diff --git a/tests/safe-outputs/add-build-tag.lock.yml b/tests/safe-outputs/add-build-tag.lock.yml
index 29d9f8be..e4cf50bc 100644
--- a/tests/safe-outputs/add-build-tag.lock.yml
+++ b/tests/safe-outputs/add-build-tag.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/add-build-tag.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/add-build-tag.md" version=0.30.1
 
 name: "Daily safe-output smoke add-build-tag-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -483,25 +506,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -510,7 +556,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -525,7 +571,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -758,7 +804,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -773,7 +819,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/add-pr-comment.lock.yml b/tests/safe-outputs/add-pr-comment.lock.yml
index 443ff8c7..681aad65 100644
--- a/tests/safe-outputs/add-pr-comment.lock.yml
+++ b/tests/safe-outputs/add-pr-comment.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/add-pr-comment.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/add-pr-comment.md" version=0.30.1
 
 name: "Daily safe-output smoke add-pr-comment-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -484,25 +507,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -511,7 +557,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -526,7 +572,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -759,7 +805,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -774,7 +820,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/comment-on-work-item.lock.yml b/tests/safe-outputs/comment-on-work-item.lock.yml
index de68864d..9f3862dc 100644
--- a/tests/safe-outputs/comment-on-work-item.lock.yml
+++ b/tests/safe-outputs/comment-on-work-item.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/comment-on-work-item.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/comment-on-work-item.md" version=0.30.1
 
 name: "Daily safe-output smoke comment-on-work-item-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -484,25 +507,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -511,7 +557,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -526,7 +572,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -759,7 +805,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -774,7 +820,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/create-branch.lock.yml b/tests/safe-outputs/create-branch.lock.yml
index c110efd8..fdd77694 100644
--- a/tests/safe-outputs/create-branch.lock.yml
+++ b/tests/safe-outputs/create-branch.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/create-branch.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/create-branch.md" version=0.30.1
 
 name: "Daily safe-output smoke create-branch-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -483,25 +506,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -510,7 +556,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -525,7 +571,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -758,7 +804,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -773,7 +819,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/create-git-tag.lock.yml b/tests/safe-outputs/create-git-tag.lock.yml
index c1b59f05..f885b427 100644
--- a/tests/safe-outputs/create-git-tag.lock.yml
+++ b/tests/safe-outputs/create-git-tag.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/create-git-tag.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/create-git-tag.md" version=0.30.1
 
 name: "Daily safe-output smoke create-git-tag-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -483,25 +506,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -510,7 +556,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -525,7 +571,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -758,7 +804,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -773,7 +819,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/create-pull-request.lock.yml b/tests/safe-outputs/create-pull-request.lock.yml
index e9b47af6..e4c9ffac 100644
--- a/tests/safe-outputs/create-pull-request.lock.yml
+++ b/tests/safe-outputs/create-pull-request.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/create-pull-request.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/create-pull-request.md" version=0.30.1
 
 name: "Daily safe-output smoke create-pull-request-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -486,25 +509,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -513,7 +559,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -528,7 +574,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -761,7 +807,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -776,7 +822,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/create-wiki-page.lock.yml b/tests/safe-outputs/create-wiki-page.lock.yml
index b1d172e9..9cbcc76f 100644
--- a/tests/safe-outputs/create-wiki-page.lock.yml
+++ b/tests/safe-outputs/create-wiki-page.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/create-wiki-page.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/create-wiki-page.md" version=0.30.1
 
 name: "Daily safe-output smoke create-wiki-page-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -483,25 +506,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -510,7 +556,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -525,7 +571,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -758,7 +804,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -773,7 +819,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/create-work-item.lock.yml b/tests/safe-outputs/create-work-item.lock.yml
index caab0ed2..c2c97c90 100644
--- a/tests/safe-outputs/create-work-item.lock.yml
+++ b/tests/safe-outputs/create-work-item.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/create-work-item.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/create-work-item.md" version=0.30.1
 
 name: "Daily safe-output smoke create-work-item-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -482,25 +505,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -509,7 +555,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -524,7 +570,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -757,7 +803,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -772,7 +818,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/janitor.lock.yml b/tests/safe-outputs/janitor.lock.yml
index 2da0c528..2a867776 100644
--- a/tests/safe-outputs/janitor.lock.yml
+++ b/tests/safe-outputs/janitor.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/janitor.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/janitor.md" version=0.30.1
 
 name: "ado-aw smoke janitor-$(BuildID)"
 
