diff --git a/common/config/azure-pipelines/npm-publish.yaml b/common/config/azure-pipelines/npm-publish.yaml
index 62c30996..45f7ab66 100644
--- a/common/config/azure-pipelines/npm-publish.yaml
+++ b/common/config/azure-pipelines/npm-publish.yaml
@@ -31,6 +31,14 @@ variables:
 
 resources:
   repositories:
+    # Use the Azure Pipelines GitHub App identity for the version-bump commit and PR. Unlike the
+    # "rushbot" user credentials from "checkout: self", this bot identity is exempt from the
+    # Microsoft CLA check and does not require a separate CLA-signoff pipeline run.
+    - repository: tsdocGitHubApp
+      type: github
+      name: microsoft/tsdoc
+      endpoint: GitHubProjects
+      ref: refs/heads/main
     - repository: RushstackMainRepo
       type: github
       name: Microsoft/rushstack
@@ -72,7 +80,7 @@ extends:
                   targetPath: $(Build.ArtifactStagingDirectory)/json-schemas
                   artifactName: json-schemas
             steps:
-              - checkout: self
+              - checkout: tsdocGitHubApp
                 persistCredentials: true
                 path: tsdoc
 
diff --git a/common/config/azure-pipelines/npm-release.yaml b/common/config/azure-pipelines/npm-release.yaml
index ba946bcb..066c5afe 100644
--- a/common/config/azure-pipelines/npm-release.yaml
+++ b/common/config/azure-pipelines/npm-release.yaml
@@ -93,11 +93,21 @@ extends:
             pool:
               name: publish-rushstack
               os: linux
+            templateContext:
+              outputParentDirectory: $(Build.ArtifactStagingDirectory)
+              outputs:
+                - output: pipelineArtifact
+                  targetPath: $(Build.ArtifactStagingDirectory)/published-versions
+                  artifactName: published-versions
             steps:
               - checkout: self
                 persistCredentials: true
                 path: tsdoc
 
+              - bash: |
+                  mkdir -p "$(Build.ArtifactStagingDirectory)/published-versions"
+                displayName: 'Initialize artifact staging directory'
+
               - template: /common/config/azure-pipelines/templates/install-node.yaml@self
 
               - ${{ if gt(parameters.BumpPipelineRunIdOverride, 0) }}:
@@ -118,6 +128,18 @@ extends:
                       Name: FindBumpRun
                       WorkingDirectory: $(RepoPath)
 
+              - task: DownloadPipelineArtifact@2
+                condition: eq(variables['FindBumpRun.IsVersionBumpMerge'], 'true')
+                inputs:
+                  artifactName: published-versions
+                  targetPath: $(Build.ArtifactStagingDirectory)/published-versions
+                  project: ${{ parameters.BumpPipelineProject }}
+                  definition: $(FindBumpRun.BumpPipelineDefinitionId)
+                  pipelineId: $(FindBumpRun.BumpPipelineRunId)
+                  buildType: specific
+                  buildVersionToDownload: specific
+                displayName: 'Stage published versions artifact'
+
       - stage: Publish
         displayName: 'Publish NPM Packages via ESRP'
         dependsOn: