diff --git a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
index 0878b33e12..22be524ee2 100644
--- a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
+++ b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Job.yml
@@ -4,6 +4,7 @@ parameters:
   runTestJobName: 'RunStaticTests'
   dependsOn: ''
   MUXFinalRelease: false
+  windowsAppSdkVersion: 'latest'
 
 jobs:
 - job: ${{ parameters.runTestJobName }}
@@ -15,9 +16,14 @@ jobs:
   variables:
     artifactsDir: $(Build.SourcesDirectory)\Artifacts
     packagesDir: $(Agent.TempDirectory)\WinUI-RunStaticTests-Job\packages
+    winMDVersionVerifyLcrVersion: 'latest'
     ob_outputDirectory: '$(Build.SourcesDirectory)\out'
     ob_sdl_codeSignValidation_excludes: '-|packaging\**;-|**\Test\**;-|**\Taef\**;-|**\TestDependencies\**;-|**\Microsoft.Internal.FrameworkUdk.dll'
     ob_sdl_prefast_enabled: false   # this job does no native build
+    ${{ if ne(parameters.windowsAppSdkVersion, 'latest') }}:
+      windowsAppSdkVersionArgument: '-Version ${{ parameters.windowsAppSdkVersion }}'
+    ${{ else }}:
+      windowsAppSdkVersionArgument: ''
 
   steps:
   # This is a temporarily workaround to avoid getting non-fatal "folder C:\__t\NativeCompilerPrefast not found"
@@ -31,26 +37,30 @@ jobs:
       gci env:* | sort-object name
     displayName: Display build machine environment variable
 
-  # Authenticate to NuGet feeds used by this pipeline (WinUI.Dependencies has nuget.org as an upstream source,
-  # so public releases are available through it without direct nuget.org access)
+  # Fork PRs must not authenticate to private package feeds.
   - task: NuGetAuthenticate@1
-    displayName: 'NuGet Authenticate'
+    displayName: 'Authenticate to WinUI.Dependencies'
+    condition: and(succeeded(), ne(variables['System.PullRequest.IsFork'], 'True'))
 
   # In this pipeline configuration, 'NuGetCommand' is ambiguous so the specific task guid must be used instead
   # See known NuGet task issue notes.
-  # The latest public release is resolved via the WinUI.Dependencies feed (which has nuget.org as an upstream)
-  # The package is installed into a temp directory to ensure it doesn't get used elsewhere for a build
+  # Install the latest public release by default, or the version supplied by the caller.
   - task: NuGetCommand@2
     displayName: 'NuGet install Microsoft.WindowsAppSDK'
     inputs:
       command: 'custom'
-      arguments: 'install Microsoft.WindowsAppSDK -OutputDirectory $(packagesDir) -ConfigFile $(Build.SourcesDirectory)\nuget.config'
+      arguments: 'install Microsoft.WindowsAppSDK $(windowsAppSdkVersionArgument) -OutputDirectory $(packagesDir) -ConfigFile $(Build.SourcesDirectory)\nuget.config -NonInteractive'
 
-  - task: NuGetCommand@2
-    displayName: 'NuGet install WinMDVersionVerifyLcr'
+  - task: DownloadPackage@1
+    displayName: 'Download WinMDVersionVerifyLcr $(winMDVersionVerifyLcrVersion)'
+    condition: and(succeeded(), ne(variables['System.PullRequest.IsFork'], 'True'))
     inputs:
-      command: 'custom'
-      arguments: 'install WinMDVersionVerifyLcr -OutputDirectory $(packagesDir) -ConfigFile $(Build.SourcesDirectory)\nuget.config'
+      packageType: 'nuget'
+      feed: 'WinUI.Dependencies'
+      definition: 'WinMDVersionVerifyLcr'
+      version: '$(winMDVersionVerifyLcrVersion)'
+      extract: true
+      downloadPath: '$(packagesDir)\WinMDVersionVerifyLcr\$(winMDVersionVerifyLcrVersion)'
 
   - template: WinUI-DownloadPipelineArtifacts-Steps.yml
     parameters:
@@ -61,8 +71,14 @@ jobs:
 