@@ -67,25 +67,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
+
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
+
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -94,7 +117,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -109,7 +132,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -504,25 +527,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
+
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
+
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -531,7 +577,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -546,7 +592,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -779,7 +825,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -794,7 +840,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/link-work-items.lock.yml b/tests/safe-outputs/link-work-items.lock.yml
index 66abf648..a888fe73 100644
--- a/tests/safe-outputs/link-work-items.lock.yml
+++ b/tests/safe-outputs/link-work-items.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/link-work-items.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/link-work-items.md" version=0.30.1
 
 name: "Daily safe-output smoke link-work-items-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -486,25 +509,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -513,7 +559,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -528,7 +574,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -761,7 +807,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -776,7 +822,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/missing-data.lock.yml b/tests/safe-outputs/missing-data.lock.yml
index 1f5b2613..2c1dc0bb 100644
--- a/tests/safe-outputs/missing-data.lock.yml
+++ b/tests/safe-outputs/missing-data.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/missing-data.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/missing-data.md" version=0.30.1
 
 name: "Daily safe-output smoke missing-data-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -483,25 +506,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -510,7 +556,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -525,7 +571,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -758,7 +804,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -773,7 +819,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/missing-tool.lock.yml b/tests/safe-outputs/missing-tool.lock.yml
index fe0c93d6..6f144045 100644
--- a/tests/safe-outputs/missing-tool.lock.yml
+++ b/tests/safe-outputs/missing-tool.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/missing-tool.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/missing-tool.md" version=0.30.1
 
 name: "Daily safe-output smoke missing-tool-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -482,25 +505,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -509,7 +555,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -524,7 +570,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -757,7 +803,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -772,7 +818,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/noop-target.lock.yml b/tests/safe-outputs/noop-target.lock.yml
index 6d706364..5467a889 100644
--- a/tests/safe-outputs/noop-target.lock.yml
+++ b/tests/safe-outputs/noop-target.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/noop-target.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/noop-target.md" version=0.30.1
 
 name: "ado-aw smoke noop target-$(BuildID)"
 
@@ -33,25 +33,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -60,7 +83,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -75,7 +98,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -469,25 +492,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -496,7 +542,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -511,7 +557,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -731,7 +777,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -746,7 +792,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/noop.lock.yml b/tests/safe-outputs/noop.lock.yml
index b95affc4..90eced18 100644
--- a/tests/safe-outputs/noop.lock.yml
+++ b/tests/safe-outputs/noop.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/noop.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/noop.md" version=0.30.1
 
 name: "Daily safe-output smoke noop-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -481,25 +504,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -508,7 +554,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -523,7 +569,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -756,7 +802,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -771,7 +817,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/queue-build.lock.yml b/tests/safe-outputs/queue-build.lock.yml
index 21ab7e40..97fbaf03 100644
--- a/tests/safe-outputs/queue-build.lock.yml
+++ b/tests/safe-outputs/queue-build.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/queue-build.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/queue-build.md" version=0.30.1
 
 name: "Daily safe-output smoke queue-build-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -485,25 +508,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -512,7 +558,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -527,7 +573,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -760,7 +806,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -775,7 +821,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/reply-to-pr-comment.lock.yml b/tests/safe-outputs/reply-to-pr-comment.lock.yml
index 0d3508c8..a1047d18 100644
--- a/tests/safe-outputs/reply-to-pr-comment.lock.yml
+++ b/tests/safe-outputs/reply-to-pr-comment.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/reply-to-pr-comment.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/reply-to-pr-comment.md" version=0.30.1
 
