diff --git a/.pipelines/scripts/windows_build_vhd.sh b/.pipelines/scripts/windows_build_vhd.sh
index b6ac3472d2c..af6ba2f8ac0 100644
--- a/.pipelines/scripts/windows_build_vhd.sh
+++ b/.pipelines/scripts/windows_build_vhd.sh
@@ -24,7 +24,6 @@ set +x
 # * SKIPVALIDATEREOFFERUPDATE - is always set to True
 # * BUILD_DATE
 
-
 # First we validate the branch. DRY_RUN is only allowed to be false on release branches - which are of the form
 # windows/vYYYYMMDD. If we're on the release branch then we also override SIG_FOR_PRODUCTION, because this is a production build.
 # for dry runs, we set SIG_FOR_PRODUCTION to false.
@@ -34,34 +33,34 @@ echo "Checking SourceBranch: ${BRANCH}"
 
 # Check if IS_RELEASE_PIPELINE is already set in the environment
 if [ -z "${IS_RELEASE_PIPELINE:-}" ]; then
-  if echo "${BRANCH}" | grep -E '^refs/heads/windows/v[[:digit:]]{8}$' > /dev/null; then
-    echo "The branch ${BRANCH} is a release branch. Setting IS_RELEASE_PIPELINE to True."
-    export IS_RELEASE_PIPELINE="True"
-    echo "##vso[task.setvariable variable=IS_RELEASE_PIPELINE]True"
-  else
-    echo "The branch ${BRANCH} is not a release branch. Setting IS_RELEASE_PIPELINE to False."
-    export IS_RELEASE_PIPELINE="False"
-    echo "##vso[task.setvariable variable=IS_RELEASE_PIPELINE]False"
-  fi
+	if echo "${BRANCH}" | grep -E '^refs/heads/windows/v[[:digit:]]{8}$' >/dev/null; then
+		echo "The branch ${BRANCH} is a release branch. Setting IS_RELEASE_PIPELINE to True."
+		export IS_RELEASE_PIPELINE="True"
+		echo "##vso[task.setvariable variable=IS_RELEASE_PIPELINE]True"
+	else
+		echo "The branch ${BRANCH} is not a release branch. Setting IS_RELEASE_PIPELINE to False."
+		export IS_RELEASE_PIPELINE="False"
+		echo "##vso[task.setvariable variable=IS_RELEASE_PIPELINE]False"
+	fi
 fi
 
 if [ "${IS_RELEASE_PIPELINE}" = "True" ]; then
-  if [ "${DRY_RUN}" = "True" ]; then
-    echo "This is a test build triggered from the release pipeline"
-  else
-    echo "This is a release build triggered from the release pipeline. DRY_RUN=${DRY_RUN}"
-
-	if ! (echo "${BRANCH}" | grep -E '^refs/heads/windows/v[[:digit:]]{8}$' > /dev/null); then
-	  echo "The branch ${BRANCH} is not release branch. Please use the release branch. Release branch name format: windows/vYYYYMMDD."
-	  exit 1
+	if [ "${DRY_RUN}" = "True" ]; then
+		echo "This is a test build triggered from the release pipeline"
+	else
+		echo "This is a release build triggered from the release pipeline. DRY_RUN=${DRY_RUN}"
+
+		if ! (echo "${BRANCH}" | grep -E '^refs/heads/windows/v[[:digit:]]{8}$' >/dev/null); then
+			echo "The branch ${BRANCH} is not release branch. Please use the release branch. Release branch name format: windows/vYYYYMMDD."
+			exit 1
+		fi
+		echo "##vso[task.setvariable variable=SIG_FOR_PRODUCTION]True"
 	fi
-    echo "##vso[task.setvariable variable=SIG_FOR_PRODUCTION]True"
-  fi
 else
-  echo "This is a test build triggered from the test pipeline"
-  export DRY_RUN=True
-  echo "##vso[task.setvariable variable=DRY_RUN]$DRY_RUN";
-  echo "##vso[task.setvariable variable=SIG_FOR_PRODUCTION]False"
+	echo "This is a test build triggered from the test pipeline"
+	export DRY_RUN=True
+	echo "##vso[task.setvariable variable=DRY_RUN]$DRY_RUN"
+	echo "##vso[task.setvariable variable=SIG_FOR_PRODUCTION]False"
 fi
 
 export MODE="windowsVhdMode"
@@ -74,32 +73,33 @@ echo "Original SIG_IMAGE_VERSION: ${SIG_IMAGE_VERSION:-}"
 
 # -n is "not empty"
 if [ -n "${SIG_GALLERY_NAME:-}" ] && [ -n "${SIG_IMAGE_NAME_PREFIX:-}" ] && [ -n "${SIG_IMAGE_VERSION:-}" ]; then
-    echo "All of Name, Prefix, and Version have been set"
-    export SIG_IMAGE_NAME="${SIG_IMAGE_NAME_PREFIX}-${WINDOWS_SKU}"
+	echo "All of Name, Prefix, and Version have been set"
+	export SIG_IMAGE_NAME="${SIG_IMAGE_NAME_PREFIX}-${WINDOWS_SKU}"
 else
-    echo "At least on of the name, prefix or version are empty. Overwriting all values. "
-    export SIG_IMAGE_VERSION="$(date +"%y%m%d").$(date +"%H%M%S").$RANDOM"
-    export SIG_IMAGE_NAME="windows-${WINDOWS_SKU}"
-    export SIG_GALLERY_NAME="PackerSigGalleryEastUS"
+	echo "At least on of the name, prefix or version are empty. Overwriting all values. "
+	export SIG_IMAGE_VERSION="$(date +"%y%m%d").$(date +"%H%M%S").$RANDOM"
+	export SIG_IMAGE_NAME="windows-${WINDOWS_SKU}"
+	export SIG_GALLERY_NAME="PackerSigGalleryEastUS"
 
