diff --git a/.pipelines/MSIXBundle-vPack-Official.yml b/.pipelines/MSIXBundle-vPack-Official.yml
index 03f8dba0873..e9abec012e5 100644
--- a/.pipelines/MSIXBundle-vPack-Official.yml
+++ b/.pipelines/MSIXBundle-vPack-Official.yml
@@ -216,6 +216,7 @@ extends:
             Write-Verbose -Verbose "Completed building PowerShell for '$env:BuildConfiguration' configuration"
           displayName: 'Build Windows Universal - $(Architecture)-$(BuildConfiguration) Symbols folder'
           env:
+            VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: $(VSS_NUGET_EXTERNAL_FEED_ENDPOINTS)
             ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
 
         # Add CodeQL Finalize task right after your 'Build' step.
diff --git a/.pipelines/templates/stages/PowerShell-vPack-Stages.yml b/.pipelines/templates/stages/PowerShell-vPack-Stages.yml
index 404936440f8..2b607ef758c 100644
--- a/.pipelines/templates/stages/PowerShell-vPack-Stages.yml
+++ b/.pipelines/templates/stages/PowerShell-vPack-Stages.yml
@@ -204,6 +204,7 @@ stages:
         displayName: Build Windows Universal - $(Architecture) -$(BuildConfiguration) Symbols folder
         env:
           __DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY)
+          VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: $(VSS_NUGET_EXTERNAL_FEED_ENDPOINTS)
           ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
 
       - task: CodeQL3000Finalize@0 # Add CodeQL Finalize task right after your 'Build' step.
diff --git a/docs/building/internals.md b/docs/building/internals.md
index 0d3c0f7dcbf..14c4c9a0c2d 100644
--- a/docs/building/internals.md
+++ b/docs/building/internals.md
@@ -49,6 +49,8 @@ The flags can also be enabled together. The shared
 [`insert-nuget-config-azfeed.yml`](../../.pipelines/templates/insert-nuget-config-azfeed.yml)
 template installs the Azure Artifacts Credential Provider and supplies an Azure DevOps
 access token through the secret `VSS_NUGET_EXTERNAL_FEED_ENDPOINTS` variable.
+Build steps must explicitly map this secret variable into their `env` block,
+including module-only builds; Azure Pipelines does not automatically export secret variables.
 The `powershell-net-early-access` service connection identity must have read access
 to the module feed. The existing PowerShell feed continues to use its separate PAT.
 For local restores, install the Azure Artifacts Credential Provider and use
diff --git a/test/infrastructure/NugetConfig.Tests.ps1 b/test/infrastructure/NugetConfig.Tests.ps1
index db144b71df5..65e08ab80b3 100644
--- a/test/infrastructure/NugetConfig.Tests.ps1
+++ b/test/infrastructure/NugetConfig.Tests.ps1
@@ -88,6 +88,21 @@ Describe 'Early-access module feeds' {
         }
     }
 
+    It 'Maps secret feed credentials directly into the build environment in <Pipeline>' -TestCases @(
+        @{ Pipeline = '.pipelines/templates/stages/PowerShell-vPack-Stages.yml' }
+        @{ Pipeline = '.pipelines/MSIXBundle-vPack-Official.yml' }
+    ) {
+        param($Pipeline)
+
+        $template = Get-Content "$PSScriptRoot/../../$Pipeline" -Raw
+        $buildStep = [regex]::Match($template, '(?ms)^\s*displayName: [''"]?Build Windows Universal[^\r\n]*\r?\n(?<envIndent> +)env:\r?\n(?<env>.*?)(?=^\k<envIndent>\S|\z)')
+        $buildStep.Success | Should -BeTrue
+        $envIndent = $buildStep.Groups['envIndent'].Value + '  '
+        $buildStep.Groups['env'].Value | Should -Match (
+            '(?m)^' + $envIndent + 'VSS_NUGET_EXTERNAL_FEED_ENDPOINTS: \$\(VSS_NUGET_EXTERNAL_FEED_ENDPOINTS\)\r?$'
+        )
+    }
+
     BeforeEach {
         $env:EARLY_ACCESS_FEED = 'net10'
         Mock New-NugetConfigFile -ModuleName build {}