 name: "Daily safe-output smoke reply-to-pr-comment-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -486,25 +509,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -513,7 +559,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -528,7 +574,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -761,7 +807,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -776,7 +822,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/report-incomplete.lock.yml b/tests/safe-outputs/report-incomplete.lock.yml
index 9d266f13..89435d04 100644
--- a/tests/safe-outputs/report-incomplete.lock.yml
+++ b/tests/safe-outputs/report-incomplete.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/report-incomplete.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/report-incomplete.md" version=0.30.1
 
 name: "Daily safe-output smoke report-incomplete-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -482,25 +505,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -509,7 +555,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -524,7 +570,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -757,7 +803,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -772,7 +818,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/resolve-pr-thread.lock.yml b/tests/safe-outputs/resolve-pr-thread.lock.yml
index 96d4cf6e..c8a8a37e 100644
--- a/tests/safe-outputs/resolve-pr-thread.lock.yml
+++ b/tests/safe-outputs/resolve-pr-thread.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/resolve-pr-thread.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/resolve-pr-thread.md" version=0.30.1
 
 name: "Daily safe-output smoke resolve-pr-thread-$(BuildID)"
 
@@ -61,25 +61,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
+
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
+
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -88,7 +111,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -103,7 +126,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -502,25 +525,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
+
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
+
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -529,7 +575,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -544,7 +590,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -777,7 +823,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -792,7 +838,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/smoke-failure-reporter.lock.yml b/tests/safe-outputs/smoke-failure-reporter.lock.yml
index 28fe3f21..3644dbcd 100644
--- a/tests/safe-outputs/smoke-failure-reporter.lock.yml
+++ b/tests/safe-outputs/smoke-failure-reporter.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/smoke-failure-reporter.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/smoke-failure-reporter.md" version=0.30.1
 
 name: "ado-aw smoke failure reporter-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -517,25 +540,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -544,7 +590,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -559,7 +605,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -792,7 +838,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -807,7 +853,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/submit-pr-review.lock.yml b/tests/safe-outputs/submit-pr-review.lock.yml
index 00c583ea..b93d00c5 100644
--- a/tests/safe-outputs/submit-pr-review.lock.yml
+++ b/tests/safe-outputs/submit-pr-review.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/submit-pr-review.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/submit-pr-review.md" version=0.30.1
 
 name: "Daily safe-output smoke submit-pr-review-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -485,25 +508,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -512,7 +558,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -527,7 +573,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -760,7 +806,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -775,7 +821,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/update-pr.lock.yml b/tests/safe-outputs/update-pr.lock.yml
index 77700637..8e271d9c 100644
--- a/tests/safe-outputs/update-pr.lock.yml
+++ b/tests/safe-outputs/update-pr.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/update-pr.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/update-pr.md" version=0.30.1
 
 name: "Daily safe-output smoke update-pr-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -487,25 +510,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -514,7 +560,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -529,7 +575,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -762,7 +808,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -777,7 +823,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/update-wiki-page.lock.yml b/tests/safe-outputs/update-wiki-page.lock.yml
index 015ee883..2166c818 100644
--- a/tests/safe-outputs/update-wiki-page.lock.yml
+++ b/tests/safe-outputs/update-wiki-page.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/update-wiki-page.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/update-wiki-page.md" version=0.30.1
 
 name: "Daily safe-output smoke update-wiki-page-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -484,25 +507,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -511,7 +557,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -526,7 +572,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -759,7 +805,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -774,7 +820,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/update-work-item.lock.yml b/tests/safe-outputs/update-work-item.lock.yml
index a35a2d31..ab524b24 100644
--- a/tests/safe-outputs/update-work-item.lock.yml
+++ b/tests/safe-outputs/update-work-item.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/update-work-item.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/update-work-item.md" version=0.30.1
 
 name: "Daily safe-output smoke update-work-item-$(BuildID)"
 