   - task: powershell@2
     displayName: 'Run WinMD Compat Test'
+    condition: and(succeeded(), ne(variables['System.PullRequest.IsFork'], 'True'))
     inputs:
       targetType: filePath
       filePath: $(Build.SourcesDirectory)\build\PipelineScripts\VerifyWinMDCompat.ps1
-      arguments: -WinMDPath '$(artifactsDir)\packaging\Release\lib\uap10.0' -PackagesDirectory '$(packagesDir)' -isRelease:$${{ parameters.MUXFinalRelease }}
+      arguments: -WinMDPath '$(artifactsDir)\packaging\Release\lib\uap10.0' -PackagesDirectory '$(packagesDir)' -WinMDVersionVerifyLcrVersion '$(winMDVersionVerifyLcrVersion)' -isRelease:$${{ parameters.MUXFinalRelease }}
       pwsh: true
+
+  - powershell: |
+      Write-Host "WinMD compatibility validation is not available for fork PRs."
+    displayName: 'Skip WinMD compatibility validation'
+    condition: and(succeeded(), eq(variables['System.PullRequest.IsFork'], 'True'))
diff --git a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
index 4b34401330..446182137a 100644
--- a/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
+++ b/build/AzurePipelinesTemplates/WinUI-RunStaticTests-Stage.yml
@@ -2,6 +2,7 @@
 # Licensed under the MIT License.
 parameters:
   MUXFinalRelease: false
+  windowsAppSdkVersion: 'latest'
 
 stages:
 - stage: RunStaticTests
@@ -12,4 +13,5 @@ stages:
   - template: WinUI-RunStaticTests-Job.yml
     parameters:
       runTestJobName: RunStaticTests
-      MUXFinalRelease: ${{ parameters.MUXFinalRelease }}
\ No newline at end of file
+      MUXFinalRelease: ${{ parameters.MUXFinalRelease }}
+      windowsAppSdkVersion: ${{ parameters.windowsAppSdkVersion }}
\ No newline at end of file
diff --git a/build/PipelineScripts/VerifyWinMDCompat.ps1 b/build/PipelineScripts/VerifyWinMDCompat.ps1
index 273d6c3296..f6c113a578 100644
--- a/build/PipelineScripts/VerifyWinMDCompat.ps1
+++ b/build/PipelineScripts/VerifyWinMDCompat.ps1
@@ -10,6 +10,8 @@ param(
     [Parameter(Mandatory = $false)]
     [string]$WinAppSDKWinUIVersion = "",
     [Parameter(Mandatory = $false)]
+    [string]$WinMDVersionVerifyLcrVersion = "",
+    [Parameter(Mandatory = $false)]
     [bool]$isRelease = $false
 )
 
@@ -108,7 +110,16 @@ if (-not $env:BUILD_BUILDID)
     $nugetResultCode = $?
 }
 
-$WinMDVersionVerifyLcrVersionToUse = Get-LatestVersion "WinMDVersionVerifyLcr"
+if ($WinMDVersionVerifyLcrVersion)
+{
+    $WinMDVersionVerifyLcrVersionToUse = $WinMDVersionVerifyLcrVersion
+    Write-Host "Specific WinMDVersionVerifyLcr version specified: $WinMDVersionVerifyLcrVersionToUse"
+}
+else
+{
+    $WinMDVersionVerifyLcrVersionToUse = Get-LatestVersion "WinMDVersionVerifyLcr"
+}
+
 $winMDVersionVerifyLcrPath = [System.IO.Path]::Combine($PackagesDirectory, "WinMDVersionVerifyLcr", $WinMDVersionVerifyLcrVersionToUse, "WinMDVersionVerifyLcr.exe")
 if (-not (Test-Path $winMDVersionVerifyLcrPath))
 {
diff --git a/build/WinUI-GitHub-PR.yml b/build/WinUI-GitHub-PR.yml
index a34c066768..299d2b9a85 100644
--- a/build/WinUI-GitHub-PR.yml
+++ b/build/WinUI-GitHub-PR.yml
@@ -176,7 +176,7 @@ extends:
           failOnTestFailure: false
 
     - ${{ if eq(parameters.runFullValidation, true) }}:
-      - template: build\AzurePipelinesTemplates\WinUI-RunStaticTests-Stage.yml@WinUIInternal
+      - template: AzurePipelinesTemplates\WinUI-RunStaticTests-Stage.yml
         parameters:
           MUXFinalRelease: ${{ parameters.MUXFinalRelease }}