diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
index 0932e2f210a9..8ffc6ad307b4 100644
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@@ -417,9 +417,9 @@
       <SourceBuild RepoName="source-build-externals" ManagedOnly="true" />
     </Dependency>
     <!-- Intermediate is necessary for source build. -->
-    <Dependency Name="Microsoft.SourceBuild.Intermediate.source-build-reference-packages" Version="9.0.0-alpha.1.25521.3">
+    <Dependency Name="Microsoft.SourceBuild.Intermediate.source-build-reference-packages" Version="9.0.0-alpha.1.25564.5">
       <Uri>https://github.com/dotnet/source-build-reference-packages</Uri>
-      <Sha>a9cadb09ddcc99b1e535efb0648047634f0c4f40</Sha>
+      <Sha>6092b62b7f35fddbd6bf31e19b2ab64bbe2443ae</Sha>
       <SourceBuild RepoName="source-build-reference-packages" ManagedOnly="true" />
     </Dependency>
     <Dependency Name="Microsoft.Deployment.DotNet.Releases" Version="2.0.0-rtm.1.25059.4">
diff --git a/eng/common/tools.ps1 b/eng/common/tools.ps1
index 987a8412636b..b8fa65f63742 100644
--- a/eng/common/tools.ps1
+++ b/eng/common/tools.ps1
@@ -295,7 +295,7 @@ function InstallDotNet([string] $dotnetRoot,
     if ($runtime -eq "aspnetcore") { $runtimePath = $runtimePath + "\Microsoft.AspNetCore.App" }
     if ($runtime -eq "windowsdesktop") { $runtimePath = $runtimePath + "\Microsoft.WindowsDesktop.App" }
     $runtimePath = $runtimePath + "\" + $version
-  
+
     $dotnetVersionLabel = "runtime toolset '$runtime/$architecture v$version'"
 
     if (Test-Path $runtimePath) {
diff --git a/src/Layout/redist/targets/GenerateLayout.targets b/src/Layout/redist/targets/GenerateLayout.targets
index 2062e922fecd..c07f6d08c0c4 100644
--- a/src/Layout/redist/targets/GenerateLayout.targets
+++ b/src/Layout/redist/targets/GenerateLayout.targets
@@ -121,6 +121,13 @@
 
     <Copy SourceFiles="@(DotnetFormatDllFiles)" DestinationFiles="@(DotnetFormatDllFiles->'$(DotnetFormatDestinationDirectory)/%(RecursiveDir)%(Filename)%(Extension)')" />
     <Copy SourceFiles="@(DotnetFormatConfigFiles)" DestinationFiles="@(DotnetFormatConfigFiles->'$(DotnetFormatDestinationDirectory)/%(RecursiveDir)%(Filename)%(Extension)')" />
+
+    <!-- Overlay newer Microsoft.Build.* assemblies from SDK for version consistency
+         this does not fix deps.json inconsistencies but ensures we don't ship vulnerable packages -->
+    <Copy SourceFiles="@(SdkMicrosoftBuildFiles)"
+          DestinationFolder="$(DotnetFormatDestinationDirectory)"
+          Condition="Exists('%(FullPath)')"
+          OverwriteReadOnlyFiles="true" />
   </Target>
 
   <Target Name="PublishMSBuildExtensions"
diff --git a/src/SourceBuild/content/eng/pipelines/templates/stages/vmr-scan.yml b/src/SourceBuild/content/eng/pipelines/templates/stages/vmr-scan.yml
index 29ba06160e46..964b84144b3f 100644
--- a/src/SourceBuild/content/eng/pipelines/templates/stages/vmr-scan.yml
+++ b/src/SourceBuild/content/eng/pipelines/templates/stages/vmr-scan.yml
@@ -16,26 +16,30 @@ stages:
     - script: |
         source ./eng/common/tools.sh
         InitializeDotNetCli true
-        cd src/sdk
-        ../../.dotnet/dotnet tool restore
-      displayName: Initialize tooling
+        echo "##vso[task.setvariable variable=DotNetPath]$_InitializeDotNetCli"
+      displayName: Initialize .NET CLI
       workingDirectory: $(Build.SourcesDirectory)
 
