diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
index 7cbd1219..f1682186 100644
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@@ -3,9 +3,9 @@
   <ProductDependencies>
   </ProductDependencies>
   <ToolsetDependencies>
-    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="11.0.0-beta.26310.1">
+    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="11.0.0-beta.26360.7">
       <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>0a80b038bcc0d76b2f26c7f22062942de75779e6</Sha>
+      <Sha>3169db01948537e61a9102477fab4a39663ba79d</Sha>
     </Dependency>
   </ToolsetDependencies>
 </Dependencies>
diff --git a/eng/common/SetupNugetSources.ps1 b/eng/common/SetupNugetSources.ps1
index 58002808..b3bddff3 100644
--- a/eng/common/SetupNugetSources.ps1
+++ b/eng/common/SetupNugetSources.ps1
@@ -13,7 +13,11 @@
 #      filePath: $(System.DefaultWorkingDirectory)/eng/common/SetupNugetSources.ps1
 #      arguments: -ConfigFile $(System.DefaultWorkingDirectory)/NuGet.config -Password $Env:Token
 #    env:
-#      Token: $(dn-bot-dnceng-artifact-feeds-rw)
+#      Token: $(InternalFeedToken)
+#
+# Note: This logic is abstracted into enable-internal-sources.yml, which uses
+# NuGetAuthenticate or a WIF-backed service connection. Prefer that template
+# over calling this script directly.
 #
 # Note that the NuGetAuthenticate task should be called after SetupNugetSources.
 # This ensures that:
diff --git a/eng/common/build.ps1 b/eng/common/build.ps1
index 4b4f6b09..2cbb7253 100644
--- a/eng/common/build.ps1
+++ b/eng/common/build.ps1
@@ -173,7 +173,11 @@ try {
     if (-not $excludeCIBinarylog) {
       $binaryLog = $true
     }
-    $nodeReuse = $false
+    # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED.
+    # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on.
+    if ($env:MSBUILD_NODEREUSE_ENABLED -ne "1") {
+      $nodeReuse = $false
+    }
   }
 
   if (-not [string]::IsNullOrEmpty($binaryLogName)) {
diff --git a/eng/common/build.sh b/eng/common/build.sh
index 719ee4b5..3a9fdcfd 100755
--- a/eng/common/build.sh
+++ b/eng/common/build.sh
@@ -213,7 +213,11 @@ if [[ -z "$configuration" ]]; then
 fi
 
 if [[ "$ci" == true ]]; then
-  node_reuse=false
+  # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED.
+  # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on.
+  if [[ "${MSBUILD_NODEREUSE_ENABLED:-}" != "1" ]]; then
+    node_reuse=false
+  fi
   if [[ "$exclude_ci_binary_log" == false ]]; then
     binary_log=true
   fi
diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml
index a8162c51..96287e55 100644
--- a/eng/common/core-templates/job/helix-job-monitor.yml
+++ b/eng/common/core-templates/job/helix-job-monitor.yml
@@ -57,6 +57,14 @@ parameters:
   type: number
   default: 30
 
+# When 'true' (the default), Helix work items that exit 0 but have failed AzDO test results
+# are treated as failed: they count toward the monitor's exit code and are resubmitted by a
+# later invocation's retry pass. Set to 'false' to fall back to exit-code-only outcomes.
+# Forwarded as --fail-on-failed-tests.
+- name: failWorkItemsWithFailedTests
+  type: boolean
+  default: true
+
 # Advanced: optional pipeline artifact (produced earlier in this run) that contains the tool
 # nupkg. When set, the artifact is downloaded and the tool is installed from the nupkg into
 # a local tool-path; this bypasses the repo's .config/dotnet-tools.json manifest and is
@@ -170,6 +178,7 @@ jobs:
       toolArgs=(
         --helix-base-uri           '${{ parameters.helixBaseUri }}'
         --polling-interval-seconds '${{ parameters.pollingIntervalSeconds }}'
+        --fail-on-failed-tests     '${{ parameters.failWorkItemsWithFailedTests }}'
         --max-wait-minutes         "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully.
         --stage-name               '$(System.StageName)'
       )
diff --git a/eng/common/core-templates/job/publish-build-assets.yml b/eng/common/core-templates/job/publish-build-assets.yml
index 700f7711..4229288d 100644
--- a/eng/common/core-templates/job/publish-build-assets.yml
+++ b/eng/common/core-templates/job/publish-build-assets.yml
@@ -122,9 +122,6 @@ jobs:
 
     # Populate internal runtime variables.
     - template: /eng/common/templates/steps/enable-internal-sources.yml
-      ${{ if eq(variables['System.TeamProject'], 'DevDiv') }}:
-        parameters:
-            legacyCredential: $(dn-bot-dnceng-artifact-feeds-rw)
 
     - template: /eng/common/templates/steps/enable-internal-runtimes.yml
 
diff --git a/eng/common/core-templates/post-build/post-build.yml b/eng/common/core-templates/post-build/post-build.yml
index 8aa86e30..9d951352 100644
--- a/eng/common/core-templates/post-build/post-build.yml
+++ b/eng/common/core-templates/post-build/post-build.yml
@@ -295,8 +295,6 @@ stages:
 
       # Populate internal runtime variables.
       - template: /eng/common/templates/steps/enable-internal-sources.yml
-        parameters:
-          legacyCredential: $(dn-bot-dnceng-artifact-feeds-rw)
 
       - template: /eng/common/templates/steps/enable-internal-runtimes.yml
 
diff --git a/eng/common/core-templates/steps/send-to-helix.yml b/eng/common/core-templates/steps/send-to-helix.yml
index 68fa739c..ec7a2000 100644
--- a/eng/common/core-templates/steps/send-to-helix.yml
+++ b/eng/common/core-templates/steps/send-to-helix.yml
@@ -10,6 +10,7 @@ parameters:
   HelixConfiguration: ''                 # optional -- additional property attached to a job
   HelixPreCommands: ''                   # optional -- commands to run before Helix work item execution
   HelixPostCommands: ''                  # optional -- commands to run after Helix work item execution
+  UseHelixMonitor: false                 # optional -- true will submit Helix jobs configured for the standalone Helix Job Monitor (results are reported/waited on out-of-band; this step will not wait, and WaitForWorkItemCompletion will be overridden)
   WorkItemDirectory: ''                  # optional -- a payload directory to zip up and send to Helix; requires WorkItemCommand; incompatible with XUnitProjects
   WorkItemCommand: ''                    # optional -- a command to execute on the payload; requires WorkItemDirectory; incompatible with XUnitProjects
   WorkItemTimeout: ''                    # optional -- a timeout in TimeSpan.Parse-ready value (e.g. 00:02:00) for the work item command; requires WorkItemDirectory; incompatible with XUnitProjects
@@ -31,7 +32,15 @@ parameters:
   continueOnError: false                 # optional -- determines whether to continue the build if the step errors; defaults to false
 
 steps:
-  - powershell: 'powershell "$env:BUILD_SOURCESDIRECTORY\eng\common\msbuild.ps1 $env:BUILD_SOURCESDIRECTORY/${{ parameters.HelixProjectPath }} /restore /p:TreatWarningsAsErrors=false ${{ parameters.HelixProjectArguments }} /t:Test /bl:$env:BUILD_SOURCESDIRECTORY\artifacts\log\$env:BuildConfig\SendToHelix.binlog"'
+  - powershell: >
+      $(Build.SourcesDirectory)\eng\common\msbuild.ps1
+      $(Build.SourcesDirectory)/${{ parameters.HelixProjectPath }}
+      /restore
+      /p:TreatWarningsAsErrors=false
+      /p:EnableHelixJobMonitor=${{ parameters.UseHelixMonitor }}
+      ${{ parameters.HelixProjectArguments }}
+      /t:Test
+      /bl:$(Build.SourcesDirectory)/artifacts/log/$(_BuildConfig)/SendToHelix.binlog
     displayName: ${{ parameters.DisplayNamePrefix }} (Windows)
     env:
       BuildConfig: $(_BuildConfig)
@@ -61,7 +70,15 @@ steps:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
     condition: and(${{ parameters.condition }}, eq(variables['Agent.Os'], 'Windows_NT'))
     continueOnError: ${{ parameters.continueOnError }}
-  - script: $BUILD_SOURCESDIRECTORY/eng/common/msbuild.sh $BUILD_SOURCESDIRECTORY/${{ parameters.HelixProjectPath }} /restore /p:TreatWarningsAsErrors=false ${{ parameters.HelixProjectArguments }} /t:Test /bl:$BUILD_SOURCESDIRECTORY/artifacts/log/$BuildConfig/SendToHelix.binlog
+  - script: >
+      $(Build.SourcesDirectory)/eng/common/msbuild.sh
+      $(Build.SourcesDirectory)/${{ parameters.HelixProjectPath }}
+      /restore
+      /p:TreatWarningsAsErrors=false
+      /p:EnableHelixJobMonitor=${{ parameters.UseHelixMonitor }}
+      ${{ parameters.HelixProjectArguments }}
+      /t:Test
+      /bl:$(Build.SourcesDirectory)/artifacts/log/$(_BuildConfig)/SendToHelix.binlog
     displayName: ${{ parameters.DisplayNamePrefix }} (Unix)
     env:
       BuildConfig: $(_BuildConfig)
@@ -91,3 +108,4 @@ steps:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
     condition: and(${{ parameters.condition }}, ne(variables['Agent.Os'], 'Windows_NT'))
     continueOnError: ${{ parameters.continueOnError }}
+
diff --git a/eng/common/cross/build-rootfs.sh b/eng/common/cross/build-rootfs.sh
index 273cae65..453bb1ba 100644
--- a/eng/common/cross/build-rootfs.sh
+++ b/eng/common/cross/build-rootfs.sh
@@ -18,7 +18,10 @@ usage()
     echo "--skipsigcheck - optional, will skip package signature checks (allowing untrusted packages)."
     echo "--skipemulation - optional, will skip qemu and debootstrap requirement when building environment for debian based systems."
     echo "--use-mirror - optional, use mirror URL to fetch resources, when available."
-    echo "--jobs N - optional, restrict to N jobs."
+    echo "--ubuntu-repo <url> - optional, override the Ubuntu apt repository base URL."
+    echo "--debian-repo <url> - optional, override the Debian apt repository base URL."
+    echo "--alpine-repo <url> - optional, override the Alpine Linux repository base URL."
+    echo "--jobs N (or --use-jobs N) - optional, restrict to N jobs."
     exit 1
 }
 
