diff --git a/Tasks/AzureFileCopyV1/task.json b/Tasks/AzureFileCopyV1/task.json
index c5efa6cccb4d..57720e5fe6e8 100644
--- a/Tasks/AzureFileCopyV1/task.json
+++ b/Tasks/AzureFileCopyV1/task.json
@@ -14,7 +14,7 @@
     "version": {
         "Major": 1,
         "Minor": 276,
-        "Patch": 0
+        "Patch": 1
     },
     "demands": [
         "azureps"
diff --git a/Tasks/AzureFileCopyV1/task.loc.json b/Tasks/AzureFileCopyV1/task.loc.json
index e17d5fedaa05..e915f3c742e1 100644
--- a/Tasks/AzureFileCopyV1/task.loc.json
+++ b/Tasks/AzureFileCopyV1/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 1,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 1
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzureFileCopyV2/task.json b/Tasks/AzureFileCopyV2/task.json
index 3477a77e8b8f..ed08c9d320b4 100644
--- a/Tasks/AzureFileCopyV2/task.json
+++ b/Tasks/AzureFileCopyV2/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 2,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 1
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzureFileCopyV2/task.loc.json b/Tasks/AzureFileCopyV2/task.loc.json
index 437c2cf9c694..a1bdb41c5e6c 100644
--- a/Tasks/AzureFileCopyV2/task.loc.json
+++ b/Tasks/AzureFileCopyV2/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 2,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 1
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzureFileCopyV3/task.json b/Tasks/AzureFileCopyV3/task.json
index 06e7f4f1fc61..b2ea5cc52a5a 100644
--- a/Tasks/AzureFileCopyV3/task.json
+++ b/Tasks/AzureFileCopyV3/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 3,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 1
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzureFileCopyV3/task.loc.json b/Tasks/AzureFileCopyV3/task.loc.json
index dbfc50de6c58..27efee798547 100644
--- a/Tasks/AzureFileCopyV3/task.loc.json
+++ b/Tasks/AzureFileCopyV3/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 3,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 1
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzureFileCopyV4/task.json b/Tasks/AzureFileCopyV4/task.json
index 1015920c4f35..65919df7704b 100644
--- a/Tasks/AzureFileCopyV4/task.json
+++ b/Tasks/AzureFileCopyV4/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzureFileCopyV4/task.loc.json b/Tasks/AzureFileCopyV4/task.loc.json
index 2e25b673f839..8bca66a8a30f 100644
--- a/Tasks/AzureFileCopyV4/task.loc.json
+++ b/Tasks/AzureFileCopyV4/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzureFileCopyV5/task.json b/Tasks/AzureFileCopyV5/task.json
index 25afe40eb1bd..8987108075b3 100644
--- a/Tasks/AzureFileCopyV5/task.json
+++ b/Tasks/AzureFileCopyV5/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzureFileCopyV5/task.loc.json b/Tasks/AzureFileCopyV5/task.loc.json
index 6c15428916dd..668accc204b4 100644
--- a/Tasks/AzureFileCopyV5/task.loc.json
+++ b/Tasks/AzureFileCopyV5/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzureFileCopyV6/task.json b/Tasks/AzureFileCopyV6/task.json
index 29edb26c4c1d..bfedf3764772 100644
--- a/Tasks/AzureFileCopyV6/task.json
+++ b/Tasks/AzureFileCopyV6/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 6,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzureFileCopyV6/task.loc.json b/Tasks/AzureFileCopyV6/task.loc.json
index 237f98668de5..98a613e06089 100644
--- a/Tasks/AzureFileCopyV6/task.loc.json
+++ b/Tasks/AzureFileCopyV6/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 6,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzurePowerShellV2/task.json b/Tasks/AzurePowerShellV2/task.json
index 4ab92f660697..0b86f51b877f 100644
--- a/Tasks/AzurePowerShellV2/task.json
+++ b/Tasks/AzurePowerShellV2/task.json
@@ -18,7 +18,7 @@
     "version": {
         "Major": 2,
         "Minor": 276,
-        "Patch": 0
+        "Patch": 1
     },
     "demands": [
         "azureps"
diff --git a/Tasks/AzurePowerShellV2/task.loc.json b/Tasks/AzurePowerShellV2/task.loc.json
index b95c9639c7f2..d8c5fd362719 100644
--- a/Tasks/AzurePowerShellV2/task.loc.json
+++ b/Tasks/AzurePowerShellV2/task.loc.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 2,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 1
   },
   "demands": [
     "azureps"
diff --git a/Tasks/AzurePowerShellV3/task.json b/Tasks/AzurePowerShellV3/task.json
index e7b485184fdb..d89c7e3723db 100644
--- a/Tasks/AzurePowerShellV3/task.json
+++ b/Tasks/AzurePowerShellV3/task.json
@@ -18,7 +18,7 @@
     "version": {
         "Major": 3,
         "Minor": 276,
-        "Patch": 0
+        "Patch": 1
     },
     "releaseNotes": "Added support for Fail on standard error and ErrorActionPreference",
     "demands": [
diff --git a/Tasks/AzurePowerShellV3/task.loc.json b/Tasks/AzurePowerShellV3/task.loc.json
index 25d8cd818756..c85cfe09191b 100644
--- a/Tasks/AzurePowerShellV3/task.loc.json
+++ b/Tasks/AzurePowerShellV3/task.loc.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 3,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 1
   },
   "releaseNotes": "ms-resource:loc.releaseNotes",
   "demands": [
diff --git a/Tasks/AzurePowerShellV4/task.json b/Tasks/AzurePowerShellV4/task.json
index d37271bf3de2..ad7e8d271e1c 100644
--- a/Tasks/AzurePowerShellV4/task.json
+++ b/Tasks/AzurePowerShellV4/task.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 2
+    "Patch": 4
   },
   "releaseNotes": "Added support for Az Module and cross platform agents.",
   "groups": [
diff --git a/Tasks/AzurePowerShellV4/task.loc.json b/Tasks/AzurePowerShellV4/task.loc.json
index d8e44b62e16b..10b3ad3e921a 100644
--- a/Tasks/AzurePowerShellV4/task.loc.json
+++ b/Tasks/AzurePowerShellV4/task.loc.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 2
+    "Patch": 4
   },
   "releaseNotes": "ms-resource:loc.releaseNotes",
   "groups": [
diff --git a/Tasks/AzurePowerShellV5/task.json b/Tasks/AzurePowerShellV5/task.json
index 1650b75aea07..398009af31a5 100644
--- a/Tasks/AzurePowerShellV5/task.json
+++ b/Tasks/AzurePowerShellV5/task.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 2
+    "Patch": 4
   },
   "releaseNotes": "Added support for Az Module and cross platform agents.",
   "groups": [
diff --git a/Tasks/AzurePowerShellV5/task.loc.json b/Tasks/AzurePowerShellV5/task.loc.json
index 86905b90f926..7437d9d488a3 100644
--- a/Tasks/AzurePowerShellV5/task.loc.json
+++ b/Tasks/AzurePowerShellV5/task.loc.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 2
+    "Patch": 4
   },
   "releaseNotes": "ms-resource:loc.releaseNotes",
   "groups": [
diff --git a/Tasks/Common/Sanitizer/ArgumentsSanitizer.ps1 b/Tasks/Common/Sanitizer/ArgumentsSanitizer.ps1
index 0b3ea2f2757c..f11846a39280 100644
--- a/Tasks/Common/Sanitizer/ArgumentsSanitizer.ps1
+++ b/Tasks/Common/Sanitizer/ArgumentsSanitizer.ps1
@@ -12,6 +12,24 @@ Write-Verbose "Feature flag AZP_75787_ENABLE_COLLECT state: $($featureFlags.tele
 
 $taskName = ""
 
+# AST node types that represent code execution (not pure data) and therefore
+# must never appear in a relaxed-mode argument. Kept in one module-level place so
+# the set is easy to audit and extend.
+#   ScriptBlockExpressionAst - { ... }
+#   MemberExpressionAst       - property / method access; its subclass
+#                               InvokeMemberExpressionAst (method calls) is covered too
+#   ConvertExpressionAst      - [type]$x / [type]'s' casts, incl. [ordered]@{} / [pscustomobject]@{}
+#   TypeExpressionAst         - a bare [type] reference (also the right side of -is / -isnot)
+# The -as conversion operator is handled separately in Test-SanitizerArgumentAst
+# because it is a BinaryExpressionAst distinguished by its operator, not a
+# dedicated node type.
+$script:DangerousAstNodeTypes = @(
+    [System.Management.Automation.Language.ScriptBlockExpressionAst],
+    [System.Management.Automation.Language.MemberExpressionAst],
+    [System.Management.Automation.Language.ConvertExpressionAst],
+    [System.Management.Automation.Language.TypeExpressionAst]
+)
+
 # public functions - start
 
 function Get-SanitizerFeatureFlags {
@@ -30,14 +48,26 @@ function Get-SanitizerActivateStatus {
 
 # This is a wrapper for Get-SanitizedArguments to handle feature flags in one place
 # It will return sanitized arguments string if feature flag is enabled
-function Protect-ScriptArguments([string]$inputArgs, [string]$taskName) {
+function Protect-ScriptArguments([string]$inputArgs, [string]$taskName, [switch]$AllowDataConstructors) {
     $script:taskName = $taskName
 
+    # In the relaxed mode, run the structural AST backstop on the RAW arguments
+    # first. This module only validates - it does not rewrite what the task runs -
+    # so the raw string is exactly what PowerShell parses at the dot-source sink.
+    # The relaxed allow-list permits @ { } [ ], which re-enables expressions that
+    # evaluate at bind time (a hashtable value, cast or sub-expression);
+    # Test-SanitizerArgumentAst rejects those while still allowing pure data
+    # literals such as @{ Port = 8080 }.
+    $astSafe = $true
+    if ($AllowDataConstructors) {
+        $astSafe = Test-SanitizerArgumentAst $inputArgs
+    }
+
     $expandedArgs, $expandTelemetry = Expand-EnvVariables $inputArgs;
 
-    $sanitizedArgs, $sanitizeTelemetry = Get-SanitizedArguments -InputArgs $expandedArgs
+    $sanitizedArgs, $sanitizeTelemetry = Get-SanitizedArguments -InputArgs $expandedArgs -AllowDataConstructors:$AllowDataConstructors
 
-    if ($sanitizedArgs -eq $inputArgs) {
+    if (($sanitizedArgs -eq $inputArgs) -and $astSafe) {
         Write-Debug 'Arguments passed sanitization without change.'
     }
     else {
@@ -46,10 +76,16 @@ function Protect-ScriptArguments([string]$inputArgs, [string]$taskName) {
             if ($null -ne $sanitizeTelemetry) {
                 $telemetry += $sanitizeTelemetry;
             }
+            if (-not $astSafe) {
+                if ($null -eq $telemetry) {
+                    $telemetry = @{}
+                }
+                $telemetry.astBackstopRejected = $true
+            }
             Publish-Telemetry $telemetry;
         }
 
-        if ($sanitizedArgs -ne $expandedArgs) {
+        if (($sanitizedArgs -ne $expandedArgs) -or (-not $astSafe)) {
             $message = (Get-VstsLocString -Key 'PS_ScriptArgsSanitized');
 
             if ($featureFlags.activate) {
@@ -69,16 +105,32 @@ function Protect-ScriptArguments([string]$inputArgs, [string]$taskName) {
 # public functions - end
 
 # !ATTENTION: don't write any console output in this method, because it will break result
-function Get-SanitizedArguments([string]$inputArgs) {
+function Get-SanitizedArguments([string]$inputArgs, [switch]$AllowDataConstructors) {
     $removedSymbolSign = '_#removed#_';
     $argsSplitSymbols = '``';
     [string[][]]$matchesChunks = @()
 
     ## PowerShell Regex is case insensitive by default, so we don't need to specify a-zA-Z.
     ## ('?<!`') - checking if before character no backtick.
-    ## ([^\w` _'"-=\/:\.*,+~?%\n#]) - checking if character is allowed. Insead replacing to #removed#
+    ## ([^\w` _'"-=\/:\.*,+~?%\n#]) - checking if character is allowed. Instead replacing to #removed#
     ## (?!true|false) - checking if after characters sequence no $true or $false.
-    $regex = '(?<!`)([^\w\\` _''"\-=\/:\.*,+~?%\n#])(?!true|false)'
+    ##
+    ## Two validation modes exist because there are two groups of tasks:
+    ##   * Strict (default) - the regex below. Used by the long-standing direct
+    ##     callers; their behavior must stay exactly the same.
+    ##   * Relaxed (-AllowDataConstructors) - additionally allows the data-
+    ##     constructor characters @ { } [ ] so legitimate hashtable params are not
+    ##     mangled. Any code execution those characters could re-enable (e.g.
+    ##     @{ k = cmd }) is blocked structurally by Test-SanitizerArgumentAst,
+    ##     not by this allow-list. (@(...) arrays stay blocked in both modes -
+    ##     parentheses are never allowed.)
+    ## Long-term these two modes should be unified into one consistent validation.
+    if ($AllowDataConstructors) {
+        $regex = '(?<!`)([^\w\\` _''"\-=\/:\.*,+~?%\n#@{}\[\]])(?!true|false)'
+    }
+    else {
+        $regex = '(?<!`)([^\w\\` _''"\-=\/:\.*,+~?%\n#])(?!true|false)'
+    }
 
     # We're splitting by ``, removing all suspicious characters and then join
     $argsArr = $inputArgs -split $argsSplitSymbols;
@@ -105,6 +157,82 @@ function Get-SanitizedArguments([string]$inputArgs) {
     return $($resultArgs, $telemetry);
 }
 
+# Structural backstop for the relaxed validation mode.
+#
+# A character allow-list alone cannot tell a data literal from code: once
+# @ { } [ ] are permitted, an argument such as @{ k = New-Item ... },
+# @{ k = $(...) } or @{ k = [type]::Member() } passes the regex yet is an
+# evaluated expression at the dot-source sink - a hashtable value, cast or
+# sub-expression inside a data constructor runs, whereas the same tokens at
+# top-level argument position are inert literal strings.
+#
+# This function parses the raw arguments exactly as the sink does - as the
+# argument list of a command invocation - and rejects anything that is not a
+# plain data literal:
+#   * a parse error,
+#   * a script block, member access / method call, type-cast, the -as
+#     conversion operator, or a bare type reference,
+#   * a nested command (more than the single placeholder CommandAst), which
+#     covers commands embedded in a hashtable value or a chained statement.
+# Pure data literals (@{ Port = 8080 }), variables including $env:VAR, quoted
+# strings and numbers are accepted. (@(...) arrays pass this check but are still
+# rejected by the character allow-list, which does not permit parentheses.)
+#
+# Returns $true when the arguments are safe, $false when a dangerous construct
+# is present.
+function Test-SanitizerArgumentAst([string]$inputArgs) {
+    if ([string]::IsNullOrWhiteSpace($inputArgs)) {
+        return $true
+    }
+
+    $tokens = $null
+    $parseErrors = $null
+    # A literal placeholder command name keeps the parse focused on the argument
+    # expressions and mirrors how the arguments reach the sink.
+    $ast = [System.Management.Automation.Language.Parser]::ParseInput(
+        "& placeholder $inputArgs", [ref]$tokens, [ref]$parseErrors)
+
+    if ($parseErrors -and $parseErrors.Count -gt 0) {
+        return $false
+    }
+
+    # $script:DangerousAstNodeTypes lists the node types that execute code (see its
+    # definition for the rationale). InvokeMemberExpressionAst derives from
+    # MemberExpressionAst, so method calls are covered by that single entry. The -as
+    # conversion operator (a BinaryExpressionAst with the 'As' operator) is the
+    # semantically equivalent form of a [type] cast and likewise invokes the target
+    # type's constructor / type-converter at the sink - verified to execute with both
+    # a [type] literal and a string/variable right operand - so it is rejected here
+    # too. (Top-level type literals passed as plain arguments do not parse as
+    # TypeExpressionAst and remain allowed.)
+    $dangerous = $ast.FindAll({
+            param($node)
+            $isDangerousType = $false
+            foreach ($t in $script:DangerousAstNodeTypes) {
+                if ($node -is $t) { $isDangerousType = $true; break }
+            }
+            $isDangerousType -or
+            (($node -is [System.Management.Automation.Language.BinaryExpressionAst]) -and
+             ($node.Operator -eq [System.Management.Automation.Language.TokenKind]::As))
+        }, $true)
+    if ($dangerous -and $dangerous.Count -gt 0) {
+        return $false
+    }
+
+    # Exactly one CommandAst is expected - our placeholder. Any additional
+    # CommandAst means a command nested inside a data constructor or a chained
+    # statement.
+    $commandAsts = $ast.FindAll({
+            param($node)
+            $node -is [System.Management.Automation.Language.CommandAst]
+        }, $true)
+    if ($commandAsts.Count -gt 1) {
+        return $false
+    }
+
+    return $true
+}
+
 function Publish-Telemetry($telemetry) {
     $area = 'TaskHub'
     $feature = $script:taskName
diff --git a/Tasks/Common/Sanitizer/Invoke-ScriptArgumentSanitization.ps1 b/Tasks/Common/Sanitizer/Invoke-ScriptArgumentSanitization.ps1
index 0ce65db13c95..a5ee4b2646fa 100644
--- a/Tasks/Common/Sanitizer/Invoke-ScriptArgumentSanitization.ps1
+++ b/Tasks/Common/Sanitizer/Invoke-ScriptArgumentSanitization.ps1
@@ -129,7 +129,14 @@ function Invoke-ScriptArgumentSanitization {
     $caughtMessage  = $null
     $caughtStack    = $null
     try {
-        $null = Protect-ScriptArguments -InputArgs $InputArgs -TaskName $TaskName
+        # The dispatcher is the opt-in entry point for the relaxed validation
+        # group (AzurePowerShellV2-V5, ServiceFabricPowerShellV1). They run user
+        # FilePath scripts whose arguments legitimately include hashtable params,
+        # so data constructors are permitted here and the AST backstop inside
+        # Protect-ScriptArguments blocks any that would execute. The other group -
+        # the long-standing direct callers (AzureFileCopy, PowerShell, etc.) - keep
+        # the strict allow-list by not passing this switch.
+        $null = Protect-ScriptArguments -InputArgs $InputArgs -TaskName $TaskName -AllowDataConstructors
     }
     catch {
         $sanitizerThrew = $true
diff --git a/Tasks/Common/Sanitizer/Tests/L0.ts b/Tasks/Common/Sanitizer/Tests/L0.ts
index 51e994cbde1d..6aa106ed70f9 100644
--- a/Tasks/Common/Sanitizer/Tests/L0.ts
+++ b/Tasks/Common/Sanitizer/Tests/L0.ts
@@ -70,4 +70,28 @@ describe('Security Suite', function () {
             psr.run(path.join(__dirname, 'L0Invoke-ScriptArgumentSanitization.ps1'), done);
         });
     }
+
+    if (psm.testSupported()) {
+        it('Test-SanitizerArgumentAst classifies data literals vs. executable expressions', (done) => {
+            psr.run(path.join(__dirname, 'L0Test-SanitizerArgumentAst.ps1'), done);
+        });
+    }
+
+    if (psm.testSupported()) {
+        it('Protect-ScriptArguments allows legitimate data constructors on the relaxed path', (done) => {
+            psr.run(path.join(__dirname, 'L0Protect-ScriptArguments.AllowsDataConstructors.ps1'), done);
+        });
+    }
+
+    if (psm.testSupported()) {
+        it('Protect-ScriptArguments blocks data-constructor injection via the AST backstop', (done) => {
+            psr.run(path.join(__dirname, 'L0Protect-ScriptArguments.BlocksDataConstructorInjection.ps1'), done);
+        });
+    }
+
+    if (psm.testSupported()) {
+        it('Get-SanitizedArguments keeps the strict path unchanged for legacy callers', (done) => {
+            psr.run(path.join(__dirname, 'L0Get-SanitizedArguments.GroupBIsolation.ps1'), done);
+        });
+    }
 });
diff --git a/Tasks/Common/Sanitizer/Tests/L0Get-SanitizedArguments.GroupBIsolation.ps1 b/Tasks/Common/Sanitizer/Tests/L0Get-SanitizedArguments.GroupBIsolation.ps1
new file mode 100644
index 000000000000..44ff25625f15
--- /dev/null
+++ b/Tasks/Common/Sanitizer/Tests/L0Get-SanitizedArguments.GroupBIsolation.ps1
@@ -0,0 +1,34 @@
+[CmdletBinding()]
+param()
+
+. $PSScriptRoot\..\..\..\..\Tests\lib\Initialize-Test.ps1
+. $PSScriptRoot\..\ArgumentsSanitizer.ps1
+
+# Isolation lock. Legacy direct callers (AzureFileCopy, PowerShellV2,
+# PowerShellOnTargetMachines, WindowsMachineFileCopy, Sql*Deployment) call
+# Get-SanitizedArguments / Protect-ScriptArguments WITHOUT -AllowDataConstructors.
+# That strict path must stay byte-for-byte unchanged: the data-constructor
+# characters @ { } [ ] are still treated as forbidden and the AST backstop never
+# runs. Only the new opt-in dispatcher path relaxes them.
+$dataConstructorInput = '@{ Port = 8080 }'
+
+$strict, $null  = Get-SanitizedArguments -InputArgs $dataConstructorInput
+$relaxed, $null = Get-SanitizedArguments -InputArgs $dataConstructorInput -AllowDataConstructors
+
+# Strict (default) path still strips @ { } - legacy behavior preserved.
+Assert-AreNotEqual -NotExpected $dataConstructorInput -Actual $strict `
+    -Message "Strict path must continue to sanitize data-constructor characters for legacy callers"
+
+# Relaxed path leaves the legitimate data constructor intact.
+Assert-AreEqual -Expected $dataConstructorInput -Actual $relaxed `
+    -Message "Relaxed path must preserve legitimate data constructors"
+
+# A bracket-only input behaves the same way: stripped by default, preserved with the switch.
+$bracketInput = 'value[0]'
+$strictBracket, $null  = Get-SanitizedArguments -InputArgs $bracketInput
+$relaxedBracket, $null = Get-SanitizedArguments -InputArgs $bracketInput -AllowDataConstructors
+
+Assert-AreNotEqual -NotExpected $bracketInput -Actual $strictBracket `
+    -Message "Strict path must continue to sanitize bracket characters for legacy callers"
+Assert-AreEqual -Expected $bracketInput -Actual $relaxedBracket `
+    -Message "Relaxed path must preserve bracket characters"
diff --git a/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.AllowsDataConstructors.ps1 b/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.AllowsDataConstructors.ps1
new file mode 100644
index 000000000000..a4d85f6326b3
--- /dev/null
+++ b/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.AllowsDataConstructors.ps1
@@ -0,0 +1,57 @@
+[CmdletBinding()]
+param()
+
+$originalEnableNewLogic = $env:AZP_75787_ENABLE_NEW_LOGIC
+Set-Item -Path env:AZP_75787_ENABLE_NEW_LOGIC -Value 'true'
+
+. $PSScriptRoot\..\..\..\..\Tests\lib\Initialize-Test.ps1
+. $PSScriptRoot\..\ArgumentsSanitizer.ps1
+
+try {
+
+# With -AllowDataConstructors (the path the dispatcher uses for AzurePowerShell
+# and ServiceFabricPowerShell) legitimate hashtable arguments, splatting, bare
+# type / index literals, quoted values and environment variables must pass
+# without being rejected, even though the strict allow-list mangles @ { } [ ].
+$benignInputs = @(
+    @{ Name = 'Plain hashtable';            Input = '@{ Port = 8080 }' },
+    @{ Name = 'Hashtable string value';     Input = '@{ Owner = "user@contoso.com" }' },
+    @{ Name = 'Named hashtable parameter';  Input = '-Tags @{ env = "prod" }' },
+    @{ Name = 'Bare type literal';          Input = '[string]' },
+    @{ Name = 'Type literal parameter';     Input = '-Type [System.String]' },
+    @{ Name = 'Index literal';              Input = '[0]' },
+    @{ Name = 'Splatting variable';         Input = '@params' },
+    @{ Name = 'Boolean';                    Input = '-Enabled $true' },
+    @{ Name = 'Ordinary parameters';        Input = '-Param1 value1 -Param2 value2' },
+    @{ Name = 'Env variable expansion';     Input = 'test $env:VAR1 done'; Variables = @('VAR1=hello') }
+)
+
+foreach ($test in $benignInputs) {
+    if ($null -eq $test.Variables) { $test.Variables = @() }
+    $test.Variables | ForEach-Object {
+        $name, $value = $_.Split('=')
+        if ($value) { Set-Item -Path env:$name -Value $value } else { Remove-Item env:$name -ErrorAction SilentlyContinue }
+    }
+
+    try {
+        Protect-ScriptArguments -InputArgs $test.Input -AllowDataConstructors
+    }
+    catch {
+        throw "Expected '$($test.Name)' input [$($test.Input)] to pass the relaxed sanitizer, but it threw: $($_.Exception.Message)"
+    }
+    finally {
+        $test.Variables | ForEach-Object {
+            $name, $value = $_.Split('=')
+            Remove-Item env:$name -ErrorAction SilentlyContinue
+        }
+    }
+}
+}
+finally {
+    if ($null -eq $originalEnableNewLogic) {
+        Remove-Item env:AZP_75787_ENABLE_NEW_LOGIC -ErrorAction SilentlyContinue
+    }
+    else {
+        Set-Item -Path env:AZP_75787_ENABLE_NEW_LOGIC -Value $originalEnableNewLogic
+    }
+}
diff --git a/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.BlocksDataConstructorInjection.ps1 b/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.BlocksDataConstructorInjection.ps1
new file mode 100644
index 000000000000..95ceea389af3
--- /dev/null
+++ b/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.BlocksDataConstructorInjection.ps1
@@ -0,0 +1,74 @@
+[CmdletBinding()]
+param()
+
+$originalEnableNewLogic = $env:AZP_75787_ENABLE_NEW_LOGIC
+Set-Item -Path env:AZP_75787_ENABLE_NEW_LOGIC -Value 'true'
+
+. $PSScriptRoot\..\..\..\..\Tests\lib\Initialize-Test.ps1
+. $PSScriptRoot\..\ArgumentsSanitizer.ps1
+
+try {
+
+$expectedMsg = Get-VstsLocString -Key 'PS_ScriptArgsSanitized'
+
+# Regression lock for the relaxed validation mode. Each input below uses ONLY
+# characters the relaxed allow-list permits (@ { } [ ] plus letters / paths), so
+# the character regex leaves it unchanged - yet each is an expression that
+# EXECUTES at the dot-source sink (a hashtable value, cast or property getter).
+# The AST backstop is what blocks them. If Test-SanitizerArgumentAst is removed
+# or weakened these become remote code execution.
+$astOnlyInjections = @(
+    @{ Name = 'Command as hashtable value';     Input = '@{ k = New-Item -Path C:\evil.txt -ItemType File -Force }' },
+    @{ Name = 'Get-Content as hashtable value'; Input = '@{ Tag = Get-Content C:\secret.txt }' },
+    @{ Name = 'Cast (adsi) as value';           Input = "@{ k = [adsi]'LDAP://attacker' }" },
+    @{ Name = '-as conversion as value';        Input = "@{ k = 'C:\victim\file.ps1' -as [System.IO.StreamWriter] }" },
+    @{ Name = 'Property getter as value';       Input = '@{ k = [System.Net.Dns]::MachineName }' }
+)
+
+foreach ($test in $astOnlyInjections) {
+    # 1) Prove the AST is load-bearing: the relaxed CHARACTER allow-list alone
+    #    does NOT alter these inputs, so the regex path would let them through.
+    $sanitized, $null = Get-SanitizedArguments -InputArgs $test.Input -AllowDataConstructors
+    Assert-AreEqual -Expected $test.Input -Actual $sanitized `
+        -Message "'$($test.Name)' must be carried by the AST backstop, not the character regex (regex altered it unexpectedly)."
+
+    # 2) The AST predicate rejects it.
+    Assert-AreEqual -Expected $false -Actual (Test-SanitizerArgumentAst $test.Input) `
+        -Message "Test-SanitizerArgumentAst should reject '$($test.Name)' [$($test.Input)]"
+
+    # 3) The integrated relaxed path fails closed (throws) with activate on.
+    try {
+        Assert-Throws { Protect-ScriptArguments -InputArgs $test.Input -AllowDataConstructors } -MessagePattern $expectedMsg
+    }
+    catch {
+        throw "Expected '$($test.Name)' [$($test.Input)] to be blocked by the relaxed sanitizer, but: $($_.Exception.Message)"
+    }
+}
+
+# Defense in depth: the dangerous characters the relaxed list still forbids
+# ( $ ( ) ; & | ) must remain blocked on the relaxed path as well.
+$charInjections = @(
+    'test; whoami',
+    'test && whoami',
+    'echo "$(rm ./x)"',
+    'test | whoami',
+    '@{ k = $(whoami) }'
+)
+
+foreach ($badInput in $charInjections) {
+    try {
+        Assert-Throws { Protect-ScriptArguments -InputArgs $badInput -AllowDataConstructors } -MessagePattern $expectedMsg
+    }
+    catch {
+        throw "Expected dangerous characters in [$badInput] to be blocked on the relaxed path, but: $($_.Exception.Message)"
+    }
+}
+}
+finally {
+    if ($null -eq $originalEnableNewLogic) {
+        Remove-Item env:AZP_75787_ENABLE_NEW_LOGIC -ErrorAction SilentlyContinue
+    }
+    else {
+        Set-Item -Path env:AZP_75787_ENABLE_NEW_LOGIC -Value $originalEnableNewLogic
+    }
+}
diff --git a/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.Passes.ps1 b/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.Passes.ps1
index 9521cda5c2b3..3057c19c3050 100644
--- a/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.Passes.ps1
+++ b/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.Passes.ps1
@@ -1,11 +1,14 @@
 [CmdletBinding()]
 param()
 