+    - script: |
+        $(DotNetPath)/dotnet tool restore
+      displayName: Restore tools
+      workingDirectory: $(Build.SourcesDirectory)/src/sdk
+
     - script: |
         set -e
-        sha=`../../.dotnet/dotnet darc vmr get-version --vmr "$(Build.SourcesDirectory)" sdk`
+        sha=`$(DotNetPath)/dotnet darc vmr get-version --vmr "$(Build.SourcesDirectory)" sdk`
         echo "##vso[build.addbuildtag]$sha"
       displayName: Tag the build
       workingDirectory: $(Build.SourcesDirectory)/src/sdk
 
     - script: |
-        ./eng/detect-binaries.sh
+        ./eng/detect-binaries.sh --with-sdk $(DotNetPath)
       displayName: Scan for binaries
       workingDirectory: $(Build.SourcesDirectory)
       continueOnError: true
 
     - script: >
-        ../../.dotnet/dotnet darc vmr scan-cloaked-files
+        $(DotNetPath)/dotnet darc vmr scan-cloaked-files
         --vmr "$(Build.SourcesDirectory)"
         --tmp "$(Agent.TempDirectory)"
         || (echo '##[error]Found cloaked files in the VMR' && exit 1)
diff --git a/test/Microsoft.NET.Build.Containers.IntegrationTests/CreateNewImageTests.cs b/test/Microsoft.NET.Build.Containers.IntegrationTests/CreateNewImageTests.cs
index 57262cceba44..e17c3bf33f9c 100644
--- a/test/Microsoft.NET.Build.Containers.IntegrationTests/CreateNewImageTests.cs
+++ b/test/Microsoft.NET.Build.Containers.IntegrationTests/CreateNewImageTests.cs
@@ -20,7 +20,7 @@ public CreateNewImageTests(ITestOutputHelper testOutput)
         _testOutput = testOutput;
     }
 
-    [DockerAvailableFact(Skip = "https://github.com/dotnet/sdk/issues/49502")]
+    [DockerAvailableFact(Skip = "https://github.com/dotnet/sdk/issues/49300")]
     public void CreateNewImage_Baseline()
     {
         DirectoryInfo newProjectDir = new(GetTestDirectoryName());
@@ -70,7 +70,7 @@ private static ImageConfig GetImageConfigFromTask(CreateNewImage task)
         return new(task.GeneratedContainerConfiguration);
     }
 
-    [DockerAvailableFact(Skip = "https://github.com/dotnet/sdk/issues/49502")]
+    [DockerAvailableFact(Skip = "https://github.com/dotnet/sdk/issues/49300")]
     public void ParseContainerProperties_EndToEnd()
     {
         DirectoryInfo newProjectDir = new(GetTestDirectoryName());
@@ -133,7 +133,8 @@ public void ParseContainerProperties_EndToEnd()
     /// <summary>
     /// Creates a console app that outputs the environment variable added to the image.
     /// </summary>
-    [DockerAvailableFact(Skip = "https://github.com/dotnet/sdk/issues/49502")]
+
+    [DockerAvailableFact(Skip = "https://github.com/dotnet/sdk/issues/49300")]
     public void Tasks_EndToEnd_With_EnvironmentVariable_Validation()
     {
         DirectoryInfo newProjectDir = new(GetTestDirectoryName());
@@ -216,7 +217,7 @@ public void Tasks_EndToEnd_With_EnvironmentVariable_Validation()
             .And.HaveStdOut("Foo");
     }
 
