diff --git a/.azure-pipelines/ci-build.yml b/.azure-pipelines/ci-build.yml
index 95d09b92252..4a655053eac 100644
--- a/.azure-pipelines/ci-build.yml
+++ b/.azure-pipelines/ci-build.yml
@@ -14,6 +14,10 @@ parameters:
 - name: Sign
   type: boolean
   default: true
+- name: ForceAcrPublish
+  displayName: Force ACR publication (manual runs only)
+  type: boolean
+  default: false
 - name: InternalFeed
   type: string
   default: '0985d294-5762-4bc2-a565-161ef349ca3e/PowerShell_V2_Build'
@@ -144,7 +148,7 @@ extends:
       - stage: Deploy_to_ACR
         displayName: Deploy PowerShell packages to ACR
         dependsOn: stage
-        condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'), ne(variables['Build.Reason'], 'PullRequest'), eq(dependencies.stage.outputs['MsGraphPsSdkCiBuild.DetectAcrChanges.ShouldPublishToAcr'], 'true'))
+        condition: and(succeeded(), or(and(eq(variables['Build.SourceBranch'], 'refs/heads/main'), ne(variables['Build.Reason'], 'PullRequest'), eq(dependencies.stage.outputs['MsGraphPsSdkCiBuild.DetectAcrChanges.ShouldPublishToAcr'], 'true')), and(eq(variables['Build.Reason'], 'Manual'), ${{ eq(parameters.ForceAcrPublish, true) }})))
         jobs:
         - job: DeployPowerShellPackagesToAcr
           displayName: Deploy PowerShell packages to ACR
diff --git a/.azure-pipelines/common-templates/publish-psresources-acr.yml b/.azure-pipelines/common-templates/publish-psresources-acr.yml
index 4e1e25eebe7..831d2d6b698 100644
--- a/.azure-pipelines/common-templates/publish-psresources-acr.yml
+++ b/.azure-pipelines/common-templates/publish-psresources-acr.yml
@@ -10,6 +10,40 @@ parameters:
     type: string
 
 steps:
+  - task: PowerShell@2
+    displayName: 'Diagnose ACR network access'
+    continueOnError: true
+    inputs:
+      targetType: Inline
+      pwsh: true
+      script: |
+        $ErrorActionPreference = 'Stop'
+        $registryHost = '${{ parameters.Registry }}'
+        $registryUri = "https://$registryHost/v2/"
+
+        Write-Host "Resolving $registryHost."
+        $dnsRecords = Resolve-DnsName -Name $registryHost
+        $dnsOutput = $dnsRecords |
+          Select-Object Name, Type, IPAddress, NameHost |
+          Format-Table -AutoSize |
+          Out-String
+        Write-Host $dnsOutput
+
+        Write-Host "Testing TCP connectivity to ${registryHost}:443."
+        $connection = Test-NetConnection -ComputerName $registryHost -Port 443 -InformationLevel Detailed
+        $connectionOutput = $connection |
+          Select-Object ComputerName, RemoteAddress, RemotePort, InterfaceAlias, SourceAddress, TcpTestSucceeded |
+          Format-List |
+          Out-String
+        Write-Host $connectionOutput
+        if (-not $connection.TcpTestSucceeded) {
+          throw "The build agent can't establish a TCP connection to ${registryHost}:443."
+        }
+
+        Write-Host "Requesting $registryUri. An HTTP 401 response confirms that the ACR endpoint is reachable."
+        $response = Invoke-WebRequest -Uri $registryUri -Method Get -SkipHttpErrorCheck -TimeoutSec 30
+        Write-Host "ACR endpoint returned HTTP $([int]$response.StatusCode) $($response.StatusDescription)."
+
   - task: AzurePowerShell@5
     displayName: 'Publish PowerShell packages to ACR'
     inputs: