diff --git a/build/yaml/pipelines/release.yaml b/build/yaml/pipelines/release.yaml
index 68f8a86b..1599ad59 100644
--- a/build/yaml/pipelines/release.yaml
+++ b/build/yaml/pipelines/release.yaml
@@ -23,6 +23,16 @@ name: $(date:yyyyMMdd)$(rev:rr)
 trigger: none
 pr: none
 
+parameters:
+- name: dryRun
+  displayName: 'Dry run: run everything but skip the NuGet publish (nothing is published)'
+  type: boolean
+  default: false
+- name: promoteToRelease
+  displayName: 'Promote the published packages to the Release view'
+  type: boolean
+  default: false
+
 variables:
   TeamName: VS Production Diagnostics
 
@@ -37,8 +47,17 @@ variables:
   # ---- Contacts ----
   TeamContact: clrieowners@microsoft.com
 
-  # Set to 'True' (e.g. at queue time) to promote the published packages to the Release view.
-  PromoteToRelease: 'False'
+  # Queue-time toggles. YAML variables alone are NOT settable at queue time, so these map the
+  # runtime parameters (declared above, shown in the "Run pipeline" dialog) onto the variable
+  # names the stage conditions already use. A boolean parameter expands to 'True'/'False'.
+  #
+  # Promote the published packages to the Release view.
+  PromoteToRelease: ${{ parameters.promoteToRelease }}
+
+  # Dry run: the full pipeline runs (artifact download, approval gate, and -- if enabled --
+  # the promote logic), but the NuGet push (output: nuget) is skipped so nothing is
+  # actually published to the feed.
+  DryRun: ${{ parameters.dryRun }}
 
 resources:
   repositories:
diff --git a/build/yaml/stages/release.yaml b/build/yaml/stages/release.yaml
index 1dc9c129..b7ca0948 100644
--- a/build/yaml/stages/release.yaml
+++ b/build/yaml/stages/release.yaml
@@ -25,8 +25,14 @@ stages:
   displayName: Publish NuGets to internal InstrumentationEngine Feed
   dependsOn: []
   jobs:
-  - deployment: Publish
-    displayName: Publish NuGets to internal InstrumentationEngine Feed
+  # ---------------------------------------------------------------------------------
+  # Approval gate. A release (deployment) job targeting the gated environment so the
+  # classic pre-deploy approval still applies before anything is published. It performs
+  # no work itself -- 1ES release jobs cannot declare outputs, so the actual NuGet push
+  # lives on the separate plain 'Publish' job below (output: nuget).
+  # ---------------------------------------------------------------------------------
+  - deployment: ApprovalGate
+    displayName: Approval gate (internal NuGet feed)
     environment: CLRIE-Release-Internal-NuGet-Feed
     pool:
       name: VSEngSS-Microbuild2022-1ES
@@ -39,32 +45,82 @@ stages:
         deploy:
           steps:
           - download: none
-          - download: ClrInstrumentationEngine-Signed-Yaml
-            artifact: packages-windows-Release
-            patterns: '**/Microsoft.InstrumentationEngine*.nupkg'
-            displayName: Download Windows packages
-          - download: ClrInstrumentationEngine-Signed-Yaml
-            artifact: packages-linux-ubuntu-Release
-            patterns: '**/Microsoft.InstrumentationEngine*.nupkg'
-            displayName: Download Linux (ubuntu) packages
-          - download: ClrInstrumentationEngine-Signed-Yaml
-            artifact: packages-linux-alpine-Release
-            patterns: '**/Microsoft.InstrumentationEngine*.nupkg'
-            displayName: Download Linux (alpine) packages
 
