diff --git a/windows-release/README.md b/windows-release/README.md
index 3f67d250..621e1bc5 100644
--- a/windows-release/README.md
+++ b/windows-release/README.md
@@ -40,10 +40,27 @@ Without this, the build records will be lost after 30 days.
 The code signing certificate is stored in Azure Key Vault, and is authenticated using the
 variables in a Variable group called CPythonSign. The variable group is what triggers approvals.
 The group is at https://dev.azure.com/Python/cpython/_library?itemType=VariableGroups&view=VariableGroupView&variableGroupId=1&path=CPythonSign
+A second group called CPythonTestSign exists without approvals, but only has access to a test signing certificate.
+
+The five variables in the Variable Group identify the Entra ID
+[App registration](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) with access,
+and the name of the certificate to use.
+
+* `KeyVaultApplication` - the "Application (client) ID" of the App registration
+* `KeyVaultDirectory` - the "Directory (tenant) ID" of the App registration
+* `KeyVaultSecret` - the current "Client secret" of the App registration
+* `KeyVaultUri` - the base `https://*.vault.azure.net/` URI of the Key Vault
+* `KeyVaultCertificateName` - the name of the certificate. This is not a secret
+
+The Key Vault should be configured to use Azure role-based access control (soon to be the only option),
+and the App registration should have the "Key Vault Certificate User" and "Key Vault Crypto User" roles.
+The trusted owner of the Key Vault should have the "Owner" role, but the App registration should not.
 
 To upload a new code signing certificate (which will be provided by the PSF),
-or to change to a new Azure Keyvault instance,
-see the documentation at https://github.com/vcsjones/AzureSignTool/blob/main/WALKTHROUGH.md.
+you need the certificate in encrypted .pfx format.
+This can then be uploaded directly through the Azure Portal into the Key Vault along with the passphrase.
+If reusing an existing Key Vault, upload it as a new version of the existing certificate.
+If it is uploaded as a new certificate, the Variable Group must be updated.
 
 GPG signature generation uses a GPG key stored in the Secure Files library.
 This can be found at https://dev.azure.com/Python/cpython/_library?itemType=SecureFiles
diff --git a/windows-release/azure-pipelines.yml b/windows-release/azure-pipelines.yml
index ee5f8adf..8dde308c 100644
--- a/windows-release/azure-pipelines.yml
+++ b/windows-release/azure-pipelines.yml
@@ -145,6 +145,7 @@ stages:
       parameters:
         ${{ if and(parameters.SigningCertificate, ne(parameters.SigningCertificate, 'Unsigned')) }}:
           SigningCertificate: ${{ parameters.SigningCertificate }}
+        DoFreethreaded: ${{ parameters.DoFreethreaded }}
 
   - stage: Layout
     displayName: Generate layouts
@@ -204,6 +205,7 @@ stages:
           ARM64TclTk: ${{ parameters.ARM64TclTk }}
           ${{ if and(parameters.SigningCertificate, ne(parameters.SigningCertificate, 'Unsigned')) }}:
             SigningCertificate: ${{ parameters.SigningCertificate }}
+          DoARM64: ${{ parameters.DoARM64}}
           DoFreethreaded: ${{ parameters.DoFreethreaded }}
 
     - stage: Test_MSI
diff --git a/windows-release/build-steps-pgo.yml b/windows-release/build-steps-pgo.yml
index fa18a047..3a13ae3f 100644
--- a/windows-release/build-steps-pgo.yml
+++ b/windows-release/build-steps-pgo.yml
@@ -2,7 +2,6 @@ parameters:
   PGInstrument: false
   PGRun: false
   PGUpdate: false
-  DoFreethreaded: false
 
 steps:
 - template: ./checkout.yml
@@ -23,21 +22,12 @@ steps:
 - ${{ if eq(parameters.PGInstrument, 'true') }}:
   - powershell: |
       $env:SigningCertificate = $null
-      .\PCbuild\build.bat -v -p $(Platform) -c PGInstrument
+      .\PCbuild\build.bat -v -p $(Platform) -c PGInstrument $(ExtraOptions)
     displayName: 'Run build'
     env:
       IncludeUwp: true
       Py_OutDir: '$(Build.BinariesDirectory)\bin'
 
-  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-    - powershell: |
-        $env:SigningCertificate = $null
-        .\PCbuild\build.bat -v -p $(Platform) -c PGInstrument --disable-gil
-      displayName: 'Run free-threaded build'
-      env:
-        IncludeUwp: true
-        Py_OutDir: '$(Build.BinariesDirectory)\bin'
-
   - ${{ if ne(parameters.PGRun, 'true') }}:
     # Not running in this job, so we publish our entire build and object files
 
@@ -70,21 +60,13 @@ steps:
         targetPath: '$(Build.BinariesDirectory)\bin\$(Arch)\instrumented'
 
   - powershell: |
-      & "$(Build.BinariesDirectory)\bin\$(Arch)\instrumented\python.exe" -m test --pgo
+      $exe = (gci "$(Build.BinariesDirectory)\bin\$(Arch)\instrumented\$(PythonExePattern)" | select -First 1)
+      & $exe -m test --pgo
     ignoreLASTEXITCODE: true
     displayName: 'Collect profile'
     env:
       PYTHONHOME: '$(Build.SourcesDirectory)'
 
-  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-    - powershell: |
-        $exe = (gci "$(Build.BinariesDirectory)\bin\$(Arch)\instrumented\python3*t.exe" | select -First 1)
-        & $exe -m test --pgo
-      ignoreLASTEXITCODE: true
-      displayName: 'Collect free-threaded profile'
-      env:
-        PYTHONHOME: '$(Build.SourcesDirectory)'
-
 
   - ${{ if ne(parameters.PGUpdate, 'true') }}:
     # Not finishing in this job, so publish the binaries
@@ -121,21 +103,12 @@ steps:
 
   - powershell: |
       $env:SigningCertificate = $null
-      .\PCbuild\build.bat -v -p $(Platform) -c PGUpdate
+      .\PCbuild\build.bat -v -p $(Platform) -c PGUpdate $(ExtraOptions)
     displayName: 'Run build with PGO'
     env:
       IncludeUwp: true
       Py_OutDir: '$(Build.BinariesDirectory)\bin'
 
-  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-    - powershell: |
-        $env:SigningCertificate = $null
-        .\PCbuild\build.bat -v -p $(Platform) -c PGUpdate --disable-gil
-      displayName: 'Run free-threaded build with PGO'
-      env:
-        IncludeUwp: true
-        Py_OutDir: '$(Build.BinariesDirectory)\bin'
-
   - powershell: |
       $kitroot = (gp 'HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots\').KitsRoot10
       $tool = (gci -r "$kitroot\Bin\*\x64\signtool.exe" | sort FullName -Desc | select -First 1)
diff --git a/windows-release/build-steps.yml b/windows-release/build-steps.yml
index 0bee73b8..ef5f3f88 100644
--- a/windows-release/build-steps.yml
+++ b/windows-release/build-steps.yml
@@ -1,6 +1,5 @@
 parameters:
   ShouldPGO: false
-  DoFreethreaded: false
 
 steps:
 - template: ./checkout.yml
@@ -16,48 +15,24 @@ steps:
     Write-Host "##vso[build.addbuildtag]$($d.PythonVersion)-$(Name)"
   displayName: 'Extract version numbers'
 
-- ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-  - powershell: |
-      Write-Host "##vso[build.addbuildtag]freethreaded"
-      Write-Host "##vso[build.addbuildtag]$(VersionText)-freethreaded"
-    displayName: 'Add freethreaded tags'
-
 - ${{ if eq(parameters.ShouldPGO, 'false') }}:
   - powershell: |
       $env:SigningCertificate = $null
-      .\PCbuild\build.bat -v -p $(Platform) -c $(Configuration)
+      .\PCbuild\build.bat -v -p $(Platform) -c $(Configuration) $(ExtraOptions)
     displayName: 'Run build'
     env:
       IncludeUwp: true
       Py_OutDir: '$(Build.BinariesDirectory)\bin'
 
