diff --git a/Directory.Build.props b/Directory.Build.props
index 7518dc3e..011f8111 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -6,6 +6,7 @@
     <BaseIntermediateOutputPath>$(RepoRootPath)obj\$([MSBuild]::MakeRelative($(RepoRootPath), $(MSBuildProjectDirectory)))\</BaseIntermediateOutputPath>
     <BaseOutputPath Condition=" '$(BaseOutputPath)' == '' ">$(RepoRootPath)bin\$(MSBuildProjectName)\</BaseOutputPath>
     <PackageOutputPath>$(RepoRootPath)bin\Packages\$(Configuration)\NuGet\</PackageOutputPath>
+    <VSIXOutputPath>$(RepoRootPath)bin\Packages\$(Configuration)\Vsix\$(Platform)\</VSIXOutputPath>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <AnalysisLevel>latest</AnalysisLevel>
diff --git a/Expand-Template.ps1 b/Expand-Template.ps1
index f91ab76b..4192f8cf 100755
--- a/Expand-Template.ps1
+++ b/Expand-Template.ps1
@@ -166,6 +166,10 @@ try {
         'LibraryNoDots' = $LibraryName.Replace('.','');
     }
 
+    Replace-Placeholders -Path "azure-pipelines/variables/InsertJsonValues.ps1" -Replacements @{
+        'LibraryName' = $LibraryName;
+    }
+
     Replace-Placeholders -Path "azure-pipelines/variables/SymbolsFeatureName.ps1" -Replacements @{
         'LibraryName' = $LibraryName;
     }
diff --git a/azure-pipelines/GlobalVariables.yml b/azure-pipelines/GlobalVariables.yml
index b2d1d532..cee858b1 100644
--- a/azure-pipelines/GlobalVariables.yml
+++ b/azure-pipelines/GlobalVariables.yml
@@ -2,3 +2,5 @@ variables:
   # These variables are required for MicroBuild tasks
   TeamName: VS IDE
   TeamEmail: vsidemicrobuild@microsoft.com
+  # These variables influence insertion pipelines
+  ContainsVsix: false # This should be true when the repo builds a VSIX that should be inserted to VS.
diff --git a/azure-pipelines/artifacts/VSInsertion.ps1 b/azure-pipelines/artifacts/VSInsertion.ps1
index de7899e6..ffc7e29a 100644
--- a/azure-pipelines/artifacts/VSInsertion.ps1
+++ b/azure-pipelines/artifacts/VSInsertion.ps1
@@ -16,7 +16,9 @@ if (!$BuildConfiguration) {
     $BuildConfiguration = 'Debug'
 }
 
-$NuGetPackages = "$RepoRoot/bin/Packages/$BuildConfiguration/NuGet"
+$PackagesRoot = "$RepoRoot/bin/Packages/$BuildConfiguration"
+$NuGetPackages = "$PackagesRoot/NuGet"
+$VsixPackages = "$PackagesRoot/Vsix"
 
 if (!(Test-Path $NuGetPackages)) {
     Write-Warning "Skipping because NuGet packages haven't been built yet."
@@ -27,8 +29,12 @@ $result = @{
     "$NuGetPackages" = (Get-ChildItem $NuGetPackages -Recurse)
 }
 
+if (Test-Path $VsixPackages) {
+    $result["$PackagesRoot"] += Get-ChildItem $VsixPackages -Recurse
+}
+
 if ($env:IsOptProf) {
-    $VSRepoPackages = "$RepoRoot/bin/Packages/$BuildConfiguration/VSRepo"
+    $VSRepoPackages = "$PackagesRoot/VSRepo"
     $result["$VSRepoPackages"] = (Get-ChildItem "$VSRepoPackages\*.VSInsertionMetadata.*.nupkg");
 }
 
