds on ankj/* etc. can
-    # still validate the rest of the pipeline (including signing).
+    # Helix telemetry and Guardian/SDL tooling use these tokens. Skip the
+    # group load when we're not on a branch the ACLs accept so manual /
+    # non-PR builds on ankj/* etc. can still validate the rest of the
+    # pipeline (including signing).
     - ${{ if or(eq(variables['Build.SourceBranch'], 'refs/heads/main'), startsWith(variables['Build.SourceBranch'], 'refs/heads/release/'), startsWith(variables['Build.SourceBranch'], 'refs/heads/internal/release/')) }}:
-      - group: Publish-Build-Assets
       - group: DotNet-HelixApi-Access
       - group: SDL_Settings
     - name: _InternalBuildArgs
diff --git a/eng/pipelines/release-publish-nuget.yml b/eng/pipelines/release-publish-nuget.yml
index 6125911d0bb..bd590077a49 100644
--- a/eng/pipelines/release-publish-nuget.yml
+++ b/eng/pipelines/release-publish-nuget.yml
@@ -2178,7 +2178,9 @@ extends:
               - pwsh: |
                   $ErrorActionPreference = 'Stop'
 
-                  npm install -g @vscode/vsce@3.7.1 --registry https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
+                  # Pin Azure Identity explicitly so VSCE's transitive dependency graph
+                  # remains stable across npm feed updates.
+                  npm install -g @vscode/vsce@3.7.1 @azure/identity@4.13.1 --registry https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public-npm/npm/registry/
                   vsce --version
                 displayName: 'Install vsce'
 
diff --git a/eng/pipelines/templates/build_extension.yml b/eng/pipelines/templates/build_extension.yml
index 17d281a3750..c81d22ba967 100644
--- a/eng/pipelines/templates/build_extension.yml
+++ b/eng/pipelines/templates/build_extension.yml
@@ -74,7 +74,9 @@ jobs:
           inputs:
             targetType: 'inline'
             script: |
-              npm install -g @vscode/vsce@3.7.1
+              # Pin Azure Identity explicitly so VSCE's transitive dependency graph
+              # remains stable across npm feed updates.
+              npm install -g @vscode/vsce@3.7.1 @azure/identity@4.13.1
               vsce --version
             workingDirectory: '$(Build.SourcesDirectory)'