diff --git a/e2e/scenario_test.go b/e2e/scenario_test.go
index 344abe20eea..a52493c7479 100644
--- a/e2e/scenario_test.go
+++ b/e2e/scenario_test.go
@@ -400,9 +400,6 @@ func Test_Ubuntu2204FIPS(t *testing.T) {
 				vmss.Properties.AdditionalCapabilities = &armcompute.AdditionalCapabilities{
 					EnableFips1403Encryption: to.Ptr(true),
 				}
-				settings := vmss.Properties.VirtualMachineProfile.ExtensionProfile.Extensions[0].Properties.ProtectedSettings
-				vmss.Properties.VirtualMachineProfile.ExtensionProfile.Extensions[0].Properties.Settings = settings
-				vmss.Properties.VirtualMachineProfile.ExtensionProfile.Extensions[0].Properties.ProtectedSettings = nil
 			},
 			Validator: func(ctx context.Context, s *Scenario) {
 				ValidateInstalledPackageVersion(ctx, s, "moby-containerd", components.GetExpectedPackageVersions("containerd", "ubuntu", "r2204")[0])
@@ -425,9 +422,6 @@ func Test_Ubuntu2204Gen2FIPS(t *testing.T) {
 				vmss.Properties.AdditionalCapabilities = &armcompute.AdditionalCapabilities{
 					EnableFips1403Encryption: to.Ptr(true),
 				}
-				settings := vmss.Properties.VirtualMachineProfile.ExtensionProfile.Extensions[0].Properties.ProtectedSettings
-				vmss.Properties.VirtualMachineProfile.ExtensionProfile.Extensions[0].Properties.Settings = settings
-				vmss.Properties.VirtualMachineProfile.ExtensionProfile.Extensions[0].Properties.ProtectedSettings = nil
 			},
 			Validator: func(ctx context.Context, s *Scenario) {
 				ValidateInstalledPackageVersion(ctx, s, "moby-containerd", components.GetExpectedPackageVersions("containerd", "ubuntu", "r2204")[0])
diff --git a/vhdbuilder/packer/packer_source.sh b/vhdbuilder/packer/packer_source.sh
index 6f515615600..766f2f4dfe3 100644
--- a/vhdbuilder/packer/packer_source.sh
+++ b/vhdbuilder/packer/packer_source.sh
@@ -426,3 +426,52 @@ cpAndMode() {
   mode=$3
   DIR=$(dirname "$dest") && mkdir -p ${DIR} && cp $src $dest && chmod $mode $dest || exit $ERR_PACKER_COPY_FILE
 }
+
+updateWALinuxAgent() {
+  local waagent_version="2.15.0.1"
+  local tarball="v${waagent_version}.tar.gz"
+  local extract_dir="WALinuxAgent-${waagent_version}"
+
+  apt-get purge -y walinuxagent
+  systemctl daemon-reload
+  rm -rf /usr/lib/python3/dist-packages/azurelinuxagent*
+  rm -rf /usr/local/lib/python3.10/dist-packages/azurelinuxagent*
+
+  # Download WALinuxAgent source
+  wget -O "${tarball}" "https://github.com/Azure/WALinuxAgent/archive/refs/tags/${tarball}" || {
+    echo "Failed to download WALinuxAgent"
+    return 1
+  }
+
+  # Extract and install
+  tar -xvf "${tarball}" || {
+    echo "Failed to extract WALinuxAgent tarball"
+    rm -f "${tarball}"
+    return 1
+  }
+
+  pushd "${extract_dir}" || {
+    echo "Failed to enter WALinuxAgent directory"
+    rm -rf "${tarball}" "${extract_dir}"
+    return 1
+  }
+
+  python3 setup.py install --register-service --install-lib=/usr/lib/python3/dist-packages --install-scripts=/usr/sbin || {
+    echo "Failed to install WALinuxAgent"
+    popd
+    rm -rf "${tarball}" "${extract_dir}"
+    return 1
+  }
+
+  popd
+
+  # Disable auto-update to prevent the agent from updating itself
+  sed -i 's/^AutoUpdate.Enabled=y/AutoUpdate.Enabled=n/' /etc/waagent.conf
+
+  systemctl enable walinuxagent
+
+  # Cleanup downloaded files
+  rm -rf "${tarball}" "${extract_dir}"
+
+  echo "WALinuxAgent ${waagent_version} installed successfully"
+}
diff --git a/vhdbuilder/packer/pre-install-dependencies.sh b/vhdbuilder/packer/pre-install-dependencies.sh
index dae69a0db77..afb3ecf1a2b 100644
--- a/vhdbuilder/packer/pre-install-dependencies.sh
+++ b/vhdbuilder/packer/pre-install-dependencies.sh
@@ -33,6 +33,7 @@ if isMarinerOrAzureLinux "$OS"; then
 fi
 
 installJq || echo "WARNING: jq installation failed, VHD Build benchmarks will not be available for this build."
+updateWALinuxAgent || echo "WARNING: WALinuxAgent update failed"
 capture_benchmark "${SCRIPT_NAME}_source_packer_files_and_declare_variables"
 
 copyPackerFiles
@@ -46,6 +47,7 @@ else
 fi
 systemctl daemon-reload
 systemctlEnableAndStart systemd-journald 30 || exit 1
+
 if ! isFlatcar "$OS" ; then
     systemctlEnableAndStart rsyslog 30 || exit 1
 fi
diff --git a/vhdbuilder/packer/vhd-scanning.sh b/vhdbuilder/packer/vhd-scanning.sh
index 8175b297f5f..b800af0750e 100755
--- a/vhdbuilder/packer/vhd-scanning.sh
+++ b/vhdbuilder/packer/vhd-scanning.sh
@@ -114,6 +114,18 @@ if [ "${OS_SKU}" = "Ubuntu" ] && [ "${OS_VERSION}" = "22.04" ] && [ "$(printf %s
     # Register FIPS feature and create VM using REST API. Exit if any step fails.
     ensure_fips_feature_registered || exit $?
     create_fips_vm "$VM_SIZE" || exit $?
+
+    # Test extension functionality using Custom Script Extension (cat /etc/os-release)
+    # This validates that the Linux agent and Custom Script Extension work on this VM
+    echo "Testing Custom Script Extension functionality..."
+    az vm extension set \
+        --resource-group $RESOURCE_GROUP_NAME \
+        --vm-name $SCAN_VM_NAME \
+        --name customScript \
+        --publisher Microsoft.Azure.Extensions \
+        --protected-settings '{"commandToExecute":"cat /etc/os-release"}'
+
+    capture_benchmark "${SCRIPT_NAME}_test_custom_script_extension"
 else
     echo "Creating VM using standard az vm create command..."