diff --git a/.pipelines/typescript-build-and-publish.yaml b/.pipelines/typescript-build-and-publish.yaml
index cf005b77..ae411618 100644
--- a/.pipelines/typescript-build-and-publish.yaml
+++ b/.pipelines/typescript-build-and-publish.yaml
@@ -17,7 +17,13 @@ variables:
 
   # ESRP Code Signing
   # ESRP Registration: https://portal.esrp.microsoft.com/Onboarding/AccountDetails?clientId=142047f4-eda8-4853-8776-c2e81803ea13
-  # Service connection in devdiv Azure DevOps: Devtunnels-esrp-ame-msi (https://devdiv.visualstudio.com/OnlineServices/_settings/adminservices?resourceId=702454c9-77bd-4750-820e-5ce2e483f9f5)
+  # Service connection in devdiv Azure DevOps: Devtunnels-esrp-ame-msi-wif2
+  # (listed under https://devdiv.visualstudio.com/OnlineServices/_settings/adminservices)
+  # This replaces the earlier 'Devtunnels-esrp-ame-msi' connection (resourceId 702454c9-77bd-4750-820e-5ce2e483f9f5).
+  # That connection's federated identity credential no longer matches the assertion subject presented by the
+  # ADO v5 agent, so EsrpRelease fails to acquire a token with 'AADSTS700213: No matching federated identity
+  # record found for presented assertion subject'. dev-tunnels-ssh made the same switch in
+  # microsoft/dev-tunnels-ssh@d8a9ff1.
   # Managed identity that this service connection has federated access to: tunnels-ppe-esrp-id (client id 01ee3ff5-3b24-4b62-996e-6217f7cf3487) in AME tenant (33e01921-4d64-4f8c-a055-5bdaffd5e33d).
   # Signing certificate: esrp-sign in tunnels-ppe-esrp-kv
   # ESRP used to use a cert to authenticate as app in Microsoft tenant, but now it uses a managed identity in AME tenant.
@@ -25,7 +31,7 @@ variables:
   # https://eng.ms/docs/microsoft-security/identity/trust-and-security-services/tss-high-security-environments/tss-esrp-fabric-and-platform-services/esrp-documentation/tsgs/sfi/tsg501-eliminate-access-to-codesigning-from-corp-tenants
   # https://eng.ms/docs/microsoft-security/identity/trust-and-security-services/tss-high-security-environments/tss-esrp-fabric-and-platform-services/esrp-documentation/tsgs/sfi/tsg506-integrating-esrp-release-ado-extension
 
-  EsrpConnectedServiceName: 'Devtunnels-esrp-ame-msi' # Service connection with ESRP MSI based authentication
+  EsrpConnectedServiceName: 'Devtunnels-esrp-ame-msi-wif2' # Service connection with ESRP MSI based authentication
   EsrpClientId: '142047f4-eda8-4853-8776-c2e81803ea13' # ESRP Client Id, the Old App Registration Id to which we mapped our Managed Identity Id to
   EsrpAuthAKVName: 'tunnels-ppe-esrp-kv' # Key Vault name where the signing certificate is stored
   EsrpAuthSignCertName: 'esrp-sign' # Code signing certificate name in the Key Vault