-    export WS_SKU=$(echo $WINDOWS_SKU | tr '-' '_')
+	export WS_SKU=$(echo $WINDOWS_SKU | tr '-' '_')
 fi
 
 if [ "${USE_RELEASE_DATE:-}" = "False" ]; then
-  echo "use current date as build date";  BUILD_DATE=$(date +"%y%m%d")
+	echo "use current date as build date"
+	BUILD_DATE=$(date +"%y%m%d")
 else
-  echo "use release date as build date"
-  echo "${RELEASE_DATE:-}" | grep -E '[[:digit:]]{6}'
-  if (( $? != 0 )); then
-    echo "The release date ${RELEASE_DATE} is not valid date. Release date format: YYMMDD."
-    exit 1
-  fi
-  export BUILD_DATE=${RELEASE_DATE}
+	echo "use release date as build date"
+	echo "${RELEASE_DATE:-}" | grep -E '[[:digit:]]{6}'
+	if (($? != 0)); then
+		echo "The release date ${RELEASE_DATE} is not valid date. Release date format: YYMMDD."
+		exit 1
+	fi
+	export BUILD_DATE=${RELEASE_DATE}
 fi
 echo "Default BUILD_DATE is $BUILD_DATE"
 if [ -n "${CUSTOM_BUILD_DATE:-}" ]; then
-  echo "set BUILD_DATE to ${CUSTOM_BUILD_DATE}"
-  export BUILD_DATE=${CUSTOM_BUILD_DATE}
+	echo "set BUILD_DATE to ${CUSTOM_BUILD_DATE}"
+	export BUILD_DATE=${CUSTOM_BUILD_DATE}
 fi
 
 echo "Modified SIG_IMAGE_VERSION: ${SIG_IMAGE_VERSION}"
@@ -120,6 +120,7 @@ export MANAGED_SIG_ID="$(cat packer-output | grep -a "ManagedImageSharedImageGal
 echo "Found OS_DISK_URI: ${OS_DISK_URI}"
 echo "Found MANAGED_SIG_ID: ${MANAGED_SIG_ID}"
 
+
 # if bash is echoing the commands, then ADO processes both the echo of the command to set the variable and the command itself.
 # This causes super odd behavior in ADO.
 set +x
diff --git a/e2e/types.go b/e2e/types.go
index 9c6a3b177ce..0459d32b9de 100644
--- a/e2e/types.go
+++ b/e2e/types.go
@@ -239,6 +239,15 @@ func (s *Scenario) PrepareVMSSModel(ctx context.Context, t testing.TB, vmss *arm
 		s.VMConfigMutator(vmss)
 	}
 
+	// Enable AutomaticOSUpgrade on the VMSS upgrade policy.
+	// This is required when the VHD image comes from an official 1P gallery.
+	if vmss.Properties.UpgradePolicy == nil {
+		vmss.Properties.UpgradePolicy = &armcompute.UpgradePolicy{}
+	}
+	vmss.Properties.UpgradePolicy.AutomaticOSUpgradePolicy = &armcompute.AutomaticOSUpgradePolicy{
+		EnableAutomaticOSUpgrade: to.Ptr(true),
+	}
+
 	if vmss.Properties.VirtualMachineProfile == nil {
 		vmss.Properties.VirtualMachineProfile = &armcompute.VirtualMachineScaleSetVMProfile{}
 	}
diff --git a/vhdbuilder/packer/produce-packer-settings-functions.sh b/vhdbuilder/packer/produce-packer-settings-functions.sh
index 4c4793b8a0c..3fce022354d 100644
--- a/vhdbuilder/packer/produce-packer-settings-functions.sh
+++ b/vhdbuilder/packer/produce-packer-settings-functions.sh
@@ -357,13 +357,11 @@ function prepare_windows_vhd() {
 			fi
 
 			windows_sigmode_direct_shared_gallery_image_id="/SharedGalleries/${sig_source_gallery_name}/Images/${sig_image_name}/Versions/${WINDOWS_IMAGE_VERSION}"
-			# Clear marketplace and raw VHD source fields — packer requires exactly one source type
+			# Clear VHD import fields — they conflict with gallery source.
+			# Keep marketplace fields (publisher/offer/sku/version) populated: Packer's ARM
+			# template validation still references them even when using direct_shared_gallery_image_id.
 			WINDOWS_IMAGE_URL=""
 			WINDOWS_BASE_IMAGE_URL=""
-			WINDOWS_IMAGE_PUBLISHER=""
-			WINDOWS_IMAGE_OFFER=""
-			WINDOWS_IMAGE_SKU=""
-			WINDOWS_IMAGE_VERSION=""
 			echo "Using direct shared gallery source:"
 			echo "  ID: ${windows_sigmode_direct_shared_gallery_image_id}"