@@ -88,8 +91,9 @@ __FreeBSDPackages+=" terminfo-db"
 __OpenBSDVersion="7.8"
 __OpenBSDPackages="heimdal-libs"
 __OpenBSDPackages+=" icu4c"
-__OpenBSDPackages+=" inotify-tools"
+__OpenBSDPackages+=" libinotify"
 __OpenBSDPackages+=" openssl"
+__OpenBSDPackages+=" e2fsprogs"
 
 __IllumosPackages="icu"
 __IllumosPackages+=" mit-krb5"
@@ -143,6 +147,9 @@ __KeyringFile="/usr/share/keyrings/ubuntu-archive-keyring.gpg"
 __SkipSigCheck=0
 __SkipEmulation=0
 __UseMirror=0
+__UbuntuRepoOverride=
+__DebianRepoOverride=
+__AlpineRepoOverride=
 
 __UnprocessedBuildArgs=
 while :; do
@@ -396,6 +403,31 @@ while :; do
         --use-mirror)
             __UseMirror=1
             ;;
+        --ubuntu-repo|-ubuntu-repo)
+            shift
+            if [[ "$#" -le 0 ]]; then
+                echo "ERROR: --ubuntu-repo requires a URL argument."
+                usage
+            fi
+            __UbuntuRepoOverride="$1"
+            ;;
+        --debian-repo|-debian-repo)
+            shift
+            if [[ "$#" -le 0 ]]; then
+                echo "ERROR: --debian-repo requires a URL argument."
+                usage
+            fi
+            __DebianRepoOverride="$1"
+            ;;
+        --alpine-repo|-alpine-repo)
+            shift
+            if [[ "$#" -le 0 ]]; then
+                echo "ERROR: --alpine-repo requires a URL argument."
+                usage
+            fi
+            __AlpineRepoOverride="$1"
+            ;;
+        # Removed duplicate/invalid option handling block (was breaking case statement parsing).
         --use-jobs)
             shift
             MAXJOBS=$1
@@ -445,6 +477,12 @@ if [[ -z "$__UbuntuRepo" ]]; then
     __UbuntuRepo="https://ports.ubuntu.com/"
 fi
 
+if [[ -n "$__UbuntuRepoOverride" && "$__KeyringFile" == *ubuntu* ]]; then
+    __UbuntuRepo="$__UbuntuRepoOverride"
+elif [[ -n "$__DebianRepoOverride" && "$__KeyringFile" == *debian* ]]; then
+    __UbuntuRepo="$__DebianRepoOverride"
+fi
+
 if [[ -n "$__LLVM_MajorVersion" ]]; then
     __UbuntuPackages+=" libclang-common-${__LLVM_MajorVersion}${__LLVM_MinorVersion:+.$__LLVM_MinorVersion}-dev"
 fi
@@ -485,6 +523,7 @@ if [[ "$__CodeName" == "alpine" ]]; then
     __ApkToolsDir="$(mktemp -d)"
     __ApkKeysDir="$(mktemp -d)"
     arch="$(uname -m)"
+    __AlpineRepo="${__AlpineRepoOverride:-https://dl-cdn.alpinelinux.org/alpine}"
 