-  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-    - powershell: |
-        $env:SigningCertificate = $null
-        .\PCbuild\build.bat -v -p $(Platform) -c $(Configuration) --disable-gil
-      displayName: 'Run free-threaded build'
-      env:
-        IncludeUwp: true
-        Py_OutDir: '$(Build.BinariesDirectory)\bin'
-
 - ${{ if eq(parameters.ShouldPGO, 'true') }}:
   - powershell: |
       $env:SigningCertificate = $null
-      .\PCbuild\build.bat -v -p $(Platform) --pgo
+      .\PCbuild\build.bat -v -p $(Platform) --pgo $(ExtraOptions)
     displayName: 'Run build with PGO'
     env:
       IncludeUwp: true
       Py_OutDir: '$(Build.BinariesDirectory)\bin'
 
-  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-    - powershell: |
-        $env:SigningCertificate = $null
-        .\PCbuild\build.bat -v -p $(Platform) --pgo --disable-gil
-      displayName: 'Run free-threaded build'
-      env:
-        IncludeUwp: true
-        Py_OutDir: '$(Build.BinariesDirectory)\bin'
-
 - powershell: |
     $kitroot = (gp 'HKLM:\SOFTWARE\Microsoft\Windows Kits\Installed Roots\').KitsRoot10
     $tool = (gci -r "$kitroot\Bin\*\x64\signtool.exe" | sort FullName -Desc | select -First 1)
diff --git a/windows-release/layout-command.yml b/windows-release/layout-command.yml
index 406ccd85..1524bca2 100644
--- a/windows-release/layout-command.yml
+++ b/windows-release/layout-command.yml
@@ -1,23 +1,37 @@
+parameters:
+  Binaries: $(Pipeline.Workspace)\bin_$(Name)
+  Sources: $(Build.SourcesDirectory)
+  Temp: $(Build.BinariesDirectory)\layout-temp
+  Docs: $(Build.BinariesDirectory)\doc
+
 steps:
-- task: DownloadPipelineArtifact@1
+- download: current
+  artifact: bin_$(HostArch)
   displayName: 'Download artifact: bin_$(HostArch)'
   condition: and(succeeded(), variables['HostArch'])
-  inputs:
-    artifactName: bin_$(HostArch)
-    targetPath: $(Build.BinariesDirectory)\bin_$(HostArch)
+
+- powershell: |
+    Write-Host "##vso[task.setvariable variable=Python]${{ parameters.Binaries }}\python.exe"
+  condition: and(succeeded(), not(variables['HostArch']))
+  displayName: 'Set Python command'
+
+- powershell: |
+    Write-Host "##vso[task.setvariable variable=Python]$(Pipeline.Workspace)\bin_$(HostArch)\python.exe"
+  condition: and(succeeded(), variables['HostArch'])
+  displayName: 'Set Python command'
 
 - powershell: >
-    Write-Host (
-    '##vso[task.setvariable variable=LayoutCmd]&
+    $layout_cmd = '&
     "$(Python)"
     "{1}\PC\layout"
     -vv
     --source "{1}"
-    --build "{0}\bin"
-    --arch "$(Name)"
-    --temp "{0}\layout-temp"
-    --include-cat "{0}\bin\python.cat"
-    --doc-build "{0}\doc"'
-    -f ("$(Build.BinariesDirectory)", "$(Build.SourcesDirectory)")
-    )
+    --build "{0}"
+    --arch "$(Arch)"
+    --temp "{2}"
+    --include-cat "{0}\python.cat"
+    --doc-build "{3}"'
+    -f ("${{ parameters.Binaries }}", "${{ parameters.Sources }}", "${{ parameters.Temp }}", "${{ parameters.Docs}}");
+    Write-Host "##vso[task.setvariable variable=LayoutCmd]$layout_cmd";
+    Write-Host "Setting LayoutCmd=$layout_cmd"
   displayName: 'Set LayoutCmd'
diff --git a/windows-release/libffi-build.yml b/windows-release/libffi-build.yml
index cef921a7..338066e4 100644
--- a/windows-release/libffi-build.yml
+++ b/windows-release/libffi-build.yml
@@ -24,7 +24,10 @@ name: ${{ parameters.SourceTag }}_$(Date:yyyyMMdd)$(Rev:.rr)
 
 
 variables:
-- group: CPythonSign
+- ${{ if eq(parameters.SigningCertificate, 'PythonSoftwareFoundation') }}:
+  - group: CPythonSign
+- ${{ if eq(parameters.SigningCertificate, 'TestSign') }}:
+  - group: CPythonTestSign
 - name: IntDir
   value: '$(Build.BinariesDirectory)'
 - name: OutDir
diff --git a/windows-release/msi-steps.yml b/windows-release/msi-steps.yml
index d9e14ccd..0a18dbfc 100644
--- a/windows-release/msi-steps.yml
+++ b/windows-release/msi-steps.yml
@@ -1,7 +1,7 @@
 parameters:
-  ARM64TclTk: true
   DoFreethreaded: false
   SigningCertificate: ''
+  Artifacts: []
 
 steps:
   - template: ./checkout.yml
@@ -12,79 +12,22 @@ steps:
     displayName: 'Update signing description'
     condition: and(succeeded(), not(variables['SigningDescription']))
 
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: doc'
-    inputs:
-      artifactName: doc
-      targetPath: $(Build.BinariesDirectory)\doc
-
-  - task: CopyFiles@2
-    displayName: 'Merge documentation files'
-    inputs:
-      sourceFolder: $(Build.BinariesDirectory)\doc
-      targetFolder: $(Build.SourcesDirectory)\Doc\build
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: bin_win32'
-    inputs:
-      artifactName: bin_win32
-      targetPath: $(Build.BinariesDirectory)\win32
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: bin_win32_d'
-    inputs:
-      artifactName: bin_win32_d
-      targetPath: $(Build.BinariesDirectory)\win32
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: bin_amd64'
-    inputs:
-      artifactName: bin_amd64
-      targetPath: $(Build.BinariesDirectory)\amd64
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: bin_amd64_d'
-    inputs:
-      artifactName: bin_amd64_d
-      targetPath: $(Build.BinariesDirectory)\amd64
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: bin_arm64'
-    condition: and(succeeded(), eq(variables['PublishARM64'], 'true'))
-    inputs:
-      artifactName: bin_arm64
-      targetPath: $(Build.BinariesDirectory)\arm64
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: bin_arm64_d'
-    condition: and(succeeded(), eq(variables['PublishARM64'], 'true'))
-    inputs:
-      artifactName: bin_arm64_d
-      targetPath: $(Build.BinariesDirectory)\arm64
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: tcltk_lib_win32'
-    inputs:
-      artifactName: tcltk_lib_win32
-      targetPath: $(Build.BinariesDirectory)\tcltk_lib_win32
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: tcltk_lib_amd64'
-    inputs:
-      artifactName: tcltk_lib_amd64
-      targetPath: $(Build.BinariesDirectory)\tcltk_lib_amd64
-
-  - ${{ if eq(parameters.ARM64TclTk, true) }}:
-    - task: DownloadPipelineArtifact@1
-      displayName: 'Download artifact: tcltk_lib_arm64'
-      condition: and(succeeded(), eq(variables['PublishARM64'], 'true'))
-      inputs:
-        artifactName: tcltk_lib_arm64
-        targetPath: $(Build.BinariesDirectory)\tcltk_lib_arm64
+  - ${{ each a in parameters.Artifacts }}:
+    - download: current
+      artifact: ${{ a.artifact }}
+      displayName: 'Download artifact: ${{ a.artifact }}'
+
+    - ${{ if a.target }}:
+      - task: CopyFiles@2
+        displayName: 'Move ${{ a.artifact }} files'
+        inputs:
+          sourceFolder: $(Pipeline.Workspace)\${{ a.artifact }}
+          targetFolder: ${{ a.target }}
+          overwrite: false
 
   - ${{ if parameters.SigningCertificate }}:
     - powershell: |
-        copy $(Build.BinariesDirectory)\amd64\Activate.ps1 Lib\venv\scripts\common\Activate.ps1 -Force
+        copy $(Py_OutDir)\amd64\Activate.ps1 Lib\venv\scripts\common\Activate.ps1 -Force
       displayName: 'Copy signed files into sources'
 
   - script: |
@@ -125,7 +68,7 @@ steps:
         $signcmd = 'AzureSignTool sign -kvu "$(KeyVaultUri)" ' + `
                    '-kvi "$(KeyVaultApplication)" -kvt "$(KeyVaultDirectory)" -kvs "$(KeyVaultSecret)" ' + `
                    '-tr http://timestamp.digicert.com/ -td sha256 ' + `
-                   '-kvc "${{ parameters.SigningCertificate }}" -d "$(SigningDescription)" -fd sha256'
+                   '-kvc "$(KeyVaultCertificateName)" -d "$(SigningDescription)" -fd sha256'
         $signcmd = $signcmd -replace '"', '\"'
         "/p:_SignCommand=""$signcmd""" | Out-File $env:ResponseFile -Append -Encoding UTF8
       displayName: 'Inject signing command into response file'
@@ -138,37 +81,17 @@ steps:
     env:
       Platform: x86
 
-  - script: |
-      %MSBUILD% Tools\msi\bundle\releaselocal.wixproj /t:Rebuild /p:RebuildAll=true "@$(ResponseFile)"
-    displayName: 'Build win32 installer'
-    env:
-      Platform: x86
-      PYTHON: $(Build.BinariesDirectory)\win32\python.exe
-      PythonForBuild: $(Build.BinariesDirectory)\win32\python.exe
-      PYTHONHOME: $(Build.SourcesDirectory)
-      TclTkLibraryDir: $(Build.BinariesDirectory)\tcltk_lib_win32
-
-  - script: |
-      %MSBUILD% Tools\msi\bundle\releaselocal.wixproj /t:Rebuild /p:RebuildAll=true "@$(ResponseFile)"
-    displayName: 'Build amd64 installer'
-    env:
-      Platform: x64
-      PYTHON: $(Build.BinariesDirectory)\amd64\python.exe
-      PythonForBuild: $(Build.BinariesDirectory)\amd64\python.exe
-      PYTHONHOME: $(Build.SourcesDirectory)
-      TclTkLibraryDir: $(Build.BinariesDirectory)\tcltk_lib_amd64
-
-  - script: |
-      %MSBUILD% Tools\msi\bundle\releaselocal.wixproj /t:Rebuild /p:RebuildAll=true "@$(ResponseFile)"
-    displayName: 'Build arm64 installer'
-    condition: and(succeeded(), eq(variables['PublishARM64'], 'true'))
-    env:
-      Platform: ARM64
-      PYTHON: $(Build.BinariesDirectory)\win32\python.exe
-      PythonForBuild: $(Build.BinariesDirectory)\win32\python.exe
-      PYTHONHOME: $(Build.SourcesDirectory)
-      ${{ if eq(parameters.ARM64TclTk, true) }}:
-        TclTkLibraryDir: $(Build.BinariesDirectory)\tcltk_lib_arm64
+  - ${{ each b in parameters.Bundles }}:
+    - script: |
+        %MSBUILD% Tools\msi\bundle\releaselocal.wixproj /t:Rebuild /p:RebuildAll=true "@$(ResponseFile)"
+      displayName: 'Build ${{ b.bundle }} installer'
+      env:
+        Platform: ${{ b.Platform }}
+        PYTHON: $(Pipeline.Workspace)\${{ b.PythonForBuild }}\python.exe
+        PythonForBuild: $(Pipeline.Workspace)\${{ b.PythonForBuild }}\python.exe
+        PYTHONHOME: $(Build.SourcesDirectory)
+        ${{ if b.TclTkArtifact }}:
+          TclTkLibraryDir: $(Pipeline.Workspace)\${{ b.TclTkArtifact }}
 
   - powershell: |
       del $env:ResponseFile -ErrorAction Continue
@@ -177,39 +100,17 @@ steps:
     env:
       ResponseFile: $(ResponseFile)
 
-  - task: CopyFiles@2
-    displayName: 'Assemble artifact: msi (win32)'
-    inputs:
-      sourceFolder: $(Build.BinariesDirectory)\win32\en-us
-      targetFolder: $(Build.ArtifactStagingDirectory)\msi\win32
-      contents: |
-        *.msi
-        *.cab
-        *.exe
-
-  - task: CopyFiles@2
-    displayName: 'Assemble artifact: msi (amd64)'
-    inputs:
-      sourceFolder: $(Build.BinariesDirectory)\amd64\en-us
-      targetFolder: $(Build.ArtifactStagingDirectory)\msi\amd64
-      contents: |
-        *.msi
-        *.cab
-        *.exe
-
-  - task: CopyFiles@2
-    displayName: 'Assemble artifact: msi (arm64)'
-    condition: and(succeeded(), eq(variables['PublishARM64'], 'true'))
-    inputs:
-      sourceFolder: $(Build.BinariesDirectory)\arm64\en-us
-      targetFolder: $(Build.ArtifactStagingDirectory)\msi\arm64
-      contents: |
-        *.msi
-        *.cab
-        *.exe
-
-  - task: PublishPipelineArtifact@0
+  - ${{ each b in parameters.Bundles }}:
+    - task: CopyFiles@2
+      displayName: 'Assemble artifact: msi (${{ b.bundle }})'
+      inputs:
+        sourceFolder: $(Build.BinariesDirectory)\${{ b.bundle }}\en-us
+        targetFolder: $(Build.ArtifactStagingDirectory)\msi\${{ b.bundle }}
+        contents: |
+          *.msi
+          *.cab
+          *.exe
+
+  - publish: '$(Build.ArtifactStagingDirectory)\msi'
+    artifact: msi
     displayName: 'Publish MSI'
-    inputs:
-      targetPath: '$(Build.ArtifactStagingDirectory)\msi'
-      artifactName: msi
diff --git a/windows-release/openssl-build.yml b/windows-release/openssl-build.yml
index a1ca5590..35cab019 100644
--- a/windows-release/openssl-build.yml
+++ b/windows-release/openssl-build.yml
@@ -20,8 +20,10 @@ name: ${{ parameters.SourceTag }}_$(Date:yyyyMMdd)$(Rev:.rr)
 
 
 variables:
-- ${{ if ne(parameters.SigningCertificate, 'Unsigned') }}:
+- ${{ if eq(parameters.SigningCertificate, 'PythonSoftwareFoundation') }}:
   - group: CPythonSign
+- ${{ if eq(parameters.SigningCertificate, 'TestSign') }}:
+  - group: CPythonTestSign
 - name: IntDir
   value: '$(Build.BinariesDirectory)'
 - name: OutDir
diff --git a/windows-release/sign-files.yml b/windows-release/sign-files.yml
index 21ce8f9d..1a13ae6b 100644
--- a/windows-release/sign-files.yml
+++ b/windows-release/sign-files.yml
@@ -23,7 +23,7 @@ steps:
       AzureSignTool sign -kvu '$(KeyVaultUri)' `
                     -kvi '$(KeyVaultApplication)' -kvt '$(KeyVaultDirectory)' -kvs '$(KeyVaultSecret)' `
                     -tr http://timestamp.digicert.com/ -td sha256 `
-                    -kvc '${{ parameters.SigningCertificate }}' -d '$(SigningDescription)' -fd sha256 `
+                    -kvc '$(KeyVaultCertificateName)' -d '$(SigningDescription)' -fd sha256 `
                     $files
     displayName: 'Sign binaries'
     retryCountOnTaskFailure: 3
diff --git a/windows-release/sign-nuget-files.yml b/windows-release/sign-nuget-files.yml
index 9d64a9a9..2118e17b 100644
--- a/windows-release/sign-nuget-files.yml
+++ b/windows-release/sign-nuget-files.yml
@@ -23,7 +23,7 @@ steps:
         NuGetKeyVaultSignTool sign -kvu '$(KeyVaultUri)' `
           -kvi '$(KeyVaultApplication)' -kvt '$(KeyVaultDirectory)' -kvs '$(KeyVaultSecret)' `
           -tr http://timestamp.digicert.com/ -td sha256 `
-          -kvc '${{ parameters.SigningCertificate }}' -fd sha256 `
+          -kvc '$(KeyVaultCertificateName)' -fd sha256 `
           $_
       }
     displayName: 'Sign binaries'
diff --git a/windows-release/stage-build.yml b/windows-release/stage-build.yml
index 7a98b376..0334fc74 100644
--- a/windows-release/stage-build.yml
+++ b/windows-release/stage-build.yml
@@ -61,12 +61,14 @@ jobs:
         Platform: x86
         Configuration: Release
         _HostPython: .\python
+        ExtraOptions: ''
       win32_d:
         Name: win32_d
         Arch: win32
         Platform: x86
         Configuration: Debug
         _HostPython: .\python
+        ExtraOptions: ''
       ${{ if ne(parameters.DoPGO, 'true') }}:
         amd64:
           Name: amd64
@@ -74,12 +76,14 @@ jobs:
           Platform: x64
           Configuration: Release
           _HostPython: .\python
+          ExtraOptions: ''
       amd64_d:
         Name: amd64_d
         Arch: amd64
         Platform: x64
         Configuration: Debug
         _HostPython: .\python
+        ExtraOptions: ''
       ${{ if or(ne(parameters.DoPGO, 'true'), ne(parameters.DoPGOARM64, 'true')) }}:
         arm64:
           Name: arm64
@@ -87,17 +91,62 @@ jobs:
           Platform: ARM64
           Configuration: Release
           _HostPython: python
+          ExtraOptions: ''
       arm64_d:
         Name: arm64_d
         Arch: arm64
         Platform: ARM64
         Configuration: Debug
         _HostPython: python
+        ExtraOptions: ''
+      ${{ if eq(parameters.DoFreethreaded, 'true') }}:
+        win32_t:
+          Name: win32_t
+          Arch: win32
+          Platform: x86
+          Configuration: Release
+          _HostPython: .\python
+          ExtraOptions: --disable-gil
+        win32_td:
+          Name: win32_td
+          Arch: win32
+          Platform: x86
+          Configuration: Debug
+          _HostPython: .\python
+          ExtraOptions: --disable-gil
+        ${{ if ne(parameters.DoPGO, 'true') }}:
+          amd64_t:
+            Name: amd64_t
+            Arch: amd64
+            Platform: x64
+            Configuration: Release
+            _HostPython: .\python
+            ExtraOptions: --disable-gil
+        amd64_td:
+          Name: amd64_td
+          Arch: amd64
+          Platform: x64
+          Configuration: Debug
+          _HostPython: .\python
+          ExtraOptions: --disable-gil
+        ${{ if or(ne(parameters.DoPGO, 'true'), ne(parameters.DoPGOARM64, 'true')) }}:
+          arm64_t:
+            Name: arm64_t
+            Arch: arm64
+            Platform: ARM64
+            Configuration: Release
+            _HostPython: python
+            ExtraOptions: --disable-gil
+        arm64_td:
+          Name: arm64_td
+          Arch: arm64
+          Platform: ARM64
+          Configuration: Debug
+          _HostPython: python
+          ExtraOptions: --disable-gil
 
   steps:
     - template: ./build-steps.yml
-      parameters:
-        DoFreethreaded: ${{ parameters.DoFreethreaded }}
 
 
 - ${{ if eq(parameters.DoPGO, 'true') }}:
@@ -117,11 +166,20 @@ jobs:
           Arch: amd64
           Platform: x64
           _HostPython: .\python
+          PythonExePattern: python.exe
+          ExtraOptions: ''
+        ${{ if eq(parameters.DoFreethreaded, 'true') }}:
+          amd64_t:
+            Name: amd64_t
+            Arch: amd64
+            Platform: x64
+            _HostPython: .\python
+            PythonExePattern: python3*t.exe
+            ExtraOptions: --disable-gil
 
     steps:
       - template: ./build-steps-pgo.yml
         parameters:
-          DoFreethreaded: ${{ parameters.DoFreethreaded }}
           PGInstrument: true
           PGRun: true
           PGUpdate: true
@@ -136,18 +194,26 @@ jobs:
       workspace:
         clean: all
 
+      variables:
+        Arch: arm64
+        Platform: ARM64
+        _HostPython: python
+
       strategy:
         matrix:
           arm64:
             Name: arm64
-            Arch: arm64
-            Platform: ARM64
-            _HostPython: python
+            PythonExePattern: python.exe
+            ExtraOptions: ''
+          ${{ if eq(parameters.DoFreethreaded, 'true') }}:
+            arm64_t:
+              Name: arm64_t
+              PythonExePattern: python3*t.exe
+              ExtraOptions: --disable-gil
 
       steps:
         - template: ./build-steps-pgo.yml
           parameters:
-            DoFreethreaded: ${{ parameters.DoFreethreaded }}
             PGInstrument: true
 
     - job: Build_Python_PGO_2
@@ -163,17 +229,23 @@ jobs:
       workspace:
         clean: all
 
+      variables:
+        Arch: arm64
+        Platform: ARM64
+
       strategy:
         matrix:
           arm64:
             Name: arm64
-            Arch: arm64
-            Platform: ARM64
+            PythonExePattern: python.exe
+          ${{ if eq(parameters.DoFreethreaded, 'true') }}:
+            arm64_t:
+              Name: arm64_t
+              PythonExePattern: python3*t.exe
 
       steps:
         - template: ./build-steps-pgo.yml
           parameters:
-            DoFreethreaded: ${{ parameters.DoFreethreaded }}
             PGRun: true
 
     - job: Build_Python_PGO_3
@@ -186,18 +258,26 @@ jobs:
       workspace:
         clean: all
 
+      variables:
+        Arch: arm64
+        Platform: ARM64
+        _HostPython: python
+
       strategy:
         matrix:
           arm64:
             Name: arm64
-            Arch: arm64
-            Platform: ARM64
-            _HostPython: python
+            PythonExePattern: python.exe
+            ExtraOptions: ''
+          ${{ if eq(parameters.DoFreethreaded, 'true') }}:
+            arm64_t:
+              Name: arm64_t
+              PythonExePattern: python3*t.exe
+              ExtraOptions: --disable-gil
 
       steps:
         - template: ./build-steps-pgo.yml
           parameters:
-            DoFreethreaded: ${{ parameters.DoFreethreaded }}
             PGUpdate: true
 
 
@@ -238,21 +318,15 @@ jobs:
         platform: ARM64
         msbuildArguments: /t:CopyTclTkLib /p:OutDir="$(Build.ArtifactStagingDirectory)\tcl_arm64"
 
-  - task: PublishPipelineArtifact@0
+  - publish: '$(Build.ArtifactStagingDirectory)\tcl_win32'
+    artifact: tcltk_lib_win32
     displayName: 'Publish artifact: tcltk_lib_win32'
-    inputs:
-      targetPath: '$(Build.ArtifactStagingDirectory)\tcl_win32'
-      artifactName: tcltk_lib_win32
 
