diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index 395cd5a3..9fb7514f 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -1,4 +1,5 @@
 admins
+ACCESSTOKEN
 apps
 appwiz
 appx
@@ -56,11 +57,13 @@ mubaidr
 NOLOGO
 NOLOGO
 nonexistentpackage
+npmjs
 numpy
 NVM
 opencode
 onboarding
 opensource
+oss
 pkief
 powertoys
 prerel
@@ -74,6 +77,7 @@ reduxjs
 requ
 restsource
 ritwickdey
+sourced
 tastejs
 todomvc
 toolsai
diff --git a/pipelines/azure-pipelines.yml b/pipelines/azure-pipelines.yml
index e90ac7f5..323cb9b0 100644
--- a/pipelines/azure-pipelines.yml
+++ b/pipelines/azure-pipelines.yml
@@ -36,6 +36,9 @@ extends:
       - ES365AIMigrationTooling
     settings:
       skipBuildTagsForGitHubPullRequests: true
+      # CFSClean is omitted so NpmDsc can reach registry.npmjs.org. CFSClean2 (PowerShell Gallery)
+      # and CFSClean3 are enforced; PowerShell modules are sourced from an internal feed instead.
+      networkIsolationPolicy: Permissive,CFSClean2,CFSClean3
 
     stages:
       - stage: WinGet_DSC_Artifacts_Publish
@@ -94,6 +97,26 @@ extends:
                 clean: true
                 fetchTags: false
 
+              - task: PowerShell@2
+                displayName: "Install PSDesiredStateConfiguration from internal feed"
+                env:
+                  SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+                inputs:
+                  pwsh: true
+                  targetType: "inline"
+                  # PowerShell Gallery is blocked by CFSClean2, so the module is pulled from an
+                  # internal Azure Artifacts feed that has PowerShell Gallery as an upstream source.
+                  script: |
+                    $token = $env:SYSTEM_ACCESSTOKEN | ConvertTo-SecureString -AsPlainText -Force
+                    $credential = [System.Management.Automation.PSCredential]::new('AzureDevOps', $token)
+                    $feedUri = 'https://pkgs.dev.azure.com/shine-oss/winget-dsc/_packaging/WinGetDscDependencies/nuget/v3/index.json'
+                    $repoName = 'WinGetDscDependencies'
+                    if (-not (Get-PSResourceRepository -Name $repoName -ErrorAction SilentlyContinue)) {
+                        Register-PSResourceRepository -Name $repoName -Uri $feedUri -Trusted
+                    }
+                    Install-PSResource -Name PSDesiredStateConfiguration -Version '2.0.7' -Repository $repoName -Credential $credential -TrustRepository
+                    Get-Module -Name PSDesiredStateConfiguration -ListAvailable | Select-Object Name, Version
+
               - task: PowerShell@2
                 displayName: "Run Pester tests for DSC modules"
                 inputs:
diff --git a/tests/Microsoft.DotNet.Dsc/Microsoft.DotNet.Dsc.Tests.ps1 b/tests/Microsoft.DotNet.Dsc/Microsoft.DotNet.Dsc.Tests.ps1
index 4b60c6c8..c25f6eca 100644
--- a/tests/Microsoft.DotNet.Dsc/Microsoft.DotNet.Dsc.Tests.ps1
+++ b/tests/Microsoft.DotNet.Dsc/Microsoft.DotNet.Dsc.Tests.ps1
@@ -11,7 +11,9 @@ Set-StrictMode -Version Latest
 #>
 
 BeforeAll {
-    Install-Module -Name PSDesiredStateConfiguration -Force -SkipPublisherCheck
+    if ((Get-Module -Name PSDesiredStateConfiguration -ListAvailable).Version -ne '2.0.7') {
+        Install-Module -Name PSDesiredStateConfiguration -Force -SkipPublisherCheck -RequiredVersion '2.0.7'
+    }
     Import-Module Microsoft.DotNet.Dsc
 
     $script:toolsDir = Join-Path $env:USERPROFILE 'tools'
diff --git a/tests/Microsoft.Windows.Developer/Microsoft.Windows.Developer.Tests.ps1 b/tests/Microsoft.Windows.Developer/Microsoft.Windows.Developer.Tests.ps1
index 68dd4383..81107ab3 100644
--- a/tests/Microsoft.Windows.Developer/Microsoft.Windows.Developer.Tests.ps1
+++ b/tests/Microsoft.Windows.Developer/Microsoft.Windows.Developer.Tests.ps1
@@ -12,7 +12,9 @@ Set-StrictMode -Version Latest
 # InModuleScope ensures that all mocks are on the Microsoft.Windows.Developer module.
 InModuleScope Microsoft.Windows.Developer {
    BeforeAll {
-      Install-Module -Name PSDesiredStateConfiguration -Force -SkipPublisherCheck
+      if ((Get-Module -Name PSDesiredStateConfiguration -ListAvailable).Version -ne '2.0.7') {
+         Install-Module -Name PSDesiredStateConfiguration -Force -SkipPublisherCheck -RequiredVersion '2.0.7'
+      }
       Import-Module Microsoft.Windows.Developer
 
       # Create test registry path.