-          - task: NuGetAuthenticate@1
-            displayName: NuGet Authenticate
+  # ---------------------------------------------------------------------------------
+  # Publish. Plain job (runs only after the gate is approved). Artifacts are downloaded
+  # via templateContext.inputs (the 1ES-sanctioned replacement for '- download:') and
+  # published via the only construct 1ES allows for pushing NuGet packages: output: nuget.
+  # ---------------------------------------------------------------------------------
+  - job: Publish
+    displayName: Publish NuGets to internal InstrumentationEngine Feed
+    dependsOn: ApprovalGate
+    pool:
+      name: VSEngSS-Microbuild2022-1ES
+      os: windows
+    templateContext:
+      inputs:
+      - input: pipelineArtifact
+        pipeline: ClrInstrumentationEngine-Signed-Yaml
+        artifactName: packages-windows-Release
+        targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-windows-Release
+      - input: pipelineArtifact
+        pipeline: ClrInstrumentationEngine-Signed-Yaml
+        artifactName: packages-linux-ubuntu-Release
+        targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-linux-ubuntu-Release
+      - input: pipelineArtifact
+        pipeline: ClrInstrumentationEngine-Signed-Yaml
+        artifactName: packages-linux-alpine-Release
+        targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-linux-alpine-Release
+      outputs:
+      - output: nuget
+        displayName: Push to DevDiv InstrumentationEngine feed
+        # Dry run: skip the actual push (nothing is published) while the rest of the job
+        # -- artifact download above and the promote logic downstream -- still runs.
+        condition: ne(variables['DryRun'], 'True')
+        packageParentPath: $(ArtifactsDirectory)
+        packagesToPush: $(ArtifactsDirectory)\$(WindowsInstrumentationEngineNuGetArtifactPathPattern);$(ArtifactsDirectory)\$(LinuxInstrumentationEngineNuGetArtifactPathPattern)
+        nuGetFeedType: internal
+        publishVstsFeed: 59c1dfae-dea5-4ea5-ac83-c9abcb4ac339
+        allowPackageConflicts: true
+        publishPackageMetadata: true
+        verbosityPush: Detailed
+    steps:
+    - checkout: none
 
-          - task: NuGetCommand@2
-            displayName: Push to DevDiv InstrumentationEngine feed
-            inputs:
-              command: push
-              nuGetFeedType: internal
-              publishVstsFeed: 59c1dfae-dea5-4ea5-ac83-c9abcb4ac339
-              packagesToPush: $(ArtifactsDirectory)\$(WindowsInstrumentationEngineNuGetArtifactPathPattern);$(ArtifactsDirectory)\$(LinuxInstrumentationEngineNuGetArtifactPathPattern)
-              allowPackageConflicts: true
-              publishPackageMetadata: true
-              verbosityPush: Detailed
+  # ---------------------------------------------------------------------------------
+  # Promote (optional). Release (deployment) job, only runs when PromoteToRelease=True.
+  # Artifacts are downloaded via templateContext.inputs; the promote REST call runs in
+  # the on.success hook below.
+  # ---------------------------------------------------------------------------------
+  - deployment: Promote
+    displayName: Promote package to Release View
+    dependsOn: Publish
+    condition: eq(variables['PromoteToRelease'], 'True')
+    environment: CLRIE-Release-Promote-Internal-NuGet-Feed
+    pool:
+      name: VSEngSS-Microbuild2022-1ES
+      os: windows
+    templateContext:
+      type: releaseJob
+      isProduction: true
+      inputs:
+      - input: pipelineArtifact
+        pipeline: ClrInstrumentationEngine-Signed-Yaml
+        artifactName: packages-windows-Release
+        targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-windows-Release
+      - input: pipelineArtifact
+        pipeline: ClrInstrumentationEngine-Signed-Yaml
+        artifactName: packages-linux-ubuntu-Release
+        targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-linux-ubuntu-Release
+      - input: pipelineArtifact
+        pipeline: ClrInstrumentationEngine-Signed-Yaml
+        artifactName: packages-linux-alpine-Release
+        targetPath: $(Pipeline.Workspace)\ClrInstrumentationEngine-Signed-Yaml\packages-linux-alpine-Release
+    strategy:
+      runOnce:
+        deploy:
+          steps:
+          - download: none
         on:
           # The 'on success' hook runs after the deploy phase (including the NuGet push above)
           # has succeeded, so the promote step always runs after the packages are published.
@@ -72,10 +128,10 @@ stages:
             steps:
             # Classic equivalent: "Promote package to Release View" (deprecated marketplace task,
             # gated on PromoteToRelease). Implemented here against the Azure Artifacts packaging
-            # REST API; only runs when PromoteToRelease is set to 'True'.
+            # REST API; only runs when PromoteToRelease is 'True' and this is not a dry run.
             - task: PowerShell@2
               displayName: Promote package to Release View
-              condition: and(succeeded(), eq(variables['PromoteToRelease'], 'True'))
+              condition: and(succeeded(), eq(variables['PromoteToRelease'], 'True'), ne(variables['DryRun'], 'True'))
               env:
                 SYSTEM_ACCESSTOKEN: $(System.AccessToken)
               inputs: