diff --git a/pipelines/build-test-tool-template.yaml b/pipelines/build-test-tool-template.yaml
index de11505d8..b5df4f4b2 100644
--- a/pipelines/build-test-tool-template.yaml
+++ b/pipelines/build-test-tool-template.yaml
@@ -4,6 +4,15 @@ steps:
     inputs:
       useGlobalJson: true
 
+  - task: NuGetAuthenticate@1
+    displayName: 'Authenticate to Azure Artifacts'
+
+  - pwsh: |
+      $configPath = "$(Build.SourcesDirectory)/nuget.config"
+      dotnet nuget remove source nuget.org --configfile $configPath
+      dotnet nuget add source "https://pkgs.dev.azure.com/mseng/_packaging/SbomTool-PublicPackagesFeed/nuget/v3/index.json" --name SbomTool-PublicPackagesFeed --configfile $configPath
+    displayName: 'Configure internal NuGet source'
+
   - task: DotNetCoreCLI@2
     displayName: 'Restore solution'
     inputs:
@@ -15,25 +24,21 @@ steps:
   - task: DotNetCoreCLI@2
     displayName: Build
     inputs:
-      arguments: '-c $(BuildConfiguration)'
+      arguments: '-c $(BuildConfiguration) --no-restore'
 
   - task: DotNetCoreCLI@2
     displayName: Run unit tests (with coverage on Windows)
     condition: eq(variables['Agent.OS'], 'Windows_NT')
     inputs:
       command: 'test'
-      nobuild: true
-      configuration: '$(BuildConfiguration)'
-      arguments: '-- --report-trx --results-directory $(Agent.TempDirectory) --coverage --coverage-output $(Agent.TempDirectory)/coverage.cobertura.xml --coverage-output-format cobertura'
+      arguments: '-c $(BuildConfiguration) --no-build --no-restore -- --report-trx --results-directory $(Agent.TempDirectory) --coverage --coverage-output $(Agent.TempDirectory)/coverage.cobertura.xml --coverage-output-format cobertura'
 
   - task: DotNetCoreCLI@2
     displayName: Run unit tests (without coverage on non-Windows)
     condition: ne(variables['Agent.OS'], 'Windows_NT')
     inputs:
       command: 'test'
-      nobuild: true
-      configuration: '$(BuildConfiguration)'
-      arguments: '-- --report-trx --results-directory $(Agent.TempDirectory)'
+      arguments: '-c $(BuildConfiguration) --no-build --no-restore -- --report-trx --results-directory $(Agent.TempDirectory)'
 
   # While DotNetCoreCLI docs say that it publishes both TRX and coverage, it doesn't actually publish coverage.
   # https://github.com/microsoft/azure-pipelines-tasks/issues/18254
diff --git a/pipelines/sbom-tool-main-build.yaml b/pipelines/sbom-tool-main-build.yaml
index 66fbc2fbc..a1f3dcfa4 100644
--- a/pipelines/sbom-tool-main-build.yaml
+++ b/pipelines/sbom-tool-main-build.yaml
@@ -31,8 +31,6 @@ variables:
 extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
   parameters:
-    featureFlags:
-      disableNetworkIsolation: true
     sdl:
       sourceAnalysisPool:
         name: sbom-windows-build-pool
@@ -104,37 +102,6 @@ extends:
           - powershell: 'Get-ChildItem -Recurse -Filter *.csproj -Path src | ForEach-Object { dotnet pack $_.FullName  -c $(BuildConfiguration) --no-restore --no-build -o $(Build.ArtifactStagingDirectory)/nuget --include-symbols -p:SymbolPackageFormat=snupkg }'
             displayName: 'Pack NuGet package'
 