@@ -45,25 +45,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -72,7 +95,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -87,7 +110,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -484,25 +507,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
+
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
+
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -511,7 +557,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -526,7 +572,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -759,7 +805,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -774,7 +820,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/upload-build-attachment.lock.yml b/tests/safe-outputs/upload-build-attachment.lock.yml
index b4094bba..99874958 100644
--- a/tests/safe-outputs/upload-build-attachment.lock.yml
+++ b/tests/safe-outputs/upload-build-attachment.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/upload-build-attachment.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/upload-build-attachment.md" version=0.30.1
 
 name: "Daily safe-output smoke upload-build-attachment-$(BuildID)"
 
@@ -58,25 +58,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
+
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
+
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -85,7 +108,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -100,7 +123,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -497,25 +520,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
+
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
+
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -524,7 +570,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -539,7 +585,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -772,7 +818,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -787,7 +833,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/upload-pipeline-artifact.lock.yml b/tests/safe-outputs/upload-pipeline-artifact.lock.yml
index cfafb350..3a20bd53 100644
--- a/tests/safe-outputs/upload-pipeline-artifact.lock.yml
+++ b/tests/safe-outputs/upload-pipeline-artifact.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/upload-pipeline-artifact.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/upload-pipeline-artifact.md" version=0.30.1
 
 name: "Daily safe-output smoke upload-pipeline-artifact-$(BuildID)"
 
@@ -58,25 +58,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
+
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
+
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -85,7 +108,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -100,7 +123,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -497,25 +520,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
+
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
+
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -524,7 +570,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -539,7 +585,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -772,7 +818,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -787,7 +833,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"
diff --git a/tests/safe-outputs/upload-workitem-attachment.lock.yml b/tests/safe-outputs/upload-workitem-attachment.lock.yml
index 171e5c76..58d94563 100644
--- a/tests/safe-outputs/upload-workitem-attachment.lock.yml
+++ b/tests/safe-outputs/upload-workitem-attachment.lock.yml
@@ -1,5 +1,5 @@
 # This file is auto-generated by ado-aw. Do not edit manually.
-# @ado-aw source="tests/safe-outputs/upload-workitem-attachment.md" version=0.29.0
+# @ado-aw source="tests/safe-outputs/upload-workitem-attachment.md" version=0.30.1
 
 name: "Daily safe-output smoke upload-workitem-attachment-$(BuildID)"
 
@@ -58,25 +58,48 @@ jobs:
               --query accessToken -o tsv)
             echo "##vso[task.setvariable variable=SC_READ_TOKEN;issecret=true]$ADO_TOKEN"
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
+
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
+
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -85,7 +108,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -100,7 +123,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           AGENTIC_PIPELINES_PATH="$(Pipeline.Workspace)/agentic-pipeline-compiler/ado-aw"
@@ -500,25 +523,48 @@ jobs:
       - download: current
         artifact: agent_outputs_$(Build.BuildId)
 
-      - task: NuGetAuthenticate@1
-        displayName: "Authenticate NuGet Feed"
+      - bash: |
+          set -euo pipefail
+          TARBALL_NAME="copilot-linux-x64.tar.gz"
+          BASE_URL="https://github.com/github/copilot-cli/releases/download/v1.0.47"
+          TARBALL_URL="$BASE_URL/$TARBALL_NAME"
+          CHECKSUMS_URL="$BASE_URL/SHA256SUMS.txt"
+          TOOLS_DIR="$(Agent.TempDirectory)/tools"
+          TEMP_DIR="$(mktemp -d)"
+          trap 'rm -rf "$TEMP_DIR"' EXIT
+          mkdir -p "$TOOLS_DIR" /tmp/awf-tools
+
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/SHA256SUMS.txt" "$CHECKSUMS_URL"
+          curl -fsSL --retry 3 --retry-delay 5 -o "$TEMP_DIR/$TARBALL_NAME" "$TARBALL_URL"
+
+          EXPECTED_CHECKSUM=$(awk -v fname="$TARBALL_NAME" '$2 == fname {print $1; exit}' "$TEMP_DIR/SHA256SUMS.txt" | tr 'A-F' 'a-f')
+          if [ -z "$EXPECTED_CHECKSUM" ]; then
+            echo "ERROR: failed to resolve expected checksum for $TARBALL_NAME"
+            exit 1
+          fi
 
