diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 99184d9..d224759 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,9 +55,18 @@ jobs:
 
       - name: Run fuzzer smoke test
         working-directory: CosmosDBShell.Fuzzer
-        run: dotnet run --configuration $env:BUILD_CONFIGURATION --no-build -- --all
+        run: dotnet run --configuration $env:BUILD_CONFIGURATION --no-build --no-restore -- --all
         shell: pwsh
 
+      - name: Fail if fuzzer crash findings exist
+        shell: pwsh
+        run: |
+          $crashes = Get-ChildItem -Path CosmosDBShell.Fuzzer/findings -Filter 'crash_*.txt' -ErrorAction SilentlyContinue
+          if ($crashes -and $crashes.Count -gt 0) {
+            Write-Error "Fuzzer recorded $($crashes.Count) crash(es). See the 'fuzz-findings' artifact for details."
+            exit 1
+          }
+
       - name: Upload test results
         if: always()
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/package-unsigned.yml b/.github/workflows/package-unsigned.yml
index 56c25b4..0165a4e 100644
--- a/.github/workflows/package-unsigned.yml
+++ b/.github/workflows/package-unsigned.yml
@@ -125,6 +125,9 @@ jobs:
             --no-restore `
             --output out/nupkg `
             /p:PackageVersion=${{ steps.version.outputs.package_version }} `
+            /p:Version=${{ steps.version.outputs.package_version }} `
+            /p:FileVersion=${{ steps.version.outputs.file_version }} `
+            /p:InformationalVersion=${{ steps.version.outputs.informational_version }} `
             /p:ContinuousIntegrationBuild=true
 
       - name: Validate NuGet package set
diff --git a/.pipelines/CosmosDB-Shell-Official.yml b/.pipelines/CosmosDB-Shell-Official.yml
index 3f1af9b..3c0ca7c 100644
--- a/.pipelines/CosmosDB-Shell-Official.yml
+++ b/.pipelines/CosmosDB-Shell-Official.yml
@@ -18,6 +18,10 @@ parameters: # parameters are shown up in ADO UI in a build queue time
     displayName: "Enable debug output"
     type: boolean
     default: false
+  - name: "publishNuget"
+    displayName: "Publish NuGet packages to internal feed"
+    type: boolean
+    default: true
 
 variables:
   CDP_DEFINITION_BUILD_COUNT: $[counter('', 0)] # needed for onebranch.pipeline.version task https://aka.ms/obpipelines/versioning
@@ -122,6 +126,7 @@ extends:
                     if ($buildNumber -ne $version) {
                       Write-Host "Updating Build.BuildNumber to normalized NuGet version: $version"
                       Write-Host "##vso[build.updatebuildnumber]$version"
+                      $buildNumber = $version
                     }
 
                     $fileVersion = $version
@@ -494,7 +499,9 @@ extends:
 
               - task: NuGetCommand@2
                 displayName: "Push RID-specific NuGet packages"
-                condition: succeeded()
+                condition: and(succeeded(),
+                  eq(variables['Build.SourceBranch'], 'refs/heads/main'),
+                  eq('${{ parameters.publishNuget }}', 'true'))
                 inputs:
                   command: "push"
                   packagesToPush: |
@@ -508,7 +515,9 @@ extends:
                   allowPackageConflicts: true
               - task: NuGetCommand@2
                 displayName: "Push pointer NuGet package"
-                condition: succeeded()
+                condition: and(succeeded(),
+                  eq(variables['Build.SourceBranch'], 'refs/heads/main'),
+                  eq('${{ parameters.publishNuget }}', 'true'))
                 inputs:
                   command: "push"
                   packagesToPush: "$(Build.SourcesDirectory)\\out\\nupkg\\CosmosDBShell.$(CosmosDBShell_Version).nupkg"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 22a2ad8..e6703b2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -23,7 +23,7 @@ There are several ways you can contribute to the CosmosDBShell project:
   - Build: `dotnet build CosmosDBShell.sln` (or use the VS Code build task with Ctrl+Shift+B).
   - Run tests: `dotnet test CosmosDBShell.sln`
   - Run the tool locally: `dotnet run --project CosmosDBShell/CosmosDBShell.csproj`
-  - GitHub Actions runs CI from [.github/workflows/ci.yml](.github/workflows/ci.yml) and produces unsigned package artifacts from [.github/workflows/package-unsigned.yml](.github/workflows/package-unsigned.yml).
+  - GitHub Actions runs CI from [.github/workflows/ci.yml](.github/workflows/ci.yml) and uploads unsigned artifacts from [.github/workflows/package-unsigned.yml](.github/workflows/package-unsigned.yml).
   - GitHub Actions uses [.github/nuget.github.config](.github/nuget.github.config) so it can restore from nuget.org independently of Azure Pipelines.
   - Azure Pipelines can continue independently for branch-based signing and publishing.