diff --git a/azure-pipelines/microbuild.after.yml b/azure-pipelines/microbuild.after.yml
index 27572233..f5b921aa 100644
--- a/azure-pipelines/microbuild.after.yml
+++ b/azure-pipelines/microbuild.after.yml
@@ -13,6 +13,8 @@ steps:
   - task: MicroBuildCodesignVerify@3
     displayName: 🔍 Verify Signed Files
     inputs:
+      ApprovalListPathForSigs: $(Build.SourcesDirectory)\azure-pipelines\no_strongname.txt
+      ApprovalListPathForCerts: $(Build.SourcesDirectory)\azure-pipelines\no_authenticode.txt
       TargetFolders: |
         $(Build.SourcesDirectory)/bin/Packages/$(BuildConfiguration)
     condition: and(succeeded(), eq(variables['Agent.OS'], 'Windows_NT'))
diff --git a/azure-pipelines/no_authenticode.txt b/azure-pipelines/no_authenticode.txt
new file mode 100644
index 00000000..262625ac
--- /dev/null
+++ b/azure-pipelines/no_authenticode.txt
@@ -0,0 +1,2 @@
+bin\packages\release\vsix\_manifest\manifest.cat,sbom signed
+bin\packages\release\vsix\_manifest\spdx_2.2\manifest.cat,sbom signed
diff --git a/azure-pipelines/no_strongname.txt b/azure-pipelines/no_strongname.txt
new file mode 100644
index 00000000..e69de29b
diff --git a/azure-pipelines/variables/InsertJsonValues.ps1 b/azure-pipelines/variables/InsertJsonValues.ps1
new file mode 100644
index 00000000..807ca1cb
--- /dev/null
+++ b/azure-pipelines/variables/InsertJsonValues.ps1
@@ -0,0 +1,18 @@
+$vstsDropNames = & "$PSScriptRoot\VstsDropNames.ps1"
+$BuildConfiguration = $env:BUILDCONFIGURATION
+if (!$BuildConfiguration) {
+    $BuildConfiguration = 'Debug'
+}
+
+$BasePath = "$PSScriptRoot\..\..\bin\Packages\$BuildConfiguration\Vsix"
+
+if (Test-Path $BasePath) {
+    $vsmanFiles = @()
+    Get-ChildItem $BasePath *.vsman -Recurse -File |% {
+        $version = (Get-Content $_.FullName | ConvertFrom-Json).info.buildVersion
+        $fn = $_.Name
+        $vsmanFiles += "LibraryName.vsman{$version}=https://vsdrop.corp.microsoft.com/file/v1/$vstsDropNames;$fn"
+    }
+
+    [string]::join(',',$vsmanFiles)
+}
diff --git a/azure-pipelines/variables/VstsDropNames.ps1 b/azure-pipelines/variables/VstsDropNames.ps1
new file mode 100644
index 00000000..4ff36b2c
--- /dev/null
+++ b/azure-pipelines/variables/VstsDropNames.ps1
@@ -0,0 +1 @@
+"Products/$env:SYSTEM_TEAMPROJECT/$env:BUILD_REPOSITORY_NAME/$env:BUILD_SOURCEBRANCHNAME/$env:BUILD_BUILDID"
diff --git a/azure-pipelines/vs-insertion.yml b/azure-pipelines/vs-insertion.yml
index bb734915..add241f0 100644
--- a/azure-pipelines/vs-insertion.yml
+++ b/azure-pipelines/vs-insertion.yml
@@ -40,6 +40,13 @@ extends:
         - download: CI
           artifact: VSInsertion-Windows
           displayName: 🔻 Download VSInsertion-Windows artifact
+        - ${{ if eq(variables['ContainsVsix'], 'true') }}:
+          - task: 1ES.MicroBuildVstsDrop@1
+            displayName: 🔺 Upload VSTS Drop
+            inputs:
+              dropFolder: $(Pipeline.Workspace)/CI/VSInsertion-windows/Vsix
+              dropName: $(VstsDropNames)
+              accessToken: $(System.AccessToken)
         - task: 1ES.PublishNuget@1
           displayName: 📦 Push VS-repo packages to VS feed
           inputs:
diff --git a/azure-pipelines/vs-validation.yml b/azure-pipelines/vs-validation.yml
index b51d9ed2..1bb9f22e 100644
--- a/azure-pipelines/vs-validation.yml
+++ b/azure-pipelines/vs-validation.yml
@@ -73,6 +73,13 @@ extends:
         - download: current
           artifact: VSInsertion-Windows
           displayName: 🔻 Download VSInsertion-Windows artifact
+        - ${{ if eq(variables['ContainsVsix'], 'true') }}:
+          - task: 1ES.MicroBuildVstsDrop@1
+            displayName: 🔺 Upload VSTS Drop
+            inputs:
+              dropFolder: $(Pipeline.Workspace)/VSInsertion-windows/Vsix
+              dropName: $(VstsDropNames)
+              accessToken: $(System.AccessToken)
         - task: 1ES.PublishNuget@1
           displayName: 📦 Push VS-repo packages to VS feed
           inputs: