diff --git a/common/config/azure-pipelines/npm-publish.yaml b/common/config/azure-pipelines/npm-publish.yaml
index f66e4459..62c30996 100644
--- a/common/config/azure-pipelines/npm-publish.yaml
+++ b/common/config/azure-pipelines/npm-publish.yaml
@@ -86,6 +86,8 @@ extends:
 
               - template: /common/config/azure-pipelines/templates/bump-versions.yaml@self
 
+              - template: /common/config/azure-pipelines/templates/pack.yaml@self
+
               - template: /common/config/azure-pipelines/templates/post-publish.yaml@self
 
               - template: /common/config/azure-pipelines/templates/push-and-create-github-pr.yaml@self
diff --git a/common/config/azure-pipelines/templates/bump-versions.yaml b/common/config/azure-pipelines/templates/bump-versions.yaml
index f8dd6efc..badade12 100644
--- a/common/config/azure-pipelines/templates/bump-versions.yaml
+++ b/common/config/azure-pipelines/templates/bump-versions.yaml
@@ -1,31 +1,25 @@
-# Applies the pending "rush change" files to bump package versions and update CHANGELOGs, packs the
-# resulting tarballs, and commits the version bump on the automated feature branch. Unlike the
-# previous flow, this does NOT push to "main" (pushing directly to "main" is blocked) -- the commit
-# is opened as a PR instead.
+# Applies the pending "rush change" files to bump package versions and update CHANGELOGs, then
+# commits the version bump on the automated feature branch. Packing the tarballs is a separate step
+# (see pack.yaml); this template only bumps and commits.
 #
-# Apply and pack are performed in a single "rush publish" invocation, while the change files are
-# still present: "--apply" bumps package.json versions and regenerates CHANGELOG files, "--pack"
-# writes an npm tarball per publishable project into the release folder, and "--include-all" ensures
-# every "shouldPublish" project is packed. Rush requires "--include-all" whenever "--pack" is used,
-# so every publishable project is packed regardless of whether its version changed in this bump.
-# That is fine because ESRP ignores tarballs whose version is already published, so the unchanged
-# packages are simply skipped at publish time.
+# "rush version --bump" applies the change files: it bumps package.json versions, regenerates the
+# CHANGELOG files, updates inter-project dependency ranges, and deletes the consumed change files.
+# We deliberately omit "--target-branch": every git operation in Rush's PublishGit is gated on a
+# target branch being set, so without it Rush performs NO git operations -- the bumps land in the
+# working tree and we commit them ourselves onto the feature branch (which is later opened as a PR
+# instead of pushed directly to "main").
 #
-# Because "--target-branch" is omitted, "rush publish" leaves the bumps uncommitted in the working
-# tree, which lets us commit exactly those changes ourselves.
+# Note: "rush publish --apply --include-all" does NOT bump versions -- "--include-all" routes to
+# Rush's "publish all" path, which packs every project at its current version and never applies the
+# change files. That is why version bumping must be done here with "rush version --bump".
 parameters:
   - name: RepoPath
     type: string
     default: '$(Agent.BuildDirectory)/tsdoc'
 
 steps:
-  - script: >
-      node common/scripts/install-run-rush.js publish
-      --apply
-      --pack
-      --include-all
-      --release-folder $(Build.ArtifactStagingDirectory)/packages
-    displayName: 'Rush Publish (apply version bumps and pack)'
+  - script: 'node common/scripts/install-run-rush.js version --bump'
+    displayName: 'Rush Version (apply version bumps)'
     workingDirectory: ${{ parameters.RepoPath }}
 
   - bash: |
diff --git a/common/config/azure-pipelines/templates/pack.yaml b/common/config/azure-pipelines/templates/pack.yaml
new file mode 100644
index 00000000..6425368f
--- /dev/null
+++ b/common/config/azure-pipelines/templates/pack.yaml
@@ -0,0 +1,29 @@
+# Packs every publishable ("shouldPublish") project into an npm tarball at its freshly bumped
+# version, into the release folder that the bump pipeline uploads as the "packages" artifact. Runs
+# only when the bump step actually produced version changes.
+#
+# Rush requires "--include-all" whenever "--pack" is used, so every publishable project is packed
+# regardless of whether its version changed in this bump. "--include-all" packs projects directly
+# from their (already bumped) package.json versions and does not depend on the change files, so it
+# is safe to run after "rush version --bump" has consumed them. Packing unchanged projects is
+# harmless because ESRP ignores tarballs whose version is already published.
+#
+# "--publish" is required alongside "--pack": Rush's pack step only actually runs "npm pack" and
+# copies the tarball into the release folder when "--publish" is set; without it the pack is a
+# dry-run and produces no tarballs. With "--pack" set this does NOT publish to the registry (Rush
+# takes the pack branch, never the npm-publish branch) -- ESRP performs the real publish later.
+parameters:
+  - name: RepoPath
+    type: string
+    default: '$(Agent.BuildDirectory)/tsdoc'
+
+steps:
+  - script: >
+      node common/scripts/install-run-rush.js publish
+      --pack
+      --publish
+      --include-all
+      --release-folder $(Build.ArtifactStagingDirectory)/packages
+    displayName: 'Rush Pack'
+    workingDirectory: ${{ parameters.RepoPath }}
+    condition: and(succeeded(), eq(variables.HasChanges, 'true'))