     ensureDownloadTool
 
@@ -529,15 +568,15 @@ if [[ "$__CodeName" == "alpine" ]]; then
     # initialize DB
     # shellcheck disable=SC2086
     "$__ApkToolsDir/apk.static" \
-        -X "https://dl-cdn.alpinelinux.org/alpine/$version/main" \
-        -X "https://dl-cdn.alpinelinux.org/alpine/$version/community" \
+        -X "$__AlpineRepo/$version/main" \
+        -X "$__AlpineRepo/$version/community" \
         -U $__ApkSignatureArg --root "$__RootfsDir" --arch "$__AlpineArch" --initdb add
 
     if [[ "$__AlpineLlvmLibsLookup" == 1 ]]; then
         # shellcheck disable=SC2086
         __AlpinePackages+=" $("$__ApkToolsDir/apk.static" \
-            -X "https://dl-cdn.alpinelinux.org/alpine/$version/main" \
-            -X "https://dl-cdn.alpinelinux.org/alpine/$version/community" \
+            -X "$__AlpineRepo/$version/main" \
+            -X "$__AlpineRepo/$version/community" \
             -U $__ApkSignatureArg --root "$__RootfsDir" --arch "$__AlpineArch" \
             search 'llvm*-libs' | grep -E '^llvm' | sort | tail -1 | sed 's/-[^-]*//2g')"
     fi
@@ -545,8 +584,8 @@ if [[ "$__CodeName" == "alpine" ]]; then
     # install all packages in one go
     # shellcheck disable=SC2086
     "$__ApkToolsDir/apk.static" \
-        -X "https://dl-cdn.alpinelinux.org/alpine/$version/main" \
-        -X "https://dl-cdn.alpinelinux.org/alpine/$version/community" \
+        -X "$__AlpineRepo/$version/main" \
+        -X "$__AlpineRepo/$version/community" \
         -U $__ApkSignatureArg --root "$__RootfsDir" --arch "$__AlpineArch" $__NoEmulationArg \
         add $__AlpinePackages
 
diff --git a/eng/common/cross/install-debs.py b/eng/common/cross/install-debs.py
index 20ca770a..1d1dfabf 100644
--- a/eng/common/cross/install-debs.py
+++ b/eng/common/cross/install-debs.py
@@ -121,10 +121,14 @@ async def fetch_release_file(session, mirror, suite, keyring):
         await download_file(session, release_gpg_url, release_gpg_file.name)
 
         print("Verifying signature of Release with Release.gpg.")
-        verify_command = ["gpg"]
+        # Use gpgv rather than gpg for verification. gpgv verifies a detached
+        # signature against a fixed keyring without involving gpg-agent or
+        # keyboxd, which makes it robust on hosts running GnuPG 2.4+ (e.g. Azure
+        # Linux) where "gpg --keyring" routes through keyboxd and can fail.
+        verify_command = ["gpgv"]
         if keyring:
             verify_command += ["--keyring", keyring]
-        verify_command += ["--verify", release_gpg_file.name, release_file.name]
+        verify_command += [release_gpg_file.name, release_file.name]
         result = subprocess.run(verify_command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
 
         if result.returncode != 0:
diff --git a/eng/common/cross/toolchain.cmake b/eng/common/cross/toolchain.cmake
index 99d6dfe8..ead7fe3e 100644
--- a/eng/common/cross/toolchain.cmake
+++ b/eng/common/cross/toolchain.cmake
@@ -59,9 +59,9 @@ elseif(TARGET_ARCH_NAME STREQUAL "arm64")
       set(TIZEN_TOOLCHAIN "aarch64-tizen-linux-gnu")
     endif()
   elseif(FREEBSD)
-    set(triple "aarch64-unknown-freebsd12")
+    set(TOOLCHAIN "aarch64-unknown-freebsd14")
   elseif(OPENBSD)
-    set(triple "aarch64-unknown-openbsd")
+    set(TOOLCHAIN "aarch64-unknown-openbsd")
   endif()
 elseif(TARGET_ARCH_NAME STREQUAL "armel")
   set(CMAKE_SYSTEM_PROCESSOR armv7l)
@@ -117,9 +117,9 @@ elseif(TARGET_ARCH_NAME STREQUAL "x64")
       set(TIZEN_TOOLCHAIN "x86_64-tizen-linux-gnu")
     endif()
   elseif(FREEBSD)
-    set(triple "x86_64-unknown-freebsd12")
+    set(TOOLCHAIN "x86_64-unknown-freebsd14")
   elseif(OPENBSD)
-    set(triple "x86_64-unknown-openbsd")
+    set(TOOLCHAIN "x86_64-unknown-openbsd")
   elseif(ILLUMOS)
     set(TOOLCHAIN "x86_64-illumos")
   elseif(HAIKU)
@@ -160,8 +160,6 @@ if(TIZEN)
     find_toolchain_dir("${CROSS_ROOTFS}/usr/lib64/gcc/${TIZEN_TOOLCHAIN}")
   endif()
 
-  message(STATUS "TIZEN_TOOLCHAIN_PATH set to: ${TIZEN_TOOLCHAIN_PATH}")
-
   include_directories(SYSTEM ${TIZEN_TOOLCHAIN_PATH}/include/c++)
   include_directories(SYSTEM ${TIZEN_TOOLCHAIN_PATH}/include/c++/${TIZEN_TOOLCHAIN})
 endif()
@@ -206,9 +204,9 @@ if(ANDROID)
     include(${CROSS_ROOTFS}/../build/cmake/android.toolchain.cmake)
 elseif(FREEBSD OR OPENBSD)
     # we cross-compile by instructing clang
-    set(CMAKE_C_COMPILER_TARGET ${triple})
-    set(CMAKE_CXX_COMPILER_TARGET ${triple})
-    set(CMAKE_ASM_COMPILER_TARGET ${triple})
+    set(CMAKE_C_COMPILER_TARGET ${TOOLCHAIN})
+    set(CMAKE_CXX_COMPILER_TARGET ${TOOLCHAIN})
+    set(CMAKE_ASM_COMPILER_TARGET ${TOOLCHAIN})
     set(CMAKE_SYSROOT "${CROSS_ROOTFS}")
     set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fuse-ld=lld")
     set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -fuse-ld=lld")
diff --git a/eng/common/dotnet-install.ps1 b/eng/common/dotnet-install.ps1
index 50ae6273..b6d45f2b 100644
--- a/eng/common/dotnet-install.ps1
+++ b/eng/common/dotnet-install.ps1
@@ -4,13 +4,16 @@ Param(
   [string] $architecture = '',
   [string] $version = 'Latest',
   [string] $runtime = 'dotnet',
+  [string] $dotnetPath = '',
   [string] $RuntimeSourceFeed = '',
   [string] $RuntimeSourceFeedKey = ''
 )
 
 . $PSScriptRoot\tools.ps1
 
-if (-not [string]::IsNullOrEmpty($env:DOTNET_GLOBAL_INSTALL_DIR)) {
+if (-not [string]::IsNullOrEmpty($dotnetPath)) {
+  $dotnetRoot = $dotnetPath
+} elseif (-not [string]::IsNullOrEmpty($env:DOTNET_GLOBAL_INSTALL_DIR)) {
   $dotnetRoot = $env:DOTNET_GLOBAL_INSTALL_DIR
 } else {
   $dotnetRoot = Join-Path $RepoRoot '.dotnet'
diff --git a/eng/common/dotnet-install.sh b/eng/common/dotnet-install.sh
index 1cb3f5ab..58a7e6f3 100644
--- a/eng/common/dotnet-install.sh
+++ b/eng/common/dotnet-install.sh
@@ -16,6 +16,7 @@ scriptroot="$( cd -P "$( dirname "$source" )" && pwd )"
 version='Latest'
 architecture=''
 runtime='dotnet'
+dotnetPath=''
 runtimeSourceFeed=''
 runtimeSourceFeedKey=''
 while [[ $# -gt 0 ]]; do
@@ -33,6 +34,10 @@ while [[ $# -gt 0 ]]; do
       shift
       runtime="$1"
       ;;
+    -dotnetpath)
+      shift
+      dotnetPath="$1"
+      ;;
     -runtimesourcefeed)
       shift
       runtimeSourceFeed="$1"
@@ -80,7 +85,9 @@ case $cpuname in
     ;;
 esac
 