+$originalEnableNewLogic = $env:AZP_75787_ENABLE_NEW_LOGIC
 Set-Item -Path env:AZP_75787_ENABLE_NEW_LOGIC -Value 'true'
 
 . $PSScriptRoot\..\..\..\..\Tests\lib\Initialize-Test.ps1
 . $PSScriptRoot\..\ArgumentsSanitizer.ps1
 
+try {
+
 $testSuites = @(
     @{
         Name  = 'Handles empty line'
@@ -117,3 +120,12 @@ foreach ($test in $testSuites) {
         }
     }
 }
+}
+finally {
+    if ($null -eq $originalEnableNewLogic) {
+        Remove-Item env:AZP_75787_ENABLE_NEW_LOGIC -ErrorAction SilentlyContinue
+    }
+    else {
+        Set-Item -Path env:AZP_75787_ENABLE_NEW_LOGIC -Value $originalEnableNewLogic
+    }
+}
diff --git a/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.Throws.ps1 b/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.Throws.ps1
index 3602df85798c..93c1fb8c2bbe 100644
--- a/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.Throws.ps1
+++ b/Tasks/Common/Sanitizer/Tests/L0Protect-ScriptArguments.Throws.ps1
@@ -1,11 +1,14 @@
 [CmdletBinding()]
 param()
 
+$originalEnableNewLogic = $env:AZP_75787_ENABLE_NEW_LOGIC
 Set-Item -Path env:AZP_75787_ENABLE_NEW_LOGIC -Value 'true'
 
 . $PSScriptRoot\..\..\..\..\Tests\lib\Initialize-Test.ps1
 . $PSScriptRoot\..\ArgumentsSanitizer.ps1
 
+try {
+
 $testSuites = @(
     @{
         Name      = 'If dangerous symbols are present, and FF is on'
@@ -66,3 +69,12 @@ foreach ($test in $testSuites) {
         }
     }
 }
+}
+finally {
+    if ($null -eq $originalEnableNewLogic) {
+        Remove-Item env:AZP_75787_ENABLE_NEW_LOGIC -ErrorAction SilentlyContinue
+    }
+    else {
+        Set-Item -Path env:AZP_75787_ENABLE_NEW_LOGIC -Value $originalEnableNewLogic
+    }
+}
diff --git a/Tasks/Common/Sanitizer/Tests/L0Test-SanitizerArgumentAst.ps1 b/Tasks/Common/Sanitizer/Tests/L0Test-SanitizerArgumentAst.ps1
new file mode 100644
index 000000000000..a6d53ddb751d
--- /dev/null
+++ b/Tasks/Common/Sanitizer/Tests/L0Test-SanitizerArgumentAst.ps1
@@ -0,0 +1,58 @@
+[CmdletBinding()]
+param()
+
+. $PSScriptRoot\..\..\..\..\Tests\lib\Initialize-Test.ps1
+. $PSScriptRoot\..\ArgumentsSanitizer.ps1
+
+# Unit tests for the structural AST backstop used by the relaxed
+# (-AllowDataConstructors) sanitizer path. Returns $true for pure data literals
+# and $false for anything that evaluates / executes at the dot-source sink.
+
+# SAFE: data literals, variables (incl. $env:), quoted strings, bare type/index
+# literals and ordinary parameters - none of these execute code.
+$safe = @(
+    '',
+    '   ',
+    '-Param1 value1 -Param2 value2',
+    '@{ Port = 8080 }',
+    '@{ Owner = "user@contoso.com" }',
+    "-Tags @{ env = 'prod' }",
+    '@params',
+    '[string]',
+    '[0]',
+    '-Type [System.String]',
+    '$env:BUILD_REQUESTEDFOR',
+    'value.txt',
+    '-Path D:\my\path',
+    '-Flag $true'
+)
+
+# UNSAFE: every item is an expression that evaluates at the sink when it appears
+# inside a data constructor (hashtable value, array element) or as a chained
+# statement. Verified against the real '. <script> <args>' / '& <script> <args>'
+# sinks: these run code; the AST is the only reliable way to tell them apart from
+# the data literals above, because they use only allow-listed characters.
+$unsafe = @(
+    '@{ k = New-Item -Path C:\evil.txt -ItemType File -Force }', # nested command
+    '@{ Tag = Get-Content C:\secret.txt }',                      # nested command
+    '@{ k = $(whoami) }',                                        # sub-expression
+    "@{ k = [adsi]'LDAP://x' }",                                 # type cast
+    "@{ k = 'C:\victim\file.ps1' -as [System.IO.StreamWriter] }",# -as conversion (type literal)
+    "@{ When = '2024-01-01' -as [datetime] }",                   # -as conversion (value type)
+    '@{ k = [System.IO.StreamWriter] }',                         # bare type reference
+    '@{ k = [System.Net.Dns]::MachineName }',                    # property getter
+    '@{ k = [System.IO.File]::WriteAllText("a","b") }',          # method call
+    '@( New-Item C:\evil.txt )',                                 # command in array
+    '{ whoami }',                                                # script block
+    '@{ k = { whoami } }',                                       # script block value
+    'value; whoami',                                             # chained statement
+    'a | whoami'                                                 # pipeline
+)
+
+foreach ($s in $safe) {
+    Assert-AreEqual -Expected $true -Actual (Test-SanitizerArgumentAst $s) -Message "Expected SAFE: [$s]"
+}
+
+foreach ($u in $unsafe) {
+    Assert-AreEqual -Expected $false -Actual (Test-SanitizerArgumentAst $u) -Message "Expected UNSAFE: [$u]"
+}
diff --git a/Tasks/PowerShellOnTargetMachinesV3/task.json b/Tasks/PowerShellOnTargetMachinesV3/task.json
index 5b19386ad6fa..3d66c49f3179 100644
--- a/Tasks/PowerShellOnTargetMachinesV3/task.json
+++ b/Tasks/PowerShellOnTargetMachinesV3/task.json
@@ -14,7 +14,7 @@
     "version": {
         "Major": 3,
         "Minor": 276,
-        "Patch": 0
+        "Patch": 1
     },
     "groups": [
         {
diff --git a/Tasks/PowerShellOnTargetMachinesV3/task.loc.json b/Tasks/PowerShellOnTargetMachinesV3/task.loc.json
index 156e9084a86c..fd574fe89a14 100644
--- a/Tasks/PowerShellOnTargetMachinesV3/task.loc.json
+++ b/Tasks/PowerShellOnTargetMachinesV3/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 3,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 1
   },
   "groups": [
     {
diff --git a/Tasks/PowerShellV2/task.json b/Tasks/PowerShellV2/task.json
index fc9bfbd9b541..59e2c4e5bba9 100644
--- a/Tasks/PowerShellV2/task.json
+++ b/Tasks/PowerShellV2/task.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 2,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 1
   },
   "releaseNotes": "Script task consistency. Added support for macOS and Linux.",
   "minimumAgentVersion": "2.115.0",
diff --git a/Tasks/PowerShellV2/task.loc.json b/Tasks/PowerShellV2/task.loc.json
index 6e7690418bd3..2af2c2396e91 100644
--- a/Tasks/PowerShellV2/task.loc.json
+++ b/Tasks/PowerShellV2/task.loc.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 2,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 1
   },
   "releaseNotes": "ms-resource:loc.releaseNotes",
   "minimumAgentVersion": "2.115.0",
diff --git a/Tasks/ServiceFabricPowerShellV1/task.json b/Tasks/ServiceFabricPowerShellV1/task.json
index 89a9713d94a5..24beb7d3b2f1 100644
--- a/Tasks/ServiceFabricPowerShellV1/task.json
+++ b/Tasks/ServiceFabricPowerShellV1/task.json
@@ -18,7 +18,7 @@
     "version": {
         "Major": 1,
         "Minor": 276,
-        "Patch": 0
+        "Patch": 1
     },
     "demands": [
         "Cmd"
diff --git a/Tasks/ServiceFabricPowerShellV1/task.loc.json b/Tasks/ServiceFabricPowerShellV1/task.loc.json
index 8193fa6b431f..0268d6d11ab2 100644
--- a/Tasks/ServiceFabricPowerShellV1/task.loc.json
+++ b/Tasks/ServiceFabricPowerShellV1/task.loc.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 1,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 1
   },
   "demands": [
     "Cmd"
diff --git a/Tasks/SqlAzureDacpacDeploymentV1/task.json b/Tasks/SqlAzureDacpacDeploymentV1/task.json
index 9dfd5dd8a17c..1fe35145eb86 100644
--- a/Tasks/SqlAzureDacpacDeploymentV1/task.json
+++ b/Tasks/SqlAzureDacpacDeploymentV1/task.json
@@ -17,7 +17,7 @@
     "version": {
         "Major": 1,
         "Minor": 276,
-        "Patch": 1
+        "Patch": 2
     },
     "demands": [
         "sqlpackage"
diff --git a/Tasks/SqlAzureDacpacDeploymentV1/task.loc.json b/Tasks/SqlAzureDacpacDeploymentV1/task.loc.json
index 63c78902def8..b0a5fa50c5bd 100644
--- a/Tasks/SqlAzureDacpacDeploymentV1/task.loc.json
+++ b/Tasks/SqlAzureDacpacDeploymentV1/task.loc.json
@@ -17,7 +17,7 @@
   "version": {
     "Major": 1,
     "Minor": 276,
-    "Patch": 1
+    "Patch": 2
   },
   "demands": [
     "sqlpackage"
diff --git a/Tasks/SqlDacpacDeploymentOnMachineGroupV0/task.json b/Tasks/SqlDacpacDeploymentOnMachineGroupV0/task.json
index 6065558ca1f5..9e275d098a67 100644
--- a/Tasks/SqlDacpacDeploymentOnMachineGroupV0/task.json
+++ b/Tasks/SqlDacpacDeploymentOnMachineGroupV0/task.json
@@ -17,7 +17,7 @@
     "version": {
         "Major": 0,
         "Minor": 276,
-        "Patch": 1
+        "Patch": 2
     },
     "demands": [],
     "minimumAgentVersion": "1.102.0",
diff --git a/Tasks/SqlDacpacDeploymentOnMachineGroupV0/task.loc.json b/Tasks/SqlDacpacDeploymentOnMachineGroupV0/task.loc.json
index 357dbaf98d7c..c2b2fc267c67 100644
--- a/Tasks/SqlDacpacDeploymentOnMachineGroupV0/task.loc.json
+++ b/Tasks/SqlDacpacDeploymentOnMachineGroupV0/task.loc.json
@@ -17,7 +17,7 @@
   "version": {
     "Major": 0,
     "Minor": 276,
-    "Patch": 1
+    "Patch": 2
   },
   "demands": [],
   "minimumAgentVersion": "1.102.0",
diff --git a/Tasks/WindowsMachineFileCopyV1/task.json b/Tasks/WindowsMachineFileCopyV1/task.json
index e01af46e1be2..25e59bbe27eb 100644
--- a/Tasks/WindowsMachineFileCopyV1/task.json
+++ b/Tasks/WindowsMachineFileCopyV1/task.json
@@ -14,7 +14,7 @@
     "version": {
         "Major": 1,
         "Minor": 276,
-        "Patch": 1
+        "Patch": 2
     },
     "minimumAgentVersion": "1.104.0",
     "groups": [
diff --git a/Tasks/WindowsMachineFileCopyV1/task.loc.json b/Tasks/WindowsMachineFileCopyV1/task.loc.json
index 7d39ba0de667..785d4ce1aed0 100644
--- a/Tasks/WindowsMachineFileCopyV1/task.loc.json
