diff --git a/.pipelines/dev-tunnels-ssh-ci.yaml b/.pipelines/dev-tunnels-ssh-ci.yaml
index d629cc1..e3d037f 100644
--- a/.pipelines/dev-tunnels-ssh-ci.yaml
+++ b/.pipelines/dev-tunnels-ssh-ci.yaml
@@ -213,7 +213,7 @@ jobs:
       - task: EsrpRelease@11
         condition: and(succeeded(), eq('${{ parameters.PublishNpmPackage }}', 'true'))
         inputs:
-          connectedservicename: 'Devtunnels-esrp-ame-msi'
+          connectedservicename: 'Devtunnels-esrp-ame-msi-wif2'
           usemanagedidentity: true
           keyvaultname: 'tunnels-ppe-esrp-kv'
           signcertname: 'esrp-sign'
diff --git a/test/cs/Ssh.Test/ChannelTests.cs b/test/cs/Ssh.Test/ChannelTests.cs
index 1c5fc0a..22d1513 100644
--- a/test/cs/Ssh.Test/ChannelTests.cs
+++ b/test/cs/Ssh.Test/ChannelTests.cs
@@ -228,9 +228,10 @@ private static Action InstallOpenCancelRaceHook(
 			cancellationSource.Token.Register(
 				() => callbackStarted.TrySetResult(true));
 
-			// Cancel on a background thread. Cancel() invokes all registered
-			// callbacks sequentially on its thread before returning.
-			Task.Run(() => cancellationSource.Cancel());
+			// Cancel on a dedicated thread (not the thread pool, which can be
+			// starved under CI load). Cancel() invokes all registered callbacks
+			// sequentially on this thread before returning.
+			new Thread(() => cancellationSource.Cancel()) { IsBackground = true }.Start();
 
 			// Wait for a monitoring callback to fire. Since Cancel() executes
 			// callbacks sequentially, the internal callback starts immediately