-if [[ -n "${DOTNET_GLOBAL_INSTALL_DIR:-}" ]]; then
+if [[ -n "${dotnetPath:-}" ]]; then
+  dotnetRoot="$dotnetPath"
+elif [[ -n "${DOTNET_GLOBAL_INSTALL_DIR:-}" ]]; then
   dotnetRoot="$DOTNET_GLOBAL_INSTALL_DIR"
 else
   dotnetRoot="${repo_root}.dotnet"
diff --git a/eng/common/dotnet.ps1 b/eng/common/dotnet.ps1
index 45e5676c..ce4ea407 100644
--- a/eng/common/dotnet.ps1
+++ b/eng/common/dotnet.ps1
@@ -8,4 +8,5 @@ $dotnetRoot = InitializeDotNetCli -install:$true
 if ($args.count -gt 0) {
   $env:DOTNET_NOLOGO=1
   & "$dotnetRoot\dotnet.exe" $args
+  ExitWithExitCode $LASTEXITCODE
 }
diff --git a/eng/common/msbuild.ps1 b/eng/common/msbuild.ps1
index f041e5dd..495d533a 100644
--- a/eng/common/msbuild.ps1
+++ b/eng/common/msbuild.ps1
@@ -14,7 +14,11 @@ Param(
 
 try {
   if ($ci) {
-    $nodeReuse = $false
+    # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED.
+    # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on.
+    if ($env:MSBUILD_NODEREUSE_ENABLED -ne "1") {
+      $nodeReuse = $false
+    }
   }
 
   MSBuild @extraArgs
diff --git a/eng/common/msbuild.sh b/eng/common/msbuild.sh
index 20d3dad5..333be323 100644
--- a/eng/common/msbuild.sh
+++ b/eng/common/msbuild.sh
@@ -51,7 +51,11 @@ done
 . "$scriptroot/tools.sh"
 
 if [[ "$ci" == true ]]; then
-  node_reuse=false
+  # Disable node reuse on CI unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED.
+  # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on.
+  if [[ "${MSBUILD_NODEREUSE_ENABLED:-}" != "1" ]]; then
+    node_reuse=false
+  fi
 fi
 
 MSBuild $extra_args
diff --git a/eng/common/native/NativeAotSupported.props b/eng/common/native/NativeAotSupported.props
new file mode 100644
index 00000000..cdff9ef0
--- /dev/null
+++ b/eng/common/native/NativeAotSupported.props
@@ -0,0 +1,28 @@
+<Project>
+  <PropertyGroup>
+
+    <!-- Reject unsupported OS via RID prefix match -->
+    <_NativeAotSupportedOS Condition="
+      '$(TargetOS)' != 'browser' and
+      '$(TargetOS)' != 'haiku' and
+      '$(TargetOS)' != 'illumos' and
+      '$(TargetOS)' != 'netbsd' and
+      '$(TargetOS)' != 'solaris'
+    ">true</_NativeAotSupportedOS>
+
+    <!-- Reject unsupported architectures via RID suffix match -->
+    <_NativeAotSupportedArch Condition="
+      '$(TargetArchitecture)' != 'wasm' and
+      '$(TargetArchitecture)' != 's390x' and
+      '$(TargetArchitecture)' != 'ppc64le' and
+      ('$(TargetArchitecture)' != 'x86' or '$(TargetOS)' == 'windows')
+    ">true</_NativeAotSupportedArch>
+
+    <NativeAotSupported Condition="
+      '$(NativeAotSupported)' == '' and
+      '$(_NativeAotSupportedOS)' == 'true' and
+      '$(_NativeAotSupportedArch)' == 'true'
+    ">true</NativeAotSupported>
+
+  </PropertyGroup>
+</Project>
diff --git a/eng/common/tools.ps1 b/eng/common/tools.ps1
index fc72fe63..6f664ad8 100644
--- a/eng/common/tools.ps1
+++ b/eng/common/tools.ps1
@@ -432,11 +432,31 @@ function InitializeVisualStudioMSBuild([object]$vsRequirements = $null) {
   $msbuildVersionDir = if ([int]$vsMajorVersion -lt 16) { "$vsMajorVersion.0" } else { "Current" }
 
   $local:BinFolder = Join-Path $vsInstallDir "MSBuild\$msbuildVersionDir\Bin"
-  $local:Prefer64bit = if (Get-Member -InputObject $vsRequirements -Name 'Prefer64bit') { $vsRequirements.Prefer64bit } else { $false }
-  if ($local:Prefer64bit -and (Test-Path(Join-Path $local:BinFolder "amd64"))) {
-    $global:_MSBuildExe = Join-Path $local:BinFolder "amd64\msbuild.exe"
-  } else {
-    $global:_MSBuildExe = Join-Path $local:BinFolder "msbuild.exe"
+
+  # Use the MSBuild matching the host's process architecture (e.g. amd64 or arm64),
+  # falling back to the 32-bit MSBuild in the root Bin folder when no matching subfolder exists.
+
+  # Determine the architecture of the current process, accounting for a 32-bit process
+  # running on a 64-bit OS (PROCESSOR_ARCHITEW6432 holds the real machine architecture).
+  $local:ProcessArchitecture = $env:PROCESSOR_ARCHITECTURE
+  if (($local:ProcessArchitecture -eq 'x86') -and ($env:PROCESSOR_ARCHITEW6432)) {
+    $local:ProcessArchitecture = $env:PROCESSOR_ARCHITEW6432
+  }
+
+  # Map the architecture to the corresponding MSBuild subfolder. The 32-bit MSBuild lives in the
+  # root Bin folder, so x86 maps to an empty subfolder.
+  $local:MSBuildArchSubFolder = switch ($local:ProcessArchitecture) {
+    'AMD64' { 'amd64' }
+    'ARM64' { 'arm64' }
+    default { '' }
+  }
+
+  $global:_MSBuildExe = Join-Path $local:BinFolder "msbuild.exe"
+  if ($local:MSBuildArchSubFolder) {
+    $local:ArchMSBuildExe = Join-Path $local:BinFolder (Join-Path $local:MSBuildArchSubFolder "msbuild.exe")
+    if (Test-Path $local:ArchMSBuildExe) {
+      $global:_MSBuildExe = $local:ArchMSBuildExe
+    }
   }
 
   return $global:_MSBuildExe
@@ -531,6 +551,16 @@ function LocateVisualStudio([object]$vsRequirements = $null){
 }
 
 function InitializeBuildTool() {
+  # Allow a caller (e.g. a bootstrap script running out-of-proc) to inject the build tool via
+  # environment variables instead of the in-proc $global:_BuildTool variable. Only Path and
+  # Command are consumed by the MSBuild function below, so those are all that's needed.
+  if ($env:_BuildToolPath) {
+    return $global:_BuildTool = @{
+      Path    = $env:_BuildToolPath
+      Command = $env:_BuildToolCommand
+    }
+  }
+
   if (Test-Path variable:global:_BuildTool) {
     # If the requested msbuild parameters do not match, clear the cached variables.
     if($global:_BuildTool.Contains('ExcludePrereleaseVS') -and $global:_BuildTool.ExcludePrereleaseVS -ne $excludePrereleaseVS) {
@@ -558,7 +588,7 @@ function InitializeBuildTool() {
     }
     $dotnetPath = Join-Path $dotnetRoot (GetExecutableFileName 'dotnet')
 
-    $buildTool = @{ Path = $dotnetPath; Command = 'msbuild'; Tool = 'dotnet'; Framework = 'net' }
+    $buildTool = @{ Path = $dotnetPath; Command = 'msbuild' }
   } elseif ($msbuildEngine -eq "vs") {
     try {
       $msbuildPath = InitializeVisualStudioMSBuild
@@ -567,7 +597,7 @@ function InitializeBuildTool() {
       ExitWithExitCode 1
     }
 
-    $buildTool = @{ Path = $msbuildPath; Command = ""; Tool = "vs"; Framework = "netframework"; ExcludePrereleaseVS = $excludePrereleaseVS }
+    $buildTool = @{ Path = $msbuildPath; Command = ""; ExcludePrereleaseVS = $excludePrereleaseVS }
   } else {
     Write-PipelineTelemetryError -Category 'InitializeToolset' -Message "Unexpected value of -msbuildEngine: '$msbuildEngine'."
     ExitWithExitCode 1
@@ -706,7 +736,7 @@ function InitializeToolset() {
 }
 
 function ExitWithExitCode([int] $exitCode) {
-  if ($ci -and $prepareMachine) {
+  if ($prepareMachine) {
     Stop-Processes
   }
   exit $exitCode
@@ -741,11 +771,6 @@ function MSBuild() {
       Write-PipelineTelemetryError -Category 'Build' -Message 'Binary log must be enabled in CI build, or explicitly opted-out from with the -excludeCIBinarylog switch.'
       ExitWithExitCode 1
     }
-
-    if ($nodeReuse) {
-      Write-PipelineTelemetryError -Category 'Build' -Message 'Node reuse must be disabled in CI build.'
-      ExitWithExitCode 1
-    }
   }
 
   $buildTool = InitializeBuildTool
@@ -787,11 +812,6 @@ function MSBuild() {
     # The build already logged an error, that's the reason it failed. Producing an error here only adds noise.
     Write-Host "Build failed with exit code $exitCode. Check errors above." -ForegroundColor Red
 