+++ b/Tasks/WindowsMachineFileCopyV1/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 1,
     "Minor": 276,
-    "Patch": 1
+    "Patch": 2
   },
   "minimumAgentVersion": "1.104.0",
   "groups": [
diff --git a/Tasks/WindowsMachineFileCopyV2/task.json b/Tasks/WindowsMachineFileCopyV2/task.json
index cae573ecd854..46e9295cce85 100644
--- a/Tasks/WindowsMachineFileCopyV2/task.json
+++ b/Tasks/WindowsMachineFileCopyV2/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 2,
     "Minor": 276,
-    "Patch": 1
+    "Patch": 2
   },
   "releaseNotes": "What's new in Version 2.0: <br/>&nbsp;&nbsp;Proxy support is being added. <br/>&nbsp;&nbsp; Removed support of legacy DTL machines.",
   "minimumAgentVersion": "1.104.0",
diff --git a/Tasks/WindowsMachineFileCopyV2/task.loc.json b/Tasks/WindowsMachineFileCopyV2/task.loc.json
index 3f608145f7b5..08c2f2afe57d 100644
--- a/Tasks/WindowsMachineFileCopyV2/task.loc.json
+++ b/Tasks/WindowsMachineFileCopyV2/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 2,
     "Minor": 276,
-    "Patch": 1
+    "Patch": 2
   },
   "releaseNotes": "ms-resource:loc.releaseNotes",
   "minimumAgentVersion": "1.104.0",
diff --git a/_generated/AzureFileCopyV4.versionmap.txt b/_generated/AzureFileCopyV4.versionmap.txt
index 84a42890ec6d..04a5e95c05d0 100644
--- a/_generated/AzureFileCopyV4.versionmap.txt
+++ b/_generated/AzureFileCopyV4.versionmap.txt
@@ -1,2 +1,2 @@
-Default|4.276.0
-Node24_1|4.276.1
+Default|4.276.2
+Node24_1|4.276.3
diff --git a/_generated/AzureFileCopyV4/task.json b/_generated/AzureFileCopyV4/task.json
index 702118d2bac5..2e534610cbb7 100644
--- a/_generated/AzureFileCopyV4/task.json
+++ b/_generated/AzureFileCopyV4/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
@@ -309,8 +309,8 @@
     "ServicePrincipalError": "There was an error with the service principal used for the deployment."
   },
   "_buildConfigMapping": {
-    "Default": "4.276.0",
+    "Default": "4.276.2",
     "LocalPackages": "4.249.4",
-    "Node24_1": "4.276.1"
+    "Node24_1": "4.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzureFileCopyV4/task.loc.json b/_generated/AzureFileCopyV4/task.loc.json
index 22e124920fcb..7303c573b510 100644
--- a/_generated/AzureFileCopyV4/task.loc.json
+++ b/_generated/AzureFileCopyV4/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
@@ -309,8 +309,8 @@
     "ServicePrincipalError": "ms-resource:loc.messages.ServicePrincipalError"
   },
   "_buildConfigMapping": {
-    "Default": "4.276.0",
+    "Default": "4.276.2",
     "LocalPackages": "4.249.4",
-    "Node24_1": "4.276.1"
+    "Node24_1": "4.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzureFileCopyV4_Node24/task.json b/_generated/AzureFileCopyV4_Node24/task.json
index 21c0a36a3369..c6239d5c4de7 100644
--- a/_generated/AzureFileCopyV4_Node24/task.json
+++ b/_generated/AzureFileCopyV4_Node24/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 1
+    "Patch": 3
   },
   "demands": [
     "azureps"
@@ -309,8 +309,8 @@
     "ServicePrincipalError": "There was an error with the service principal used for the deployment."
   },
   "_buildConfigMapping": {
-    "Default": "4.276.0",
+    "Default": "4.276.2",
     "LocalPackages": "4.249.4",
-    "Node24_1": "4.276.1"
+    "Node24_1": "4.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzureFileCopyV4_Node24/task.loc.json b/_generated/AzureFileCopyV4_Node24/task.loc.json
index aaf7ef351a88..3d6f90ee64d7 100644
--- a/_generated/AzureFileCopyV4_Node24/task.loc.json
+++ b/_generated/AzureFileCopyV4_Node24/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 1
+    "Patch": 3
   },
   "demands": [
     "azureps"
@@ -309,8 +309,8 @@
     "ServicePrincipalError": "ms-resource:loc.messages.ServicePrincipalError"
   },
   "_buildConfigMapping": {
-    "Default": "4.276.0",
+    "Default": "4.276.2",
     "LocalPackages": "4.249.4",
-    "Node24_1": "4.276.1"
+    "Node24_1": "4.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzureFileCopyV5.versionmap.txt b/_generated/AzureFileCopyV5.versionmap.txt
index a9036fd0ebb0..4f73eda08d7c 100644
--- a/_generated/AzureFileCopyV5.versionmap.txt
+++ b/_generated/AzureFileCopyV5.versionmap.txt
@@ -1,2 +1,2 @@
-Default|5.276.0
-Node24_1|5.276.1
+Default|5.276.2
+Node24_1|5.276.3
diff --git a/_generated/AzureFileCopyV5/task.json b/_generated/AzureFileCopyV5/task.json
index 45a8fa7d239d..6e846ebfab28 100644
--- a/_generated/AzureFileCopyV5/task.json
+++ b/_generated/AzureFileCopyV5/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
@@ -309,8 +309,8 @@
     "AzModuleNotFound": "Could not find the modules: 'Az.Accounts'. If the module was recently installed, retry after restarting the Azure Pipelines task agent."
   },
   "_buildConfigMapping": {
-    "Default": "5.276.0",
+    "Default": "5.276.2",
     "LocalPackages": "5.249.4",
-    "Node24_1": "5.276.1"
+    "Node24_1": "5.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzureFileCopyV5/task.loc.json b/_generated/AzureFileCopyV5/task.loc.json
index 9fbd2290b79c..49c1ab7fffe1 100644
--- a/_generated/AzureFileCopyV5/task.loc.json
+++ b/_generated/AzureFileCopyV5/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
@@ -309,8 +309,8 @@
     "AzModuleNotFound": "ms-resource:loc.messages.AzModuleNotFound"
   },
   "_buildConfigMapping": {
-    "Default": "5.276.0",
+    "Default": "5.276.2",
     "LocalPackages": "5.249.4",
-    "Node24_1": "5.276.1"
+    "Node24_1": "5.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzureFileCopyV5_Node24/task.json b/_generated/AzureFileCopyV5_Node24/task.json
index d1be5493ca97..58aaf2c8442e 100644
--- a/_generated/AzureFileCopyV5_Node24/task.json
+++ b/_generated/AzureFileCopyV5_Node24/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 1
+    "Patch": 3
   },
   "demands": [
     "azureps"
@@ -309,8 +309,8 @@
     "AzModuleNotFound": "Could not find the modules: 'Az.Accounts'. If the module was recently installed, retry after restarting the Azure Pipelines task agent."
   },
   "_buildConfigMapping": {
-    "Default": "5.276.0",
+    "Default": "5.276.2",
     "LocalPackages": "5.249.4",
-    "Node24_1": "5.276.1"
+    "Node24_1": "5.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzureFileCopyV5_Node24/task.loc.json b/_generated/AzureFileCopyV5_Node24/task.loc.json
index a397f9335479..60f8b694ddf8 100644
--- a/_generated/AzureFileCopyV5_Node24/task.loc.json
+++ b/_generated/AzureFileCopyV5_Node24/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 1
+    "Patch": 3
   },
   "demands": [
     "azureps"
@@ -309,8 +309,8 @@
     "AzModuleNotFound": "ms-resource:loc.messages.AzModuleNotFound"
   },
   "_buildConfigMapping": {
-    "Default": "5.276.0",
+    "Default": "5.276.2",
     "LocalPackages": "5.249.4",
-    "Node24_1": "5.276.1"
+    "Node24_1": "5.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzureFileCopyV6.versionmap.txt b/_generated/AzureFileCopyV6.versionmap.txt
index feb695ceeae9..2bab1f383c62 100644
--- a/_generated/AzureFileCopyV6.versionmap.txt
+++ b/_generated/AzureFileCopyV6.versionmap.txt
@@ -1,2 +1,2 @@
-Default|6.276.0
-Node24_1|6.276.1
+Default|6.276.2
+Node24_1|6.276.3
diff --git a/_generated/AzureFileCopyV6/task.json b/_generated/AzureFileCopyV6/task.json
index 1eee804b4a4e..968303123f96 100644
--- a/_generated/AzureFileCopyV6/task.json
+++ b/_generated/AzureFileCopyV6/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 6,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
@@ -296,8 +296,8 @@
     "AzModuleNotFound": "Could not find the modules: 'Az.Accounts'. If the module was recently installed, retry after restarting the Azure Pipelines task agent."
   },
   "_buildConfigMapping": {
-    "Default": "6.276.0",
+    "Default": "6.276.2",
     "LocalPackages": "6.249.4",
-    "Node24_1": "6.276.1"
+    "Node24_1": "6.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzureFileCopyV6/task.loc.json b/_generated/AzureFileCopyV6/task.loc.json
index d5d077bb54c1..b16794169ae7 100644
--- a/_generated/AzureFileCopyV6/task.loc.json
+++ b/_generated/AzureFileCopyV6/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 6,
     "Minor": 276,
-    "Patch": 0
+    "Patch": 2
   },
