diff --git a/windows-release/azure-pipelines.yml b/windows-release/azure-pipelines.yml
index 9c17f6d5..d0705249 100644
--- a/windows-release/azure-pipelines.yml
+++ b/windows-release/azure-pipelines.yml
@@ -78,13 +78,17 @@ parameters:
   type: boolean
   default: true
 - name: DoEmbed
-  displayName: "Produce embeddable package"
+  displayName: "Produce embeddable package (w/ PyManager or MSI options)"
   type: boolean
   default: true
 - name: DoMSI
   displayName: "Produce EXE/MSI installer"
   type: boolean
   default: true
+- name: TestMSI
+  displayName: "Run EXE/MSI installer tests"
+  type: boolean
+  default: true
 - name: DoPyManager
   displayName: "Produce PyManager package"
   type: boolean
@@ -224,6 +228,7 @@ stages:
           BuildToPackage: ${{ parameters.BuildToPackage }}
           DoARM64: ${{ parameters.DoARM64}}
           DoFreethreaded: ${{ parameters.DoFreethreaded }}
+          SigningCertificate: ${{ parameters.SigningCertificate }}
     - ${{ if eq(parameters.DoMSIX, 'true') }}:
       - template: stage-pack-msix.yml
         parameters:
@@ -247,7 +252,7 @@ stages:
     jobs:
     - ${{ if eq(parameters.DoEmbed, 'true') }}:
       - template: stage-test-embed.yml
-    - ${{ if eq(parameters.DoMSI, 'true') }}:
+    - ${{ if and(eq(parameters.DoMSI, 'true'), eq(parameters.TestMSI, 'true')) }}:
       - template: stage-test-msi.yml
         parameters:
           DoFreethreaded: ${{ parameters.DoFreethreaded }}
diff --git a/windows-release/msi-steps.yml b/windows-release/msi-steps.yml
index 52c4a9df..ce01ca13 100644
--- a/windows-release/msi-steps.yml
+++ b/windows-release/msi-steps.yml
@@ -85,6 +85,8 @@ steps:
         AZURE_TENANT_ID: $(TrustedSigningTenantId)
         AZURE_CLIENT_ID: $(TrustedSigningClientId)
         AZURE_CLIENT_SECRET: $(TrustedSigningSecret)
+        # Only need the variable here for msi.props to detect
+        SigningCertificate: ${{ parameters.SigningCertificate }}
 
   - ${{ each b in parameters.Bundles }}:
     - script: |
@@ -101,6 +103,8 @@ steps:
           AZURE_TENANT_ID: $(TrustedSigningTenantId)
           AZURE_CLIENT_ID: $(TrustedSigningClientId)
           AZURE_CLIENT_SECRET: $(TrustedSigningSecret)
+          # Only need the variable here for msi.props to detect
+          SigningCertificate: ${{ parameters.SigningCertificate }}
 
   - powershell: |
       del $env:ResponseFile -ErrorAction Continue
diff --git a/windows-release/stage-layout-embed.yml b/windows-release/stage-layout-embed.yml
index 45bda808..bdd3b4e9 100644
--- a/windows-release/stage-layout-embed.yml
+++ b/windows-release/stage-layout-embed.yml
@@ -4,7 +4,6 @@ parameters:
 jobs:
 - job: Make_Embed_Layout
   displayName: Make embeddable layout
-  condition: and(succeeded(), eq(variables['DoEmbed'], 'true'))
 
   pool:
     vmImage: windows-2022
diff --git a/windows-release/stage-publish-pythonorg.yml b/windows-release/stage-publish-pythonorg.yml
index 7597606b..b6cdfc56 100644
--- a/windows-release/stage-publish-pythonorg.yml
+++ b/windows-release/stage-publish-pythonorg.yml
@@ -24,20 +24,6 @@ jobs:
     inputs:
       versionSpec: '>=3.10'
 
-  - task: DownloadPipelineArtifact@2
-    displayName: 'Download artifact: Doc'
-    inputs:
-      ${{ if eq(parameters.BuildToPublish, 'current') }}:
-        buildType: current
-      ${{ else }}:
-        buildType: specific
-        buildVersionToDownload: specific
-        project: $(resources.pipeline.build_to_publish.projectId)
-        pipeline: $(resources.pipeline.build_to_publish.pipelineId)
-        runId: $(resources.pipeline.build_to_publish.runID)
-      artifact: Doc
-      targetPath: $(Pipeline.Workspace)\Doc
-
   - task: DownloadPipelineArtifact@2
     displayName: 'Download artifact: msi'
     inputs:
@@ -63,8 +49,9 @@ jobs:
           buildVersionToDownload: specific
           project: $(resources.pipeline.build_to_publish.projectId)
           pipeline: $(resources.pipeline.build_to_publish.pipelineId)
-          runId: $(resources.pipeline.build_to_publish.runID)
+          buildId: $(resources.pipeline.build_to_publish.runID)
         artifactName: embed
+        # Artifact name is added to path for DownloadBuildArtifacts
         downloadPath: $(Pipeline.Workspace)
 
   - task: DownloadBuildArtifacts@1
@@ -77,8 +64,9 @@ jobs:
         buildVersionToDownload: specific
         project: $(resources.pipeline.build_to_publish.projectId)
         pipeline: $(resources.pipeline.build_to_publish.pipelineId)
-        runId: $(resources.pipeline.build_to_publish.runID)
+        buildId: $(resources.pipeline.build_to_publish.runID)
       artifactName: sbom
+      # Artifact name is added to path for DownloadBuildArtifacts
       downloadPath: $(Pipeline.Workspace)