-      - task: NuGetCommand@2
-        displayName: "Install Copilot CLI"
-        inputs:
-          command: 'custom'
-          arguments: 'install Microsoft.Copilot.CLI.linux-x64 -Source "https://pkgs.dev.azure.com/msazuresphere/_packaging/Guardian1ESPTUpstreamOrgFeed/nuget/v3/index.json" -Version 1.0.47 -OutputDirectory $(Agent.TempDirectory)/tools -ExcludeVersion -NonInteractive'
+          if command -v sha256sum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(sha256sum "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          elif command -v shasum > /dev/null 2>&1; then
+            ACTUAL_CHECKSUM=$(shasum -a 256 "$TEMP_DIR/$TARBALL_NAME" | awk '{print $1}' | tr 'A-F' 'a-f')
+          else
+            echo "ERROR: neither sha256sum nor shasum is available"
+            exit 1
+          fi
 
-      - bash: |
-          ls -la "$(Agent.TempDirectory)/tools"
-          echo "##vso[task.prependpath]$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64"
+          if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
+            echo "ERROR: checksum verification failed"
+            echo "Expected: $EXPECTED_CHECKSUM"
+            echo "Actual:   $ACTUAL_CHECKSUM"
+            exit 1
+          fi
 
-          # Copy copilot binary to /tmp so it's accessible inside AWF container
-          # (AWF auto-mounts /tmp:/tmp:rw but not Agent.TempDirectory)
-          mkdir -p /tmp/awf-tools
-          cp "$(Agent.TempDirectory)/tools/Microsoft.Copilot.CLI.linux-x64/copilot" /tmp/awf-tools/copilot
+          tar -xz -C "$TOOLS_DIR" -f "$TEMP_DIR/$TARBALL_NAME"
+          ls -la "$TOOLS_DIR"
+          echo "##vso[task.prependpath]$TOOLS_DIR"
+          cp "$TOOLS_DIR/copilot" /tmp/awf-tools/copilot
           chmod +x /tmp/awf-tools/copilot
-        displayName: "Add copilot to PATH"
+        displayName: "Install Copilot CLI (v1.0.47)"
 
       - bash: |
           copilot --version
@@ -527,7 +573,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -542,7 +588,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - task: DockerInstaller@0
         displayName: "Install Docker"
@@ -775,7 +821,7 @@ jobs:
 
       - bash: |
           set -eo pipefail
-          COMPILER_VERSION="0.29.0"
+          COMPILER_VERSION="0.30.1"
           DOWNLOAD_DIR="$(Pipeline.Workspace)/agentic-pipeline-compiler"
           DOWNLOAD_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/ado-aw-linux-x64"
           CHECKSUM_URL="https://github.com/githubnext/ado-aw/releases/download/v${COMPILER_VERSION}/checksums.txt"
@@ -790,7 +836,7 @@ jobs:
           grep "ado-aw-linux-x64" checksums.txt | sha256sum -c -
           mv ado-aw-linux-x64 ado-aw
           chmod +x ado-aw
-        displayName: "Download agentic pipeline compiler (v0.29.0)"
+        displayName: "Download agentic pipeline compiler (v0.30.1)"
 
       - bash: |
           ls -la "$(Pipeline.Workspace)/agentic-pipeline-compiler"