diff --git a/eng/common/pipelines/ci.yml b/eng/common/pipelines/ci.yml
index 008fec91a32..a3d5cf414b8 100644
--- a/eng/common/pipelines/ci.yml
+++ b/eng/common/pipelines/ci.yml
@@ -29,7 +29,10 @@ extends:
                 displayName: Install Node.js
                 inputs:
                   versionSpec: 22.x
-              - script: npm install -g pnpm # Pnpm manage-package-manager-versions will respect packageManager field
+
+              - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
+              - script: npm install -g pnpm@10.30.2 # Pnpm manage-package-manager-versions will respect packageManager field
                 displayName: Install pnpm
 
               - script: pnpm install
diff --git a/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml b/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
new file mode 100644
index 00000000000..3fa699b387d
--- /dev/null
+++ b/eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
@@ -0,0 +1,41 @@
+parameters:
+  - name: npmrcPath
+    type: string
+    # When empty, defaults to the agent user's .npmrc ($HOME/.npmrc on
+    # Linux/macOS, %USERPROFILE%\.npmrc on Windows) so every subsequent
+    # npm / pnpm / npx call in the job inherits the registry + auth.
+    default: ""
+  - name: registryUrl
+    type: string
+    default: "https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/"
+  - name: CustomCondition
+    type: string
+    default: succeeded()
+  - name: ServiceConnection
+    type: string
+    default: ""
+
+steps:
+  - pwsh: |
+      $npmrcPath = '${{ parameters.npmrcPath }}'
+      if (-not $npmrcPath) { $npmrcPath = Join-Path $HOME '.npmrc' }
+
+      Write-Host "Creating .npmrc file $npmrcPath for registry ${{ parameters.registryUrl }}"
+      $parentFolder = Split-Path -Path $npmrcPath -Parent
+
+      if ($parentFolder -and -not (Test-Path $parentFolder)) {
+        Write-Host "Creating folder $parentFolder"
+        New-Item -Path $parentFolder -ItemType Directory | Out-Null
+      }
+
+      "registry=${{ parameters.registryUrl }}" | Out-File $npmrcPath
+      Write-Host "##vso[task.setvariable variable=resolvedNpmrcPath]$npmrcPath"
+    displayName: "Create .npmrc"
+    condition: ${{ parameters.CustomCondition }}
+
+  - task: npmAuthenticate@0
+    displayName: Authenticate .npmrc
+    condition: ${{ parameters.CustomCondition }}
+    inputs:
+      workingFile: $(resolvedNpmrcPath)
+      azureDevOpsServiceConnection: ${{ parameters.ServiceConnection }}
diff --git a/eng/emitters/pipelines/templates/stages/emitter-stages.yml b/eng/emitters/pipelines/templates/stages/emitter-stages.yml
index 7d73d17a2cc..2adecca67ba 100644
--- a/eng/emitters/pipelines/templates/stages/emitter-stages.yml
+++ b/eng/emitters/pipelines/templates/stages/emitter-stages.yml
@@ -326,10 +326,7 @@ stages:
                 displayName: Download build artifacts
 
               # Always publish to internal feed
-              - template: /eng/emitters/pipelines/templates/steps/create-authenticated-npmrc.yml
-                parameters:
-                  npmrcPath: $(buildArtifactsPath)/packages/.npmrc
-                  registryUrl: https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-js/npm/registry/
+              - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
 
               # publish to devops feed
               - pwsh: |
@@ -389,6 +386,7 @@ stages:
                     inputs:
                       versionSpec: "22.x"
                       checkLatest: true
+                  - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
                   - script: npm ci
                     displayName: Install emitter dependencies for playground bundle
                     workingDirectory: $(Build.SourcesDirectory)/${{ parameters.PackagePath }}
diff --git a/eng/emitters/pipelines/templates/steps/build-step.yml b/eng/emitters/pipelines/templates/steps/build-step.yml
index abac27e71c6..d723de94d4b 100644
--- a/eng/emitters/pipelines/templates/steps/build-step.yml
+++ b/eng/emitters/pipelines/templates/steps/build-step.yml
@@ -59,6 +59,8 @@ steps:
 
