diff --git a/.pipelines/azure_pipeline_mergedbranches.yaml b/.pipelines/azure_pipeline_mergedbranches.yaml
index e1057a49f9..f98819338b 100644
--- a/.pipelines/azure_pipeline_mergedbranches.yaml
+++ b/.pipelines/azure_pipeline_mergedbranches.yaml
@@ -372,6 +372,8 @@ extends:
           displayName: 'install prereqs'
         - task: CodeQL3000Init@0
           condition: eq(variables.IS_MAIN_BRANCH, true)
+        - task: NuGetAuthenticate@1
+          displayName: 'Authenticate to CFS NuGet feed'
         - script: |
             setlocal enabledelayedexpansion
             powershell.exe -ExecutionPolicy Unrestricted -NoProfile -WindowStyle Hidden -File "build\windows\Makefile.ps1"
@@ -591,6 +593,8 @@ extends:
           displayName: 'install prereqs'
         - task: CodeQL3000Init@0
           condition: eq(variables.IS_MAIN_BRANCH, true)
+        - task: NuGetAuthenticate@1
+          displayName: 'Authenticate to CFS NuGet feed'
         - script: |
             setlocal enabledelayedexpansion
             powershell.exe -ExecutionPolicy Unrestricted -NoProfile -WindowStyle Hidden -File "build\windows\Makefile.ps1"
diff --git a/NuGet.config b/NuGet.config
new file mode 100644
index 0000000000..f48b766e23
--- /dev/null
+++ b/NuGet.config
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="PublicPackages" value="https://pkgs.dev.azure.com/github-private/microsoft/_packaging/microsoft_PublicPackages/nuget/v3/index.json" />
+  </packageSources>
+</configuration>
diff --git a/build/windows/Makefile.ps1 b/build/windows/Makefile.ps1
index cedce9c7b9..ce98efbc2a 100644
--- a/build/windows/Makefile.ps1
+++ b/build/windows/Makefile.ps1
@@ -73,10 +73,9 @@ if ($false -eq (Test-Path -Path $certsrcdir)) {
 Write-Host("set the cerificate generator source code directory : " + $certsrcdir + " ...")
 Set-Location -Path $certsrcdir
 
-Write-Host("Adding dotnet packages Newtonsoft.json and BouncyCastle ...")
-dotnet add package Newtonsoft.json
-dotnet add package BouncyCastle
-Write-Host("Successfully added dotnet packages") -ForegroundColor Green
+# Newtonsoft.Json and BouncyCastle are pinned as PackageReference in CertificateGenerator.csproj.
+# 'dotnet add package' without a version resolves the latest from the configured source, which
+# reaches api.nuget.org and un-pins the versions at build time. Restore below uses NuGet.config.
 dotnet build  -f $dotnetcoreframework
 Write-Host("Building Certificate generator code and ...") -ForegroundColor Green