-    $buildLog = GetMSBuildBinaryLogCommandLineArgument $args
-    if ($null -ne $buildLog) {
-      Write-Host "See log: $buildLog" -ForegroundColor DarkGray
-    }
-
     # When running on Azure Pipelines, override the returned exit code to avoid double logging.
     # Skip this when the build is a child of the VMR build.
     if ($ci -and $env:SYSTEM_TEAMPROJECT -ne $null -and !$fromVMR) {
@@ -839,23 +859,6 @@ function DotNet() {
   }
 }
 
-function GetMSBuildBinaryLogCommandLineArgument($arguments) {
-  foreach ($argument in $arguments) {
-    if ($argument -ne $null) {
-      $arg = $argument.Trim()
-      if ($arg.StartsWith('/bl:', "OrdinalIgnoreCase")) {
-        return $arg.Substring('/bl:'.Length)
-      }
-
-      if ($arg.StartsWith('/binaryLogger:', 'OrdinalIgnoreCase')) {
-        return $arg.Substring('/binaryLogger:'.Length)
-      }
-    }
-  }
-
-  return $null
-}
-
 function GetExecutableFileName($baseName) {
   if (IsWindowsPlatform) {
     return "$baseName.exe"
diff --git a/eng/common/tools.sh b/eng/common/tools.sh
index 48cab70e..347a29b8 100644
--- a/eng/common/tools.sh
+++ b/eng/common/tools.sh
@@ -353,6 +353,15 @@ function GetDotNetInstallScript {
 }
 
 function InitializeBuildTool {
+  # Allow a caller (e.g. a bootstrap script running out-of-proc) to inject the build tool via
+  # environment variables instead of the in-proc _InitializeBuildTool variable. Only the tool path and
+  # command are consumed by the MSBuild function below, so those are all that's needed.
+  if [[ -n "${_BuildToolPath:-}" ]]; then
+    _InitializeBuildTool="$_BuildToolPath"
+    _InitializeBuildToolCommand="$_BuildToolCommand"
+    return
+  fi
+
   if [[ -n "${_InitializeBuildTool:-}" ]]; then
     return
   fi
@@ -423,7 +432,7 @@ function InitializeToolset {
   if [[ -z "$nuget_config" ]]; then
     # Search for any variation of nuget.config in the RepoRoot
     local found_config
-    found_config=$(find "$repo_root" -maxdepth 1 -type f -iname "nuget.config" -print -quit)
+    found_config=$(find "$repo_root" -maxdepth 1 -type f -iname nuget.config | head -n 1)
 
     if [[ -n "$found_config" ]]; then
       nuget_config="$found_config"
@@ -457,7 +466,7 @@ function InitializeToolset {
 }
 
 function ExitWithExitCode {
-  if [[ "$ci" == true && "$prepare_machine" == true ]]; then
+  if [[ "$prepare_machine" == true ]]; then
     StopProcesses
   fi
   exit $1
@@ -466,7 +475,8 @@ function ExitWithExitCode {
 function StopProcesses {
   echo "Killing running build processes..."
   pkill -9 "dotnet" || true
-  pkill -9 "vbcscompiler" || true
+  pkill -9 -i -x VBCSCompiler || true
+  pkill -9 -i -x MSBuild || true
   return 0
 }
 
@@ -493,12 +503,7 @@ function DotNet {
 function MSBuild {
   if [[ "$ci" == true ]]; then
     if [[ "$binary_log" != true && "$exclude_ci_binary_log" != true ]]; then
-      Write-PipelineTelemetryError -category 'Build'  "Binary log must be enabled in CI build, or explicitly opted-out from with the -noBinaryLog switch."
-      ExitWithExitCode 1
-    fi
-
-    if [[ "$node_reuse" == true ]]; then
-      Write-PipelineTelemetryError -category 'Build'  "Node reuse must be disabled in CI build."
+      Write-PipelineTelemetryError -category 'Build'  "Binary log must be enabled in CI build, or explicitly opted-out from with the --excludeCIBinarylog switch."
       ExitWithExitCode 1
     fi
   fi
diff --git a/global.json b/global.json
index 8e3b6f5a..6bef79fa 100644
--- a/global.json
+++ b/global.json
@@ -1,11 +1,11 @@
 {
   "tools": {
-    "dotnet": "11.0.100-preview.5.26227.104"
+    "dotnet": "11.0.100-preview.5.26302.115"
   },
   "test": {
     "runner": "Microsoft.Testing.Platform"
   },
   "msbuild-sdks": {
-    "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26310.1"
+    "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26360.7"
   }
 }