-          - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@5
-            displayName: 'Sign packages'
-            inputs:
-              ConnectedServiceName: 'SBOM Tool CI ESRP'
-              AppRegistrationClientId: '51c11fce-97e9-4671-9176-0fc328a9dd17'
-              AppRegistrationTenantId: '33e01921-4d64-4f8c-a055-5bdaffd5e33d'
-              AuthAKVName: 'Sbom-Esrp-Secrets'
-              AuthCertName: 'SBOM-CI-ESRP-Auth-Cert'
-              AuthSignCertName: 'SBOM-CI-ESRP-Signing-Cert'
-              FolderPath: '$(Build.ArtifactStagingDirectory)'
-              Pattern: '*.nupkg'
-              signConfigType: inlineSignParams
-              inlineOperation: |
-                [
-                    {
-                        "keyCode": "CP-401405",
-                        "operationSetCode": "NuGetSign",
-                        "parameters": [ ],
-                        "toolName": "sign",
-                        "toolVersion": "1.0"
-                    },
-                    {
-                        "keyCode": "CP-401405",
-                        "operationSetCode": "NuGetVerify",
-                        "parameters": [ ],
-                        "toolName": "sign",
-                        "toolVersion": "1.0"
-                    }
-                ]
-            condition: and(succeeded(), startswith(variables['Build.SourceBranch'], 'refs/tags/'))
-
           - task: DotNetCoreCLI@2
             displayName: 'Build self-contained binary'
             inputs:
@@ -188,15 +155,56 @@ extends:
           - powershell: |
               cd $(Build.ArtifactStagingDirectory)/win
               $version = (ls $(BinaryNameWindows) -r | Select-Object -ExpandProperty VersionInfo).ProductVersion
-              echo "##vso[task.setvariable variable=Version;isOutput=true]$version"
-            displayName: 'Set variable version'
-
-          - powershell: |
-              cd $(Build.ArtifactStagingDirectory)/win
-              $version = (ls $(BinaryNameWindows) -r | Select-Object -ExpandProperty VersionInfo).ProductVersion
-              echo "##vso[task.setvariable variable=Version;isOutput=true]$version"
+              echo "##vso[task.setvariable variable=Version]$version"
               $version | Out-File $(Build.ArtifactStagingDirectory)/version.txt
-            displayName: 'Write version file'
+            displayName: 'Set version'
+
+          - task: NuGetToolInstaller@1
+            displayName: 'Install NuGet'
+            inputs:
+              versionSpec: 6.x
+
+          - task: NuGetCommand@2
+            displayName: 'Pack win-x64 executable'
+            inputs:
+              command: pack
+              packagesToPack: $(Build.SourcesDirectory)/src/Microsoft.Sbom.Tool.Win-x64/Microsoft.Sbom.Tool.Win-x64.nuspec
+              packDestination: $(Build.ArtifactStagingDirectory)/nuget
+              versioningScheme: byEnvVar
+              versionEnvVar: Version
+              basePath: $(Build.ArtifactStagingDirectory)/win
+              buildProperties: PackageReadmePath=$(Build.SourcesDirectory)\src\Microsoft.Sbom.Tool.Win-x64\README.md
+
+          - task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@5
+            displayName: 'Sign packages'
+            inputs:
+              ConnectedServiceName: 'SBOM Tool CI ESRP'
+              AppRegistrationClientId: '51c11fce-97e9-4671-9176-0fc328a9dd17'
+              AppRegistrationTenantId: '33e01921-4d64-4f8c-a055-5bdaffd5e33d'
+              AuthAKVName: 'Sbom-Esrp-Secrets'
+              AuthCertName: 'SBOM-CI-ESRP-Auth-Cert'
+              AuthSignCertName: 'SBOM-CI-ESRP-Signing-Cert'
+              FolderPath: '$(Build.ArtifactStagingDirectory)'
+              Pattern: '*.nupkg'
+              signConfigType: inlineSignParams
+              inlineOperation: |
+                [
+                    {
+                        "keyCode": "CP-401405",
+                        "operationSetCode": "NuGetSign",
+                        "parameters": [ ],
+                        "toolName": "sign",
+                        "toolVersion": "1.0"
+                    },
+                    {
+                        "keyCode": "CP-401405",
+                        "operationSetCode": "NuGetVerify",
+                        "parameters": [ ],
+                        "toolName": "sign",
+                        "toolVersion": "1.0"
+                    }
+                ]
+            condition: and(succeeded(), startswith(variables['Build.SourceBranch'], 'refs/tags/'))
 
