diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 8bbf7b07..6a88e0c5 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -26,7 +26,7 @@ jobs:
     # You can define any steps you want, and they will run before the agent starts.
     # If you do not check out your code, Copilot will do this for you.
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
         fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
     - name: ⚙ Install prerequisites
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 28313d12..adeffee4 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -24,7 +24,7 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
         fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
     - name: ⚙ Install prerequisites
diff --git a/.github/workflows/docs_validate.yml b/.github/workflows/docs_validate.yml
index d2f4690d..388391cd 100644
--- a/.github/workflows/docs_validate.yml
+++ b/.github/workflows/docs_validate.yml
@@ -13,7 +13,7 @@ jobs:
     name: 📚 Doc validation
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       with:
         fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
     - name: 🔗 Markup Link Checker (mlc)
diff --git a/.github/workflows/libtemplate-update.yml b/.github/workflows/libtemplate-update.yml
index f7d0b54e..800279bb 100644
--- a/.github/workflows/libtemplate-update.yml
+++ b/.github/workflows/libtemplate-update.yml
@@ -17,7 +17,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
       with:
         fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
 
diff --git a/Microsoft.VisualStudio.Threading.slnx b/Microsoft.VisualStudio.Threading.slnx
index 8542d76c..647f3cb9 100644
--- a/Microsoft.VisualStudio.Threading.slnx
+++ b/Microsoft.VisualStudio.Threading.slnx
@@ -44,9 +44,13 @@
     <File Path="test/Directory.Build.targets" />
     <File Path="test/dirs.proj" />
     <Project Path="samples/samples.csproj" />
-    <Project Path="test/IsolatedTestHost/IsolatedTestHost.csproj" />
+    <Project Path="test/IsolatedTestHost/IsolatedTestHost.csproj">
+      <Build Solution="*|NonWindows" Project="false" />
+    </Project>
     <Project Path="test/Microsoft.VisualStudio.Threading.Analyzers.Tests/Microsoft.VisualStudio.Threading.Analyzers.Tests.csproj" />
-    <Project Path="test/Microsoft.VisualStudio.Threading.Tests.Win7RegistryWatcher/Microsoft.VisualStudio.Threading.Tests.Win7RegistryWatcher.csproj" />
+    <Project Path="test/Microsoft.VisualStudio.Threading.Tests.Win7RegistryWatcher/Microsoft.VisualStudio.Threading.Tests.Win7RegistryWatcher.csproj">
+      <Build Solution="*|NonWindows" Project="false" />
+    </Project>
     <Project Path="test/Microsoft.VisualStudio.Threading.Tests/Microsoft.VisualStudio.Threading.Tests.csproj" />
     <Project Path="test/NativeAOTCompatibility.Test/NativeAOTCompatibility.Test.csproj" />
   </Folder>
diff --git a/azure-pipelines/archive-sourcecode.yml b/azure-pipelines/archive-sourcecode.yml
index 7f35de40..ee349e5b 100644
--- a/azure-pipelines/archive-sourcecode.yml
+++ b/azure-pipelines/archive-sourcecode.yml
@@ -38,7 +38,7 @@ extends:
     settings:
       networkIsolationPolicy: Permissive,CFSClean
     sdl:
-      sourceAnalysisPool: VSEngSS-MicroBuild2022-1ES
+      sourceAnalysisPool: VSEng-MicroBuildVSStable
 
     stages:
     - stage: archive
diff --git a/azure-pipelines/build.yml b/azure-pipelines/build.yml
index 76c848c5..64665929 100644
--- a/azure-pipelines/build.yml
+++ b/azure-pipelines/build.yml
@@ -98,15 +98,15 @@ parameters:
 - name: windowsPool
   type: object
   default:
-    vmImage: windows-2022
+    vmImage: windows-2025
 - name: linuxPool
   type: object
   default:
-    vmImage: ubuntu-22.04
+    vmImage: ubuntu-24.04
 - name: macOSPool
   type: object
   default:
-    vmImage: macOS-14
+    vmImage: macOS-15
 
