diff --git a/common/config/azure-pipelines/npm-publish-rush.yaml b/common/config/azure-pipelines/npm-publish-rush.yaml
index 2bf716b191..942b256ac7 100644
--- a/common/config/azure-pipelines/npm-publish-rush.yaml
+++ b/common/config/azure-pipelines/npm-publish-rush.yaml
@@ -29,12 +29,21 @@ resources:
       type: git
       name: 1ESPipelineTemplates/1ESPipelineTemplates
       ref: refs/tags/release
+    - repository: rushstackGitHubApp
+      type: github
+      name: microsoft/rushstack
+      endpoint: GitHubProjects
+      ref: refs/heads/main
 
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
   parameters:
     settings:
       networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3,DefaultDeny
+    sdl:
+      sourceRepositoriesToScan:
+        include:
+          - repository: rushstackGitHubApp
     pool:
       name: Azure-Pipelines-1ESPT-ExDShared
       os: windows
@@ -44,6 +53,7 @@ extends:
           VersionPolicyName: rush
           StageName: BumpRushVersions
           StageDisplayName: 'Bump Rush Versions and Create PR'
+          CheckoutRepository: rushstackGitHubApp
           FeatureBranch: 'automated/bump-versions-rush'
           PrTitle: 'Bump Rush package versions'
           PrDescription: |
diff --git a/common/config/azure-pipelines/npm-publish.yaml b/common/config/azure-pipelines/npm-publish.yaml
index 9b252348ab..7d59c64c23 100644
--- a/common/config/azure-pipelines/npm-publish.yaml
+++ b/common/config/azure-pipelines/npm-publish.yaml
@@ -29,12 +29,21 @@ resources:
       type: git
       name: 1ESPipelineTemplates/1ESPipelineTemplates
       ref: refs/tags/release
+    - repository: rushstackGitHubApp
+      type: github
+      name: microsoft/rushstack
+      endpoint: GitHubProjects
+      ref: refs/heads/main
 
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
   parameters:
     settings:
       networkIsolationPolicy: CFSClean,CFSClean2,CFSClean3,DefaultDeny
+    sdl:
+      sourceRepositoriesToScan:
+        include:
+          - repository: rushstackGitHubApp
     pool:
       name: Azure-Pipelines-1ESPT-ExDShared
       os: windows
@@ -44,6 +53,7 @@ extends:
           VersionPolicyName: noRush
           StageName: BumpRushstackVersions
           StageDisplayName: 'Bump Rushstack Versions and Create PR'
+          CheckoutRepository: rushstackGitHubApp
           FeatureBranch: 'automated/bump-versions-rushstack'
           PrTitle: 'Bump Rushstack package versions'
           PrDescription: |
diff --git a/common/config/azure-pipelines/templates/bump-versions-stages.yaml b/common/config/azure-pipelines/templates/bump-versions-stages.yaml
index 3dc1291c8c..cabc237130 100644
--- a/common/config/azure-pipelines/templates/bump-versions-stages.yaml
+++ b/common/config/azure-pipelines/templates/bump-versions-stages.yaml
@@ -12,6 +12,9 @@ parameters:
     type: string
   - name: StageDisplayName
     type: string
+  - name: CheckoutRepository
+    type: string
+    default: self
   - name: FeatureBranch
     type: string
   - name: PrTitle
@@ -50,12 +53,16 @@ stages:
               targetPath: $(Build.ArtifactStagingDirectory)/package-versions
               artifactName: package-versions
         steps:
-          - checkout: self
+          - checkout: ${{ parameters.CheckoutRepository }}
             persistCredentials: true
 
           - template: /common/config/azure-pipelines/templates/configure-git-user.yaml@self
 
           - bash: |
+              # Repository resources resolve independently from the self trigger. Restore the exact
+              # commit that selected this pipeline YAML before creating the automated branch.
+              git fetch --no-tags origin "$(Build.SourceVersion)"
+              git checkout --detach "$(Build.SourceVersion)"
               git checkout -b ${{ parameters.FeatureBranch }}
               echo "Created feature branch: ${{ parameters.FeatureBranch }}"
             displayName: 'Create Feature Branch'
@@ -85,6 +92,24 @@ stages:
               fi
             displayName: 'Commit Version Bumps'
 
+          - template: /common/config/azure-pipelines/templates/install-run-rush.yaml@self
+            parameters:
+              Arguments: >
+                change
+                --bulk
+                --bump-type none
+                --commit-message "chore: generate change files for version bump"
+              DisplayName: 'Generate change files'
+              Condition: "and(succeeded(), eq(variables.HasChanges, 'true'))"
+
+          - template: /common/config/azure-pipelines/templates/install-run-rush.yaml@self
+            parameters:
+              Arguments: >
+                change
+                --verify
+              DisplayName: 'Verify generated change files'
+              Condition: "and(succeeded(), eq(variables.HasChanges, 'true'))"
+
           - script: 'node libraries/rush-lib/scripts/plugins-prepublish.js'
             displayName: 'Prepublish workaround for rush-lib'