           - powershell: |
               del $(Build.ArtifactStagingDirectory)\CodeSignSummary-*.md
diff --git a/pipelines/sbom-tool-pr-build.yaml b/pipelines/sbom-tool-pr-build.yaml
index 02bb44d9b..f9b31629d 100644
--- a/pipelines/sbom-tool-pr-build.yaml
+++ b/pipelines/sbom-tool-pr-build.yaml
@@ -11,6 +11,7 @@ resources:
 
 variables:
   BuildConfiguration: 'Release'
+  MacOSArm64NetRuntime: 'osx-arm64'
 
 extends:
   template: v1/1ES.Unofficial.PipelineTemplate.yml@1esPipelines
@@ -53,7 +54,17 @@ extends:
           displayName: 'Build (macOS-arm64)'
           pool:
             name: Azure Pipelines
-            image: macos-14-arm64
+            image: macos-latest
             os: macOS
           steps:
           - template: pipelines/build-test-tool-template.yaml@self
+
+          - task: DotNetCoreCLI@2
+            displayName: 'Build osx-arm64 self-contained binary'
+            inputs:
+              command: publish
+              publishWebProjects: false
+              projects: src/Microsoft.Sbom.Tool/Microsoft.Sbom.Tool.csproj
+              arguments: '-c $(BuildConfiguration) --no-restore --output $(Build.ArtifactStagingDirectory)/osx-arm64 --self-contained --runtime $(MacOSArm64NetRuntime) -p:PublishSingleFile=true -p:DebugType=None -f net8.0'
+              zipAfterPublish: false
+              modifyOutputPath: false
diff --git a/src/Microsoft.Sbom.Tool.Win-x64/Microsoft.Sbom.Tool.Win-x64.nuspec b/src/Microsoft.Sbom.Tool.Win-x64/Microsoft.Sbom.Tool.Win-x64.nuspec
new file mode 100644
index 000000000..b14894ccc
--- /dev/null
+++ b/src/Microsoft.Sbom.Tool.Win-x64/Microsoft.Sbom.Tool.Win-x64.nuspec
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<package>
+  <metadata>
+    <id>Microsoft.Sbom.Tool.Win-x64</id>
+    <version>$version$</version>
+    <authors>Microsoft</authors>
+    <owners>Microsoft</owners>
+    <requireLicenseAcceptance>true</requireLicenseAcceptance>
+    <license type="expression">MIT</license>
+    <projectUrl>https://github.com/microsoft/sbom-tool</projectUrl>
+    <repository type="git" url="https://github.com/microsoft/sbom-tool.git" />
+    <releaseNotes>https://github.com/microsoft/sbom-tool/releases</releaseNotes>
+    <readme>README.md</readme>
+    <description>Self-contained win-x64 executable for Microsoft SBOM Tool.</description>
+    <copyright>Copyright Microsoft Corporation. All rights reserved.</copyright>
+    <tags>sbom spdx cli win-x64</tags>
+  </metadata>
+  <files>
+    <file src="sbom-tool-win-x64.exe" target="tools\win-x64" />
+    <file src="$PackageReadmePath$" target="" />
+  </files>
+</package>
diff --git a/src/Microsoft.Sbom.Tool.Win-x64/README.md b/src/Microsoft.Sbom.Tool.Win-x64/README.md
new file mode 100644
index 000000000..a245cfc4d
--- /dev/null
+++ b/src/Microsoft.Sbom.Tool.Win-x64/README.md
@@ -0,0 +1,13 @@
+# Microsoft SBOM Tool for win-x64
+
+This package contains the self-contained Windows x64 executable for
+[Microsoft SBOM Tool](https://github.com/microsoft/sbom-tool).
+
+The executable is installed at:
+
+```text
+tools/win-x64/sbom-tool-win-x64.exe
+```
+
+See the [Microsoft SBOM Tool documentation](https://github.com/microsoft/sbom-tool#readme)
+for command-line usage.