-  - task: PublishPipelineArtifact@0
+  - publish: '$(Build.ArtifactStagingDirectory)\tcl_amd64'
+    artifact: tcltk_lib_amd64
     displayName: 'Publish artifact: tcltk_lib_amd64'
-    inputs:
-      targetPath: '$(Build.ArtifactStagingDirectory)\tcl_amd64'
-      artifactName: tcltk_lib_amd64
 
   - ${{ if eq(parameters.ARM64TclTk, true) }}:
-    - task: PublishPipelineArtifact@0
+    - publish: '$(Build.ArtifactStagingDirectory)\tcl_arm64'
+      artifact: tcltk_lib_arm64
       displayName: 'Publish artifact: tcltk_lib_arm64'
-      inputs:
-        targetPath: '$(Build.ArtifactStagingDirectory)\tcl_arm64'
-        artifactName: tcltk_lib_arm64
diff --git a/windows-release/stage-layout-embed.yml b/windows-release/stage-layout-embed.yml
index c8b23d30..6563ab5d 100644
--- a/windows-release/stage-layout-embed.yml
+++ b/windows-release/stage-layout-embed.yml
@@ -9,30 +9,28 @@ jobs:
   workspace:
     clean: all
 
+  variables:
+    PYTHONHOME: $(Build.SourcesDirectory)
+
   strategy:
     matrix:
       win32:
         Name: win32
-        Python: $(Build.BinariesDirectory)\bin\python.exe
-        PYTHONHOME: $(Build.SourcesDirectory)
+        Arch: win32
       amd64:
         Name: amd64
-        Python: $(Build.BinariesDirectory)\bin\python.exe
-        PYTHONHOME: $(Build.SourcesDirectory)
+        Arch: amd64
       arm64:
         Name: arm64
+        Arch: arm64
         HostArch: amd64
-        Python: $(Build.BinariesDirectory)\bin_amd64\python.exe
-        PYTHONHOME: $(Build.SourcesDirectory)
 
   steps:
   - template: ./checkout.yml
 
-  - task: DownloadPipelineArtifact@1
+  - download: current
+    artifact: bin_$(Name)
     displayName: 'Download artifact: bin_$(Name)'
-    inputs:
-      artifactName: bin_$(Name)
-      targetPath: $(Build.BinariesDirectory)\bin
 
   - template: ./layout-command.yml
 
@@ -48,11 +46,9 @@ jobs:
       --preset-embed
     displayName: 'Generate embeddable layout'
 
-  - task: PublishPipelineArtifact@0
+  - publish: '$(Build.ArtifactStagingDirectory)\layout'
+    artifact: layout_embed_$(Name)
     displayName: 'Publish Artifact: layout_embed_$(Name)'
-    inputs:
-      targetPath: '$(Build.ArtifactStagingDirectory)\layout'
-      artifactName: layout_embed_$(Name)
 
   - task: PublishBuildArtifacts@1
     displayName: 'Publish Artifact: embed'
diff --git a/windows-release/stage-layout-full.yml b/windows-release/stage-layout-full.yml
index 3eb45ca3..07030dc1 100644
--- a/windows-release/stage-layout-full.yml
+++ b/windows-release/stage-layout-full.yml
@@ -13,83 +13,97 @@ jobs:
   workspace:
     clean: all
 
+  variables:
+    PYTHONHOME: $(Build.SourcesDirectory)
+
   strategy:
     matrix:
       win32:
         Name: win32
-        Python: $(Build.BinariesDirectory)\bin\python.exe
-        PYTHONHOME: $(Build.SourcesDirectory)
-        TclLibrary: $(Build.BinariesDirectory)\tcltk_lib\tcl8
+        DebugName: win32_d
+        Arch: win32
+        TclLibrary: tcltk_lib_win32
+        ExtraOptions: ''
       amd64:
         Name: amd64
-        Python: $(Build.BinariesDirectory)\bin\python.exe
-        PYTHONHOME: $(Build.SourcesDirectory)
-        TclLibrary: $(Build.BinariesDirectory)\tcltk_lib\tcl8
+        DebugName: amd64_d
+        Arch: amd64
+        TclLibrary: tcltk_lib_amd64
+        ExtraOptions: ''
       arm64:
         Name: arm64
+        DebugName: arm64_d
+        Arch: arm64
         HostArch: amd64
-        Python: $(Build.BinariesDirectory)\bin_amd64\python.exe
-        PYTHONHOME: $(Build.SourcesDirectory)
-        ${{ if eq(parameters.ARM64TclTk, true) }}:
-          TclLibrary: $(Build.BinariesDirectory)\tcltk_lib\tcl8
+        ExtraOptions: ''
+        ${{ if eq(parameters.ARM64TclTk, 'true') }}:
+          TclLibrary: tcltk_lib_arm64
+      ${{ if eq(parameters.DoFreethreaded, 'true') }}:
+        win32_t:
+          Name: win32_t
+          DebugName: win32_td
+          Arch: win32
+          HostArch: win32
+          TclLibrary: tcltk_lib_win32
+          ExtraOptions: --include-freethreaded
+        amd64_t:
+          Name: amd64_t
+          DebugName: amd64_td
+          Arch: amd64
+          HostArch: amd64
+          TclLibrary: tcltk_lib_amd64
+          ExtraOptions: --include-freethreaded
+        arm64_t:
+          Name: arm64_t
+          DebugName: arm64_td
+          Arch: arm64
+          HostArch: amd64
+          TclLibrary: tcltk_lib_arm64
+          ExtraOptions: --include-freethreaded
 
   steps:
   - template: ./checkout.yml
 
-  - task: DownloadPipelineArtifact@1
+  - download: current
+    artifact: bin_$(Name)
     displayName: 'Download artifact: bin_$(Name)'
-    inputs:
-      artifactName: bin_$(Name)
-      targetPath: $(Build.BinariesDirectory)\bin
 
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: bin_$(Name)_d'
-    inputs:
-      artifactName: bin_$(Name)_d
-      targetPath: $(Build.BinariesDirectory)\bin
+  - download: current
+    artifact: bin_$(DebugName)
+    displayName: 'Download artifact: bin_$(DebugName)'
+
+  - powershell: |
+      $dest = "$(Pipeline.Workspace)\bin_$(Name)"
+      dir "$(Pipeline.Workspace)\bin_$(DebugName)" | `
+      ?{ -not (Test-Path "$dest\$($_.Name)") } | `
+      %{ copy $_.FullName $dest }
+    displayName: 'Copy debug binaries'
 
-  - task: DownloadPipelineArtifact@1
+  - download: current
+    artifact: doc
     displayName: 'Download artifact: doc'
-    inputs:
-      artifactName: doc
-      targetPath: $(Build.BinariesDirectory)\doc
 
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: tcltk_lib_$(Name)'
+  - download: current
+    artifact: $(TclLibrary)
+    displayName: 'Download artifact: $(TclLibrary)'
     condition: and(succeeded(), variables['TclLibrary'])
-    inputs:
-      artifactName: tcltk_lib_$(Name)
-      targetPath: $(Build.BinariesDirectory)\tcltk_lib
 
   - powershell: |
-      copy "$(Build.BinariesDirectory)\bin\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
+      Write-Host "##vso[task.setvariable variable=TCL_LIBRARY]$(Pipeline.Workspace)\$(TclLibrary)\tcl8"
+    displayName: 'Update TCL_LIBRARY'
+    condition: and(succeeded(), variables['TclLibrary'])
+
+  - powershell: |
+      copy "$(Pipeline.Workspace)\bin_$(Name)\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
     displayName: 'Copy signed files into sources'
     condition: and(succeeded(), variables['SigningCertificate'])
 