 jobs:
 - job: Windows
diff --git a/azure-pipelines/official.yml b/azure-pipelines/official.yml
index 9fdb4bf2..2101010c 100644
--- a/azure-pipelines/official.yml
+++ b/azure-pipelines/official.yml
@@ -48,7 +48,7 @@ extends:
     settings:
       networkIsolationPolicy: Permissive,CFSClean
     sdl:
-      sourceAnalysisPool: VSEngSS-MicroBuild2022-1ES
+      sourceAnalysisPool: VSEng-MicroBuildVSStable
       codeSignValidation:
         enabled: true
         break: true
@@ -72,7 +72,7 @@ extends:
           RealSign: true
           ShouldSkipOptimize: ${{ parameters.ShouldSkipOptimize }}
           EnableAPIScan: ${{ parameters.EnableAPIScan }}
-          windowsPool: VSEngSS-MicroBuild2022-1ES
+          windowsPool: VSEng-MicroBuildVSStable
           linuxPool:
             name: AzurePipelines-EO
             demands:
@@ -80,7 +80,7 @@ extends:
             os: Linux
           macOSPool:
             name: Azure Pipelines
-            vmImage: macOS-14
+            vmImage: macOS-15
             os: macOS
           EnableMacOSBuild: ${{ parameters.EnableMacOSBuild }}
           RunTests: ${{ parameters.RunTests }}
diff --git a/azure-pipelines/prepare-insertion-stages.yml b/azure-pipelines/prepare-insertion-stages.yml
index 61a79661..3744cabc 100644
--- a/azure-pipelines/prepare-insertion-stages.yml
+++ b/azure-pipelines/prepare-insertion-stages.yml
@@ -17,7 +17,7 @@ stages:
     - ${{ if parameters.ArchiveSymbols }}:
       - job: symbol_archive
         displayName: Archive symbols
-        pool: VSEngSS-MicroBuild2022-1ES
+        pool: VSEng-MicroBuildVSStable
         variables:
           ONEES_ENFORCED_CODEQL_ENABLED: false # CodeQL runs on build stages, we don't need it here
         steps:
diff --git a/azure-pipelines/release.yml b/azure-pipelines/release.yml
index 915908a1..332ed419 100644
--- a/azure-pipelines/release.yml
+++ b/azure-pipelines/release.yml
@@ -23,7 +23,7 @@ extends:
     settings:
       networkIsolationPolicy: Permissive,CFSClean
     sdl:
-      sourceAnalysisPool: VSEngSS-MicroBuild2022-1ES
+      sourceAnalysisPool: VSEng-MicroBuildVSStable
 
     stages:
     - stage: release
diff --git a/azure-pipelines/unofficial.yml b/azure-pipelines/unofficial.yml
index 887ddceb..1b28375c 100644
--- a/azure-pipelines/unofficial.yml
+++ b/azure-pipelines/unofficial.yml
@@ -59,7 +59,7 @@ extends:
     settings:
       networkIsolationPolicy: Permissive,CFSClean
     sdl:
-      sourceAnalysisPool: VSEngSS-MicroBuild2022-1ES
+      sourceAnalysisPool: VSEng-MicroBuildVSStable
       credscan:
         enabled: false
       suppression:
@@ -86,7 +86,7 @@ extends:
           RealSign: false
           ShouldSkipOptimize: ${{ parameters.ShouldSkipOptimize }}
           EnableAPIScan: ${{ parameters.EnableAPIScan }}
-          windowsPool: VSEngSS-MicroBuild2022-1ES
+          windowsPool: VSEng-MicroBuildVSStable
           linuxPool:
             name: AzurePipelines-EO
             demands:
@@ -94,7 +94,7 @@ extends:
             os: Linux
           macOSPool:
             name: Azure Pipelines
-            vmImage: macOS-14
+            vmImage: macOS-15
             os: macOS
           EnableMacOSBuild: ${{ parameters.EnableMacOSBuild }}
           RunTests: ${{ parameters.RunTests }}
diff --git a/azure-pipelines/vs-insertion.yml b/azure-pipelines/vs-insertion.yml
index 2c6c6dc8..ffe0d83f 100644
--- a/azure-pipelines/vs-insertion.yml
+++ b/azure-pipelines/vs-insertion.yml
@@ -25,14 +25,16 @@ extends:
     settings:
       networkIsolationPolicy: Permissive,CFSClean
     sdl:
-      sourceAnalysisPool: VSEngSS-MicroBuild2022-1ES
+      sourceAnalysisPool: VSEng-MicroBuildVSStable
+    sbom:
+      enabled: false
 