   "demands": [
     "azureps"
@@ -296,8 +296,8 @@
     "AzModuleNotFound": "ms-resource:loc.messages.AzModuleNotFound"
   },
   "_buildConfigMapping": {
-    "Default": "6.276.0",
+    "Default": "6.276.2",
     "LocalPackages": "6.249.4",
-    "Node24_1": "6.276.1"
+    "Node24_1": "6.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzureFileCopyV6_Node24/task.json b/_generated/AzureFileCopyV6_Node24/task.json
index 33feb3e0d56c..ca21d918bbfe 100644
--- a/_generated/AzureFileCopyV6_Node24/task.json
+++ b/_generated/AzureFileCopyV6_Node24/task.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 6,
     "Minor": 276,
-    "Patch": 1
+    "Patch": 3
   },
   "demands": [
     "azureps"
@@ -296,8 +296,8 @@
     "AzModuleNotFound": "Could not find the modules: 'Az.Accounts'. If the module was recently installed, retry after restarting the Azure Pipelines task agent."
   },
   "_buildConfigMapping": {
-    "Default": "6.276.0",
+    "Default": "6.276.2",
     "LocalPackages": "6.249.4",
-    "Node24_1": "6.276.1"
+    "Node24_1": "6.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzureFileCopyV6_Node24/task.loc.json b/_generated/AzureFileCopyV6_Node24/task.loc.json
index 04faa5f7e5cc..d1cfd052965b 100644
--- a/_generated/AzureFileCopyV6_Node24/task.loc.json
+++ b/_generated/AzureFileCopyV6_Node24/task.loc.json
@@ -14,7 +14,7 @@
   "version": {
     "Major": 6,
     "Minor": 276,
-    "Patch": 1
+    "Patch": 3
   },
   "demands": [
     "azureps"
@@ -296,8 +296,8 @@
     "AzModuleNotFound": "ms-resource:loc.messages.AzModuleNotFound"
   },
   "_buildConfigMapping": {
-    "Default": "6.276.0",
+    "Default": "6.276.2",
     "LocalPackages": "6.249.4",
-    "Node24_1": "6.276.1"
+    "Node24_1": "6.276.3"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzurePowerShellV4.versionmap.txt b/_generated/AzurePowerShellV4.versionmap.txt
index 04a5e95c05d0..21068d8f0af5 100644
--- a/_generated/AzurePowerShellV4.versionmap.txt
+++ b/_generated/AzurePowerShellV4.versionmap.txt
@@ -1,2 +1,2 @@
-Default|4.276.2
-Node24_1|4.276.3
+Default|4.276.4
+Node24_1|4.276.5
diff --git a/_generated/AzurePowerShellV4/task.json b/_generated/AzurePowerShellV4/task.json
index a1d5e9f015dc..a9da8c8004f6 100644
--- a/_generated/AzurePowerShellV4/task.json
+++ b/_generated/AzurePowerShellV4/task.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 2
+    "Patch": 4
   },
   "releaseNotes": "Added support for Az Module and cross platform agents.",
   "groups": [
@@ -215,8 +215,8 @@
     "ExpiredServicePrincipal": "Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired."
   },
   "_buildConfigMapping": {
-    "Default": "4.276.2",
+    "Default": "4.276.4",
     "LocalPackages": "4.249.4",
-    "Node24_1": "4.276.3"
+    "Node24_1": "4.276.5"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzurePowerShellV4/task.loc.json b/_generated/AzurePowerShellV4/task.loc.json
index c8a103cf80cf..9c9ca633a4ec 100644
--- a/_generated/AzurePowerShellV4/task.loc.json
+++ b/_generated/AzurePowerShellV4/task.loc.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 2
+    "Patch": 4
   },
   "releaseNotes": "ms-resource:loc.releaseNotes",
   "groups": [
@@ -215,8 +215,8 @@
     "ExpiredServicePrincipal": "ms-resource:loc.messages.ExpiredServicePrincipal"
   },
   "_buildConfigMapping": {
-    "Default": "4.276.2",
+    "Default": "4.276.4",
     "LocalPackages": "4.249.4",
-    "Node24_1": "4.276.3"
+    "Node24_1": "4.276.5"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzurePowerShellV4_Node24/task.json b/_generated/AzurePowerShellV4_Node24/task.json
index 08fec52260ec..790cbe296936 100644
--- a/_generated/AzurePowerShellV4_Node24/task.json
+++ b/_generated/AzurePowerShellV4_Node24/task.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 3
+    "Patch": 5
   },
   "releaseNotes": "Added support for Az Module and cross platform agents.",
   "groups": [
@@ -219,8 +219,8 @@
     "ExpiredServicePrincipal": "Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired."
   },
   "_buildConfigMapping": {
-    "Default": "4.276.2",
+    "Default": "4.276.4",
     "LocalPackages": "4.249.4",
-    "Node24_1": "4.276.3"
+    "Node24_1": "4.276.5"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzurePowerShellV4_Node24/task.loc.json b/_generated/AzurePowerShellV4_Node24/task.loc.json
index 38fde8b55513..384a95075cd2 100644
--- a/_generated/AzurePowerShellV4_Node24/task.loc.json
+++ b/_generated/AzurePowerShellV4_Node24/task.loc.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 4,
     "Minor": 276,
-    "Patch": 3
+    "Patch": 5
   },
   "releaseNotes": "ms-resource:loc.releaseNotes",
   "groups": [
@@ -219,8 +219,8 @@
     "ExpiredServicePrincipal": "ms-resource:loc.messages.ExpiredServicePrincipal"
   },
   "_buildConfigMapping": {
-    "Default": "4.276.2",
+    "Default": "4.276.4",
     "LocalPackages": "4.249.4",
-    "Node24_1": "4.276.3"
+    "Node24_1": "4.276.5"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzurePowerShellV5.versionmap.txt b/_generated/AzurePowerShellV5.versionmap.txt
index 4f73eda08d7c..c48c0e3bc594 100644
--- a/_generated/AzurePowerShellV5.versionmap.txt
+++ b/_generated/AzurePowerShellV5.versionmap.txt
@@ -1,2 +1,2 @@
-Default|5.276.2
-Node24_1|5.276.3
+Default|5.276.4
+Node24_1|5.276.5
diff --git a/_generated/AzurePowerShellV5/task.json b/_generated/AzurePowerShellV5/task.json
index 42908ffd3c0d..cdfadbb83a40 100644
--- a/_generated/AzurePowerShellV5/task.json
+++ b/_generated/AzurePowerShellV5/task.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 2
+    "Patch": 4
   },
   "releaseNotes": "Added support for Az Module and cross platform agents.",
   "groups": [
@@ -209,8 +209,8 @@
     "Az_LowerVersionWarning": "Specified {0} version {1} is out of date, the latest version is {2}"
   },
   "_buildConfigMapping": {
-    "Default": "5.276.2",
+    "Default": "5.276.4",
     "LocalPackages": "5.249.4",
-    "Node24_1": "5.276.3"
+    "Node24_1": "5.276.5"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzurePowerShellV5/task.loc.json b/_generated/AzurePowerShellV5/task.loc.json
index d38dd209f0e1..a4fb2fdc8271 100644
--- a/_generated/AzurePowerShellV5/task.loc.json
+++ b/_generated/AzurePowerShellV5/task.loc.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 2
+    "Patch": 4
   },
   "releaseNotes": "ms-resource:loc.releaseNotes",
   "groups": [
@@ -209,8 +209,8 @@
     "Az_LowerVersionWarning": "ms-resource:loc.messages.Az_LowerVersionWarning"
   },
   "_buildConfigMapping": {
-    "Default": "5.276.2",
+    "Default": "5.276.4",
     "LocalPackages": "5.249.4",
-    "Node24_1": "5.276.3"
+    "Node24_1": "5.276.5"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzurePowerShellV5_Node24/task.json b/_generated/AzurePowerShellV5_Node24/task.json
index 3d8060ca1ff0..b7166d9e3677 100644
--- a/_generated/AzurePowerShellV5_Node24/task.json
+++ b/_generated/AzurePowerShellV5_Node24/task.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 3
+    "Patch": 5
   },
   "releaseNotes": "Added support for Az Module and cross platform agents.",
   "groups": [
@@ -213,8 +213,8 @@
     "Az_LowerVersionWarning": "Specified {0} version {1} is out of date, the latest version is {2}"
   },
   "_buildConfigMapping": {
-    "Default": "5.276.2",
+    "Default": "5.276.4",
     "LocalPackages": "5.249.4",
-    "Node24_1": "5.276.3"
+    "Node24_1": "5.276.5"
   }
 }
\ No newline at end of file
diff --git a/_generated/AzurePowerShellV5_Node24/task.loc.json b/_generated/AzurePowerShellV5_Node24/task.loc.json
index 46b35f0c3978..ab9864e708d3 100644
--- a/_generated/AzurePowerShellV5_Node24/task.loc.json
+++ b/_generated/AzurePowerShellV5_Node24/task.loc.json
@@ -18,7 +18,7 @@
   "version": {
     "Major": 5,
     "Minor": 276,
-    "Patch": 3
+    "Patch": 5
   },
   "releaseNotes": "ms-resource:loc.releaseNotes",
   "groups": [
@@ -213,8 +213,8 @@
     "Az_LowerVersionWarning": "ms-resource:loc.messages.Az_LowerVersionWarning"
   },
   "_buildConfigMapping": {
-    "Default": "5.276.2",
+    "Default": "5.276.4",
     "LocalPackages": "5.249.4",
-    "Node24_1": "5.276.3"
+    "Node24_1": "5.276.5"
   }
 }
\ No newline at end of file