-    [DockerAvailableFact(Skip = "https://github.com/dotnet/sdk/issues/49502")]
+    [DockerAvailableFact(Skip = "https://github.com/dotnet/sdk/issues/49300")]
     public async System.Threading.Tasks.Task CreateNewImage_RootlessBaseImage()
     {
         const string RootlessBase = "dotnet/rootlessbase";
diff --git a/test/Microsoft.NET.Build.Containers.IntegrationTests/DockerRegistryTests.cs b/test/Microsoft.NET.Build.Containers.IntegrationTests/DockerRegistryTests.cs
index ce0c46a50a87..24bfe1f73a89 100644
--- a/test/Microsoft.NET.Build.Containers.IntegrationTests/DockerRegistryTests.cs
+++ b/test/Microsoft.NET.Build.Containers.IntegrationTests/DockerRegistryTests.cs
@@ -17,7 +17,7 @@ public DockerRegistryTests(ITestOutputHelper testOutput)
         _loggerFactory = new TestLoggerFactory(testOutput);
     }
 
-    [DockerAvailableFact(Skip = "https://github.com/dotnet/sdk/issues/49502")]
+    [DockerAvailableFact(Skip = "https://github.com/dotnet/sdk/issues/49300")]
     public async Task GetFromRegistry()
     {
         var loggerFactory = new TestLoggerFactory(_testOutput);
diff --git a/test/Microsoft.NET.Build.Containers.IntegrationTests/DockerTestsCollection.cs b/test/Microsoft.NET.Build.Containers.IntegrationTests/DockerTestsCollection.cs
index 9b3a6e25327c..90d188183a78 100644
--- a/test/Microsoft.NET.Build.Containers.IntegrationTests/DockerTestsCollection.cs
+++ b/test/Microsoft.NET.Build.Containers.IntegrationTests/DockerTestsCollection.cs
@@ -5,7 +5,9 @@ namespace Microsoft.NET.Build.Containers.IntegrationTests;
 
 [CollectionDefinition("Docker tests")]
 #pragma warning disable CA1711 // Identifiers should not have incorrect suffix
-public class DockerTestsCollection : ICollectionFixture<DockerTestsFixture>
+// TODO: skipped due to docker infra instability - need to use new ACR.
+// See https://github.com/dotnet/sdk/issues/49300
+public class DockerTestsCollection // : ICollectionFixture<DockerTestsFixture>
 #pragma warning restore CA1711 // Identifiers should not have incorrect suffix
 {
     // This class has no code, and is never created. Its purpose is simply
diff --git a/test/Microsoft.NET.Build.Containers.IntegrationTests/EndToEndTests.cs b/test/Microsoft.NET.Build.Containers.IntegrationTests/EndToEndTests.cs
index bc2e8a1630bc..28a84d41fb7e 100644
--- a/test/Microsoft.NET.Build.Containers.IntegrationTests/EndToEndTests.cs
+++ b/test/Microsoft.NET.Build.Containers.IntegrationTests/EndToEndTests.cs
@@ -1371,7 +1371,7 @@ public void EndToEndMultiArch_Labels()
     [DockerSupportsArchInlineData("linux/386", "linux-x86", "/app", Skip = "There's no apphost for linux-x86 so we can't execute self-contained, and there's no .NET runtime base image for linux-x86 so we can't execute framework-dependent.")]
     [DockerSupportsArchInlineData("windows/amd64", "win-x64", "C:\\app")]
     [DockerSupportsArchInlineData("linux/amd64", "linux-x64", "/app")]
-    [DockerAvailableTheory(Skip = "https://github.com/dotnet/sdk/issues/49502")]
+    [DockerAvailableTheory(Skip = "https://github.com/dotnet/sdk/issues/49300")]
     public async Task CanPackageForAllSupportedContainerRIDs(string dockerPlatform, string rid, string workingDir)
     {
         ILogger logger = _loggerFactory.CreateLogger(nameof(CanPackageForAllSupportedContainerRIDs));