     stages:
     - stage: insertion
       jobs:
       - job: insertion
         displayName: VS insertion
-        pool: VSEngSS-MicroBuild2022-1ES
+        pool: VSEng-MicroBuildVSStable
         templateContext:
           outputParentDirectory: $(Pipeline.Workspace)/CI
         steps:
diff --git a/azure-pipelines/vs-validation.yml b/azure-pipelines/vs-validation.yml
index 5098b9c9..e2c90d21 100644
--- a/azure-pipelines/vs-validation.yml
+++ b/azure-pipelines/vs-validation.yml
@@ -29,7 +29,7 @@ extends:
     settings:
       networkIsolationPolicy: Permissive,CFSClean
     sdl:
-      sourceAnalysisPool: VSEngSS-MicroBuild2022-1ES
+      sourceAnalysisPool: VSEng-MicroBuildVSStable
       credscan:
         enabled: false
 
@@ -46,7 +46,7 @@ extends:
           Is1ESPT: true
           RealSign: false
           ShouldSkipOptimize: ${{ parameters.ShouldSkipOptimize }}
-          windowsPool: VSEngSS-MicroBuild2022-1ES
+          windowsPool: VSEng-MicroBuildVSStable
           linuxPool:
             name: AzurePipelines-EO
             demands:
@@ -54,7 +54,7 @@ extends:
             os: Linux
           macOSPool:
             name: Azure Pipelines
-            vmImage: macOS-14
+            vmImage: macOS-15
             os: macOS
           EnableMacOSBuild: false
           RunTests: false
@@ -70,7 +70,7 @@ extends:
       jobs:
       - job: insertion
         displayName: VS insertion
-        pool: VSEngSS-MicroBuild2022-1ES
+        pool: VSEng-MicroBuildVSStable
         steps:
         - checkout: self
           clean: true
diff --git a/tools/dotnet-test-cloud.ps1 b/tools/dotnet-test-cloud.ps1
index 02891d97..51919726 100644
--- a/tools/dotnet-test-cloud.ps1
+++ b/tools/dotnet-test-cloud.ps1
@@ -47,6 +47,11 @@ if ($x86) {
 $testBinLog = Join-Path $ArtifactStagingFolder (Join-Path build_logs test.binlog)
 $testDiagLog = Join-Path $ArtifactStagingFolder (Join-Path test_logs diag.log)
 
+$extraArgs = @()
+if ($IsLinux -or $IsMacOS) {
+    $extraArgs += '-p:Platform=NonWindows'
+}
+
 & $dotnet test $RepoRoot `
     --no-build `
     -c $Configuration `
@@ -58,6 +63,7 @@ $testDiagLog = Join-Path $ArtifactStagingFolder (Join-Path test_logs diag.log)
     -bl:"$testBinLog" `
     --diag "$testDiagLog;TraceLevel=info" `
     --logger trx `
+    @extraArgs `
 
 $unknownCounter = 0
 Get-ChildItem -Recurse -Path $RepoRoot\test\*.trx |% {