   - checkout: self
 
+  - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
   - task: NodeTool@0
     displayName: Install Node.js
     retryCountOnTaskFailure: 3
diff --git a/eng/emitters/pipelines/templates/steps/create-authenticated-npmrc.yml b/eng/emitters/pipelines/templates/steps/create-authenticated-npmrc.yml
deleted file mode 100644
index d315a7d6234..00000000000
--- a/eng/emitters/pipelines/templates/steps/create-authenticated-npmrc.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-parameters:
-  - name: npmrcPath
-    type: string
-  - name: registryUrl
-    type: string
-
-steps:
-  - pwsh: |
-      Write-Host "Creating .npmrc file ${{ parameters.npmrcPath }} for registry ${{ parameters.registryUrl }}"
-      $parentFolder = Split-Path -Path '${{ parameters.npmrcPath }}' -Parent
-
-      if (!(Test-Path $parentFolder)) {
-        Write-Host "Creating folder $parentFolder"
-        New-Item -Path $parentFolder -ItemType Directory | Out-Null
-      }
-
-      $content = "registry=${{ parameters.registryUrl }}`n`n" + "always-auth=true"
-      $content | Out-File '${{ parameters.npmrcPath }}'
-    displayName: "Create .npmrc"
-  - task: npmAuthenticate@0
-    displayName: Authenticate .npmrc
-    inputs:
-      workingFile: ${{ parameters.npmrcPath }}
diff --git a/eng/emitters/pipelines/templates/steps/test-step.yml b/eng/emitters/pipelines/templates/steps/test-step.yml
index fa5b0980c22..59a2beb5689 100644
--- a/eng/emitters/pipelines/templates/steps/test-step.yml
+++ b/eng/emitters/pipelines/templates/steps/test-step.yml
@@ -51,6 +51,8 @@ parameters:
 steps:
   - checkout: self
 
+  - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
   - download: current
     artifact: ${{ parameters.BuildArtifactName }}
     displayName: Download build artifacts
diff --git a/eng/tsp-core/pipelines/jobs/cli/build-tsp-cli.yml b/eng/tsp-core/pipelines/jobs/cli/build-tsp-cli.yml
index 657b421a9e6..a81710eba69 100644
--- a/eng/tsp-core/pipelines/jobs/cli/build-tsp-cli.yml
+++ b/eng/tsp-core/pipelines/jobs/cli/build-tsp-cli.yml
@@ -42,6 +42,8 @@ jobs:
       # - script: npm install -g bun
       #   displayName: Install bun
 
+      - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
       - script: npm install -g pnpm
         displayName: Install pnpm
 
diff --git a/eng/tsp-core/pipelines/templates/install.yml b/eng/tsp-core/pipelines/templates/install.yml
index 2daaa085ec1..8de49aaecc3 100644
--- a/eng/tsp-core/pipelines/templates/install.yml
+++ b/eng/tsp-core/pipelines/templates/install.yml
@@ -24,8 +24,11 @@ steps:
         inputs:
           version: 8.0.x
 
-  - script: npm install -g pnpm # Pnpm manage-package-manager-versions will respect packageManager field
+  - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
+  - script: npm install -g pnpm@10.30.2 # Pnpm manage-package-manager-versions will respect packageManager field
     displayName: Install pnpm
+
   - script: pnpm config set store-dir ${{ parameters.pnpmStorePath }}
     displayName: Setup pnpm cache dir
 
diff --git a/packages/http-client-csharp/eng/pipeline/publish.yml b/packages/http-client-csharp/eng/pipeline/publish.yml
index c0ba9c6f201..e37e84583fb 100644
--- a/packages/http-client-csharp/eng/pipeline/publish.yml
+++ b/packages/http-client-csharp/eng/pipeline/publish.yml
@@ -125,6 +125,9 @@ extends:
               npm_config_cache: $(Agent.TempDirectory)/npm-cache
             steps:
               - checkout: self
+
+              - template: /eng/common/pipelines/templates/steps/create-authenticated-npmrc.yml
+
               - pwsh: |
                   # Determine the TypeSpec PR URL 
                   $repoUrl = '$(Build.Repository.Uri)'.TrimEnd('/')