   - template: ./layout-command.yml
 
   - powershell: |
-      $(LayoutCmd) --copy "$(Build.ArtifactStagingDirectory)\layout" --preset-default
+      $(LayoutCmd) --copy "$(Build.ArtifactStagingDirectory)\layout" --preset-default $(ExtraOptions)
     displayName: 'Generate full layout'
-    env:
-      TCL_LIBRARY: $(TclLibrary)
-
-  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-    - powershell: |
-        $(LayoutCmd) --copy "$(Build.ArtifactStagingDirectory)\layout_freethreaded" --preset-default --include-freethreaded
-      displayName: 'Generate full freethreaded layout'
-      env:
-        TCL_LIBRARY: $(TclLibrary)
 
-  - task: PublishPipelineArtifact@0
+  - publish: '$(Build.ArtifactStagingDirectory)\layout'
+    artifact: layout_full_$(Name)
     displayName: 'Publish Artifact: layout_full_$(Name)'
-    inputs:
-      targetPath: '$(Build.ArtifactStagingDirectory)\layout'
-      artifactName: layout_full_$(Name)
-
-  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-    - task: PublishPipelineArtifact@0
-      displayName: 'Publish Artifact: layout_full_freethreaded_$(Name)'
-      inputs:
-        targetPath: '$(Build.ArtifactStagingDirectory)\layout_freethreaded'
-        artifactName: layout_full_freethreaded_$(Name)
diff --git a/windows-release/stage-layout-msix.yml b/windows-release/stage-layout-msix.yml
index 69e31d87..1afc1f5a 100644
--- a/windows-release/stage-layout-msix.yml
+++ b/windows-release/stage-layout-msix.yml
@@ -11,57 +11,52 @@ jobs:
   workspace:
     clean: all
 
+  variables:
+    PYTHONHOME: $(Build.SourcesDirectory)
+
   strategy:
     matrix:
       #win32:
       #  Name: win32
-      #  Python: $(Build.BinariesDirectory)\bin\python.exe
-      #  PYTHONHOME: $(Build.SourcesDirectory)
-      #  TclLibrary: $(Build.BinariesDirectory)\tcltk_lib\tcl8
+      #  TclLibrary: tcltk_lib_win32
+      #  ExtraOptions: --precompile
       amd64:
         Name: amd64
-        Python: $(Build.BinariesDirectory)\bin\python.exe
-        PYTHONHOME: $(Build.SourcesDirectory)
-        TclLibrary: $(Build.BinariesDirectory)\tcltk_lib\tcl8
+        Arch: amd64
+        TclLibrary: tcltk_lib_amd64
+        ExtraOptions: --precompile
       arm64:
         Name: arm64
+        Arch: arm64
         HostArch: amd64
-        Python: $(Build.BinariesDirectory)\bin_amd64\python.exe
-        PYTHONHOME: $(Build.SourcesDirectory)
-        ${{ if eq(parameters.ARM64TclTk, true) }}:
-          TclLibrary: $(Build.BinariesDirectory)\tcltk_lib\tcl8
+        ExtraOptions: --precompile
+        ${{ if eq(parameters.ARM64TclTk, 'true') }}:
+          TclLibrary: tcltk_lib_arm64
 
   steps:
   - template: ./checkout.yml
 
-  - task: DownloadPipelineArtifact@1
+  - download: current
+    artifact: bin_$(Name)
     displayName: 'Download artifact: bin_$(Name)'
-    inputs:
-      artifactName: bin_$(Name)
-      targetPath: $(Build.BinariesDirectory)\bin
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: bin_$(Name)_d'
-    inputs:
-      artifactName: bin_$(Name)_d
-      targetPath: $(Build.BinariesDirectory)\bin
-
-  - task: DownloadPipelineArtifact@1
-    displayName: 'Download artifact: tcltk_lib_$(Name)'
+
+  - download: current
+    artifact: $(TclLibrary)
+    displayName: 'Download artifact: $(TclLibrary)'
+    condition: and(succeeded(), variables['TclLibrary'])
+
+  - powershell: |
+      Write-Host "##vso[task.setvariable variable=TCL_LIBRARY]$(Pipeline.Workspace)\$(TclLibrary)\tcl8"
+    displayName: 'Update TCL_LIBRARY'
     condition: and(succeeded(), variables['TclLibrary'])
-    inputs:
-      artifactName: tcltk_lib_$(Name)
-      targetPath: $(Build.BinariesDirectory)\tcltk_lib
 
-  - task: DownloadPipelineArtifact@1
+  - download: current
+    artifact: cert
     displayName: 'Download artifact: cert'
     condition: and(succeeded(), variables['SigningCertificate'])
-    inputs:
-      artifactName: cert
-      targetPath: $(Build.BinariesDirectory)\cert
 
   - powershell: |
-      copy "$(Build.BinariesDirectory)\bin\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
+      copy "$(Pipeline.Workspace)\bin_$(Name)\Activate.ps1" Lib\venv\scripts\common\Activate.ps1 -Force
     displayName: 'Copy signed files into sources'
     condition: and(succeeded(), variables['SigningCertificate'])
 
@@ -69,13 +64,13 @@ jobs:
 
   - powershell: |
      Remove-Item "$(Build.ArtifactStagingDirectory)\appx-store" -Recurse -Force -EA 0
-      $(LayoutCmd) --copy "$(Build.ArtifactStagingDirectory)\appx-store" --preset-appx --precompile
+      $(LayoutCmd) --copy "$(Build.ArtifactStagingDirectory)\appx-store" --preset-appx $(ExtraOptions)
     displayName: 'Generate store APPX layout'
     env:
       TCL_LIBRARY: $(TclLibrary)
 
   - powershell: |
-      $info = (gc "$(Build.BinariesDirectory)\cert\certinfo.json" | ConvertFrom-JSON)
+      $info = (gc "$(Pipeline.Workspace)\cert\certinfo.json" | ConvertFrom-JSON)
       Write-Host "Side-loadable APPX must be signed with '$($info.Subject)'"
       Write-Host "##vso[task.setvariable variable=APPX_DATA_PUBLISHER]$($info.Subject)"
       Write-Host "##vso[task.setvariable variable=APPX_DATA_SHA256]$($info.SHA256)"
@@ -84,19 +79,15 @@ jobs:
 
   - powershell: |
       Remove-Item "$(Build.ArtifactStagingDirectory)\appx" -Recurse -Force -EA 0
-      $(LayoutCmd) --copy "$(Build.ArtifactStagingDirectory)\appx" --preset-appx --precompile --include-symbols --include-tests
+      $(LayoutCmd) --copy "$(Build.ArtifactStagingDirectory)\appx" --preset-appx --include-symbols --include-tests $(ExtraOptions)
     displayName: 'Generate sideloading APPX layout'
     env:
       TCL_LIBRARY: $(TclLibrary)
 
-  - task: PublishPipelineArtifact@0
+  - publish: '$(Build.ArtifactStagingDirectory)\appx-store'
+    artifact: layout_appxstore_$(Name)
     displayName: 'Publish Artifact: layout_appxstore_$(Name)'
-    inputs:
-      targetPath: '$(Build.ArtifactStagingDirectory)\appx-store'
-      artifactName: layout_appxstore_$(Name)
 
-  - task: PublishPipelineArtifact@0
+  - publish: '$(Build.ArtifactStagingDirectory)\appx'
+    artifact: layout_appx_$(Name)
     displayName: 'Publish Artifact: layout_appx_$(Name)'
-    inputs:
-      targetPath: '$(Build.ArtifactStagingDirectory)\appx'
-      artifactName: layout_appx_$(Name)
diff --git a/windows-release/stage-layout-nuget.yml b/windows-release/stage-layout-nuget.yml
index 215c0fb6..bf69900b 100644
--- a/windows-release/stage-layout-nuget.yml
+++ b/windows-release/stage-layout-nuget.yml
@@ -12,56 +12,59 @@ jobs:
   workspace:
     clean: all
 
+  variables:
+    PYTHONHOME: $(Build.SourcesDirectory)
+
   strategy:
     matrix:
       win32:
         Name: win32
-        Python: $(Build.BinariesDirectory)\bin\python.exe
-        PYTHONHOME: $(Build.SourcesDirectory)
+        Arch: win32
+        ExtraOptions: ''
       amd64:
         Name: amd64
-        Python: $(Build.BinariesDirectory)\bin\python.exe
-        PYTHONHOME: $(Build.SourcesDirectory)
+        Arch: amd64
+        ExtraOptions: ''
       arm64:
         Name: arm64
+        Arch: arm64
         HostArch: amd64
-        Python: $(Build.BinariesDirectory)\bin_amd64\python.exe
-        PYTHONHOME: $(Build.SourcesDirectory)
+        ExtraOptions: ''
+      ${{ if eq(parameters.DoFreethreaded, 'true') }}:
+        win32_t:
+          Name: win32_t
+          Arch: win32
+          HostArch: win32
+          ExtraOptions: --include-freethreaded
+        amd64_t:
+          Name: amd64_t
+          Arch: amd64
+          HostArch: amd64
+          ExtraOptions: --include-freethreaded
+        arm64_t:
+          Name: arm64_t
+          Arch: arm64
+          HostArch: amd64
+          ExtraOptions: --include-freethreaded
 
   steps:
   - template: ./checkout.yml
 
-  - task: DownloadPipelineArtifact@1
+  - download: current
+    artifact: bin_$(Name)
     displayName: 'Download artifact: bin_$(Name)'
-    inputs:
-      artifactName: bin_$(Name)
-      targetPath: $(Build.BinariesDirectory)\bin
 
   - powershell: |
-      copy $(Build.BinariesDirectory)\bin\Activate.ps1 Lib\venv\scripts\common\Activate.ps1 -Force
+      copy $(Pipeline.Workspace)\bin_$(Name)\Activate.ps1 Lib\venv\scripts\common\Activate.ps1 -Force
     displayName: 'Copy signed files into sources'
     condition: and(succeeded(), variables['SigningCertificate'])
 
   - template: ./layout-command.yml
 
   - powershell: |
-      $(LayoutCmd) --copy "$(Build.ArtifactStagingDirectory)\nuget" --preset-nuget
+      $(LayoutCmd) --copy "$(Build.ArtifactStagingDirectory)\nuget" --preset-nuget $(ExtraOptions)
     displayName: 'Generate nuget layout'
 
-  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-    - powershell: |
-        $(LayoutCmd) --copy "$(Build.ArtifactStagingDirectory)\nuget_freethreaded" --preset-nuget --include-freethreaded
-      displayName: 'Generate freethreaded nuget layout'
-
-  - task: PublishPipelineArtifact@0
+  - publish: '$(Build.ArtifactStagingDirectory)\nuget'
+    artifact: layout_nuget_$(Name)
     displayName: 'Publish Artifact: layout_nuget_$(Name)'
-    inputs:
-      targetPath: '$(Build.ArtifactStagingDirectory)\nuget'
-      artifactName: layout_nuget_$(Name)
-
-  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-    - task: PublishPipelineArtifact@0
-      displayName: 'Publish Artifact: layout_nuget_freethreaded_$(Name)'
-      inputs:
-        targetPath: '$(Build.ArtifactStagingDirectory)\nuget_freethreaded'
-        artifactName: layout_nuget_freethreaded_$(Name)
diff --git a/windows-release/stage-msi.yml b/windows-release/stage-msi.yml
index 2d0fb8f3..ef08bef2 100644
--- a/windows-release/stage-msi.yml
+++ b/windows-release/stage-msi.yml
@@ -1,53 +1,84 @@
 parameters:
   ARM64TclTk: true
+  DoARM64: true
   DoFreethreaded: false
   SigningCertificate: ''
 
 jobs:
-- ${{ if parameters.SigningCertificate }}:
-  - job: Make_Signed_MSI
-    displayName: Make signed MSI
+- job: Make_MSI
+  displayName: Make MSI
 
-    pool:
-      vmImage: windows-2022
+  pool:
+    vmImage: windows-2022
 
-    variables:
+  variables:
+  - ${{ if eq(parameters.SigningCertificate, 'PythonSoftwareFoundation') }}:
     - group: CPythonSign
-    - name: ReleaseUri
-      value: http://www.python.org/{arch}
-    - name: DownloadUrl
-      value: https://www.python.org/ftp/python/{version}/{arch}{releasename}/{msi}
-    - name: Py_OutDir
-      value: $(Build.BinariesDirectory)
+  - ${{ if eq(parameters.SigningCertificate, 'TestSign') }}:
+    - group: CPythonTestSign
+  - name: ReleaseUri
+    value: http://www.python.org/{arch}
+  - name: DownloadUrl
+    value: https://www.python.org/ftp/python/{version}/{arch}{releasename}/{msi}
+  - name: Py_OutDir
+    value: $(Build.BinariesDirectory)
 
-    workspace:
-      clean: all
+  workspace:
+    clean: all
 
-    steps:
-    - template: msi-steps.yml
-      parameters:
-        ARM64TclTk: ${{ parameters.ARM64TclTk }}
-        DoFreethreaded: ${{ parameters.DoFreethreaded }}
-        SigningCertificate: ${{ parameters.SigningCertificate }}
-
-
-- ${{ else }}:
-  - job: Make_MSI
-    displayName: Make MSI
-
-    pool:
-      vmImage: windows-2022
-
-    variables:
-      ReleaseUri: http://www.python.org/{arch}
-      DownloadUrl: https://www.python.org/ftp/python/{version}/{arch}{releasename}/{msi}
-      Py_OutDir: $(Build.BinariesDirectory)
-
-    workspace:
-      clean: all
-
-    steps:
-    - template: msi-steps.yml
-      parameters:
-        ARM64TclTk: ${{ parameters.ARM64TclTk }}
-        DoFreethreaded: ${{ parameters.DoFreethreaded }}
+  steps:
+  - template: msi-steps.yml
+    parameters:
+      DoFreethreaded: ${{ parameters.DoFreethreaded }}
+      SigningCertificate: ${{ parameters.SigningCertificate }}
+      Artifacts:
+      - artifact: doc
+        target: $(Build.SourcesDirectory)\Doc\build
+      - artifact: bin_win32
+        target: $(Build.BinariesDirectory)\win32
+      - artifact: bin_win32_d
+        target: $(Build.BinariesDirectory)\win32
+      - artifact: tcltk_lib_win32
+      - artifact: bin_amd64
+        target: $(Build.BinariesDirectory)\amd64
+      - artifact: bin_amd64_d
+        target: $(Build.BinariesDirectory)\amd64
+      - artifact: tcltk_lib_amd64
+      - ${{ if eq(parameters.DoARM64, 'true') }}:
+        - artifact: bin_arm64
+          target: $(Build.BinariesDirectory)\arm64
+        - artifact: bin_arm64_d
+          target: $(Build.BinariesDirectory)\arm64
+        - ${{ if eq(parameters.ARM64TclTk, 'true') }}:
+          - artifact: tcltk_lib_arm64
+      # Freethreaded binaries copy into the same target directory, but files
+      # are not overwritten.
+      - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
+        - artifact: bin_win32_t
+          target: $(Build.BinariesDirectory)\win32
+        - artifact: bin_win32_td
+          target: $(Build.BinariesDirectory)\win32
+        - artifact: bin_amd64_t
+          target: $(Build.BinariesDirectory)\amd64
+        - artifact: bin_amd64_td
+          target: $(Build.BinariesDirectory)\amd64
+        - ${{ if eq(parameters.DoARM64, 'true') }}:
+          - artifact: bin_arm64_t
+            target: $(Build.BinariesDirectory)\arm64
+          - artifact: bin_arm64_td
+            target: $(Build.BinariesDirectory)\arm64
+      Bundles:
+      - bundle: win32
+        Platform: x86
+        PythonForBuild: bin_win32
+        TclTkArtifact: tcltk_lib_win32
+      - bundle: amd64
+        Platform: x64
+        PythonForBuild: bin_amd64
+        TclTkArtifact: tcltk_lib_amd64
+      - ${{ if eq(parameters.DoARM64, 'true') }}:
+        - bundle: arm64
+          Platform: ARM64
+          PythonForBuild: bin_win32
+          ${{ if eq(parameters.ARM64TclTk, 'true') }}:
+            TclTkArtifact: tcltk_lib_arm64
diff --git a/windows-release/stage-pack-msix.yml b/windows-release/stage-pack-msix.yml
index 2bb05e9f..edb47c11 100644
--- a/windows-release/stage-pack-msix.yml
+++ b/windows-release/stage-pack-msix.yml
@@ -37,11 +37,9 @@ jobs:
   steps:
   - template: ./checkout.yml
 
-  - task: DownloadPipelineArtifact@1
+  - download: current
+    artifact: layout_$(Artifact)_$(Name)
     displayName: 'Download artifact: layout_$(Artifact)_$(Name)'
-    inputs:
-      artifactName: layout_$(Artifact)_$(Name)
-      targetPath: $(Build.BinariesDirectory)\layout
 
   - task: DownloadBuildArtifacts@0
     displayName: 'Download artifact: symbols'
@@ -59,7 +57,7 @@ jobs:
     displayName: 'Extract version numbers'
 
   - powershell: |
-      ./Tools/msi/make_appx.ps1 -layout "$(Build.BinariesDirectory)\layout" -msix "$(Build.ArtifactStagingDirectory)\msix\$(Filename).msix"
+      ./Tools/msi/make_appx.ps1 -layout "$(Pipeline.Workspace)\layout_$(Artifact)_$(Name)" -msix "$(Build.ArtifactStagingDirectory)\msix\$(Filename).msix"
     displayName: 'Build msix'
 
   - powershell: |
@@ -107,7 +105,10 @@ jobs:
       clean: all
 
     variables:
-    - group: CPythonSign
+    - ${{ if eq(parameters.SigningCertificate, 'PythonSoftwareFoundation') }}:
+      - group: CPythonSign
+    - ${{ if eq(parameters.SigningCertificate, 'TestSign') }}:
+      - group: CPythonTestSign
 
     steps:
     - template: ./checkout.yml
diff --git a/windows-release/stage-pack-nuget.yml b/windows-release/stage-pack-nuget.yml
index ded8ce6c..b7d41891 100644
--- a/windows-release/stage-pack-nuget.yml
+++ b/windows-release/stage-pack-nuget.yml
@@ -21,26 +21,26 @@ jobs:
         Name: win32
       arm64:
         Name: arm64
+      ${{ if eq(parameters.DoFreethreaded, 'true') }}:
+        amd64_t:
+          Name: amd64_t
+        win32_t:
+          Name: win32_t
+        arm64_t:
+          Name: arm64_t
 
-  ${{ if parameters.SigningCertificate }}:
-    variables:
+  variables:
+  - ${{ if eq(parameters.SigningCertificate, 'PythonSoftwareFoundation') }}:
     - group: CPythonSign
+  - ${{ if eq(parameters.SigningCertificate, 'TestSign') }}:
+    - group: CPythonTestSign
 
   steps:
   - checkout: none
 
-  - task: DownloadPipelineArtifact@1
+  - download: current
+    artifact: layout_nuget_$(Name)
     displayName: 'Download artifact: layout_nuget_$(Name)'
-    inputs:
-      artifactName: layout_nuget_$(Name)
-      targetPath: $(Build.BinariesDirectory)\layout
-
-  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-    - task: DownloadPipelineArtifact@1
-      displayName: 'Download artifact: layout_nuget_freethreaded_$(Name)'
-      inputs:
-        artifactName: layout_nuget_freethreaded_$(Name)
-        targetPath: $(Build.BinariesDirectory)\layout_freethreaded
 
   - task: NugetToolInstaller@0
     displayName: 'Install Nuget'
@@ -49,7 +49,7 @@ jobs:
 
   - powershell: >
       nuget pack
-      "$(Build.BinariesDirectory)\layout\python.nuspec"
+      "$(Pipeline.Workspace)\layout_nuget_$(Name)\python.nuspec"
       -OutputDirectory $(Build.ArtifactStagingDirectory)
       -NoPackageAnalysis
       -NonInteractive
@@ -58,7 +58,7 @@ jobs:
 
   - powershell: >
       nuget pack
-      "$(Build.BinariesDirectory)\layout\python.nuspec"
+      "$(Pipeline.Workspace)\layout_nuget_$(Name)\python.nuspec"
       -OutputDirectory $(Build.ArtifactStagingDirectory)
       -NoPackageAnalysis
       -NonInteractive
@@ -66,26 +66,6 @@ jobs:
     condition: and(succeeded(), variables['OverrideNugetVersion'])
     displayName: 'Create nuget package'
 
-  - ${{ if eq(parameters.DoFreethreaded, 'true') }}:
-    - powershell: >
-        nuget pack
-        "$(Build.BinariesDirectory)\layout_freethreaded\python.nuspec"
-        -OutputDirectory $(Build.ArtifactStagingDirectory)
-        -NoPackageAnalysis
-        -NonInteractive
-      condition: and(succeeded(), not(variables['OverrideNugetVersion']))
-      displayName: 'Create freethreaded nuget package'
-
-    - powershell: >
-        nuget pack
-        "$(Build.BinariesDirectory)\layout_freethreaded\python.nuspec"
-        -OutputDirectory $(Build.ArtifactStagingDirectory)
-        -NoPackageAnalysis
-        -NonInteractive
-        -Version "$(OverrideNugetVersion)"
-      condition: and(succeeded(), variables['OverrideNugetVersion'])
-      displayName: 'Create freethreaded nuget package'
-
   - template: sign-nuget-files.yml
     parameters:
       Include: '*.nupkg'
diff --git a/windows-release/stage-sign.yml b/windows-release/stage-sign.yml
index f16aa6bb..9733816d 100644
--- a/windows-release/stage-sign.yml
+++ b/windows-release/stage-sign.yml
@@ -2,6 +2,7 @@ parameters:
   Include: '*.exe, *.dll, *.pyd, *.cat, *.ps1'
   Exclude: 'vcruntime*, libffi*, libcrypto*, libssl*'
   SigningCertificate: ''
+  DoFreethreaded: 'false'
 
 jobs:
 - ${{ if parameters.SigningCertificate }}:
@@ -22,9 +23,19 @@ jobs:
           Name: amd64
         arm64:
           Name: arm64
+        ${{ if eq(parameters.DoFreethreaded, 'true') }}:
+          win32_t:
+            Name: win32_t
+          amd64_t:
+            Name: amd64_t
+          arm64_t:
+            Name: arm64_t
 
     variables:
-    - group: CPythonSign
+    - ${{ if eq(parameters.SigningCertificate, 'PythonSoftwareFoundation') }}:
+      - group: CPythonSign
+    - ${{ if eq(parameters.SigningCertificate, 'TestSign') }}:
+      - group: CPythonTestSign
 
     steps:
     - template: ./checkout.yml
diff --git a/windows-release/tcltk-build.yml b/windows-release/tcltk-build.yml
index 4ac418a2..db9248e0 100644
--- a/windows-release/tcltk-build.yml
+++ b/windows-release/tcltk-build.yml
@@ -39,8 +39,10 @@ resources:
 
 
 variables:
-- ${{ if ne(parameters.SigningCertificate, 'Unsigned') }}:
+- ${{ if eq(parameters.SigningCertificate, 'PythonSoftwareFoundation') }}:
   - group: CPythonSign
+- ${{ if eq(parameters.SigningCertificate, 'TestSign') }}:
+  - group: CPythonTestSign
 - name: IntDir
   value: '$(Build.BinariesDirectory)\obj'
 - name: ExternalsDir