diff --git a/.pipelines/vscode-powershell-Official.yml b/.pipelines/vscode-powershell-Official.yml
index 7d3a02c2d9..f455e8a051 100644
--- a/.pipelines/vscode-powershell-Official.yml
+++ b/.pipelines/vscode-powershell-Official.yml
@@ -56,7 +56,7 @@ extends:
       EnableCDPxPAT: false
       WindowsHostVersion:
         Version: 2022
-        Network: Netlock
+        Network: KS3
     stages:
     - stage: build
       jobs:
@@ -108,6 +108,18 @@ extends:
               files_to_sign: '**/*.ps1;**/*.psd1;**/*.psm1'
           - pwsh: Invoke-Build Package
             displayName: Create package
+          - pwsh: |
+              npx vsce generate-manifest --packagePath out/powershell-$(vsixVersion).vsix
+              cp out/powershell-$(vsixVersion).manifest out/powershell-$(vsixVersion).signature.p7s
+            displayName: Generate VSIX manifest
+          - task: onebranch.pipeline.signing@1
+            displayName: Sign VSIX manifest
+            inputs:
+              command: sign
+              cp_code: 'CP-401405'
+              search_root: $(Build.SourcesDirectory)/out
+              files_to_sign: |
+                *.signature.p7s;
       - job: test
         displayName: Build and run tests
         pool:
@@ -211,6 +223,10 @@ extends:
                 '--azure-credential'
                 '--packagePath'
                 '$(drop)/powershell-$(vsixVersion).vsix'
+                '--manifestPath'
+                '$(drop)/powershell-$(vsixVersion).manifest'
+                '--signaturePath'
+                '$(drop)/powershell-$(vsixVersion).signature.p7s'
                 if ([bool]::Parse('$(prerelease)')) { '--pre-release' }
               )
               npm run publish -- @publishArgs