diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
index 56c4ec6e7..c6c300973 100644
--- a/.config/dotnet-tools.json
+++ b/.config/dotnet-tools.json
@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "powershell": {
-      "version": "7.6.4",
+      "version": "7.6.5",
       "commands": [
         "pwsh"
       ],
@@ -31,7 +31,7 @@
       "rollForward": false
     },
     "nerdbank.dotnetrepotools": {
-      "version": "1.5.15",
+      "version": "1.5.42",
       "commands": [
         "repo"
       ],
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 05e4d16b1..2c566c0be 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -60,8 +60,11 @@ Having previously used `nbgv tag` and pushing the tag will help you identify the
 After publishing the release, the `.github/workflows/release.yml` workflow will be automatically triggered, which will:
 
 1. Find the most recent `.github/workflows/build.yml` GitHub workflow run of the tagged release.
-1. Upload the `deployables` artifact from that workflow run to your GitHub Release.
-1. If you have `NUGET_API_KEY` defined as a secret variable for your repo or org, any nuget packages in the `deployables` artifact will be pushed to nuget.org.
+1. Upload the `deployables-Linux` artifact from that workflow run to your GitHub Release.
+1. Any nuget packages in the `deployables-Linux` artifact will be pushed to nuget.org.
+
+The workflow is written to leverage NuGet.org Trusted Publishing.
+You should set `NUGET_USER` as a repo secret to satisfy Trusted Publishing requirements.
 
 ### Azure Pipelines
 
diff --git a/Directory.Packages.props b/Directory.Packages.props
index f3826462b..5f73f702a 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -5,7 +5,7 @@
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
     <MicrosoftTestingPlatformVersion>2.3.3</MicrosoftTestingPlatformVersion>
-    <MicroBuildVersion>2.0.226</MicroBuildVersion>
+    <MicroBuildVersion>2.0.257</MicroBuildVersion>
     <CodeAnalysisVersion>5.9.0</CodeAnalysisVersion>
     <CodefixTestingVersion>1.1.4</CodefixTestingVersion>
   </PropertyGroup>
diff --git a/azure-pipelines/archive-sourcecode.yml b/azure-pipelines/archive-sourcecode.yml
index cb8d68e9c..13015bef5 100644
--- a/azure-pipelines/archive-sourcecode.yml
+++ b/azure-pipelines/archive-sourcecode.yml
@@ -36,7 +36,7 @@ extends:
   template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
   parameters:
     settings:
-      networkIsolationPolicy: Permissive,CFSClean2
+      networkIsolationPolicy: DefaultDeny,CFSClean3
     sdl:
       sourceAnalysisPool: VSEng-MicroBuildVSStable
 
diff --git a/azure-pipelines/libtemplate-update.yml b/azure-pipelines/libtemplate-update.yml
index acbfbacef..8b342de2b 100644
--- a/azure-pipelines/libtemplate-update.yml
+++ b/azure-pipelines/libtemplate-update.yml
@@ -31,7 +31,7 @@ extends:
   template: azure-pipelines/MicroBuild.1ES.Unofficial.yml@MicroBuildTemplate
   parameters:
     settings:
-      networkIsolationPolicy: Permissive,CFSClean2
+      networkIsolationPolicy: DefaultDeny,CFSClean3
     sdl:
       sourceAnalysisPool:
         name: AzurePipelines-EO
diff --git a/azure-pipelines/official.yml b/azure-pipelines/official.yml
index a63588e31..edfc2e6f5 100644
--- a/azure-pipelines/official.yml
+++ b/azure-pipelines/official.yml
@@ -46,7 +46,7 @@ extends:
   template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
   parameters:
     settings:
-      networkIsolationPolicy: Permissive,CFSClean2
+      networkIsolationPolicy: DefaultDeny,CFSClean3
     sdl:
       sourceAnalysisPool: VSEng-MicroBuildVSStable
       codeSignValidation:
diff --git a/azure-pipelines/release.yml b/azure-pipelines/release.yml
index e7e804b60..d435dab3b 100644
--- a/azure-pipelines/release.yml
+++ b/azure-pipelines/release.yml
@@ -21,7 +21,7 @@ extends:
   template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
   parameters:
     settings:
-      networkIsolationPolicy: Permissive,CFSClean2
+      networkIsolationPolicy: DefaultDeny,CFSClean3
     sdl:
       sourceAnalysisPool: VSEng-MicroBuildVSStable
 
diff --git a/azure-pipelines/unofficial.yml b/azure-pipelines/unofficial.yml
index 7a968fd15..ef52618c8 100644
--- a/azure-pipelines/unofficial.yml
+++ b/azure-pipelines/unofficial.yml
@@ -57,7 +57,7 @@ extends:
   template: azure-pipelines/MicroBuild.1ES.Unofficial.yml@MicroBuildTemplate
   parameters:
     settings:
-      networkIsolationPolicy: Permissive,CFSClean2
+      networkIsolationPolicy: DefaultDeny,CFSClean3
     sdl:
       sourceAnalysisPool: VSEng-MicroBuildVSStable
       credscan:
diff --git a/azure-pipelines/vs-insertion.yml b/azure-pipelines/vs-insertion.yml
index 0f80fd599..9ee64bd69 100644
--- a/azure-pipelines/vs-insertion.yml
+++ b/azure-pipelines/vs-insertion.yml
@@ -23,7 +23,7 @@ extends:
   template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
   parameters:
     settings:
-      networkIsolationPolicy: Permissive,CFSClean2
+      networkIsolationPolicy: DefaultDeny,CFSClean3
     sdl:
       sourceAnalysisPool: VSEng-MicroBuildVSStable
       sbom:
diff --git a/azure-pipelines/vs-validation.yml b/azure-pipelines/vs-validation.yml
index 180c3eeeb..e184b9ff4 100644
--- a/azure-pipelines/vs-validation.yml
+++ b/azure-pipelines/vs-validation.yml
@@ -27,7 +27,7 @@ extends:
   template: azure-pipelines/MicroBuild.1ES.Unofficial.yml@MicroBuildTemplate
   parameters:
     settings:
-      networkIsolationPolicy: Permissive,CFSClean2
+      networkIsolationPolicy: DefaultDeny,CFSClean3
     sdl:
       sourceAnalysisPool: VSEng-MicroBuildVSStable
       credscan: