diff --git a/.azure/pipelines/ci.yml b/.azure/pipelines/ci.yml
index dadfd77e106f..a7d6a1b15e43 100644
--- a/.azure/pipelines/ci.yml
+++ b/.azure/pipelines/ci.yml
@@ -96,7 +96,6 @@ variables:
     value: /bl:artifacts/log/Release/Build.Installers.binlog
   - name: WindowsArm64InstallersLogArgs
     value: /bl:artifacts/log/Release/Build.Installers.Arm64.binlog
-- group: DotNetBuilds storage account read tokens
 - name: _InternalRuntimeDownloadArgs
   value: -RuntimeSourceFeed https://dotnetbuilds.blob.core.windows.net/internal
          -RuntimeSourceFeedKey $(dotnetbuilds-internal-container-read-token-base64)
diff --git a/.azure/pipelines/jobs/default-build.yml b/.azure/pipelines/jobs/default-build.yml
index 20b19c4c20b4..f328550c60c2 100644
--- a/.azure/pipelines/jobs/default-build.yml
+++ b/.azure/pipelines/jobs/default-build.yml
@@ -420,7 +420,18 @@ jobs:
       - ${{ parameters.beforeBuild }}
 
       # - template: /eng/common/templates-official/steps/enable-internal-sources.yml@self
-      # - template: /eng/common/templates-official/steps/enable-internal-runtimes.yml@self
+      - template: /eng/common/templates-official/steps/enable-internal-runtimes.yml@self
+
+      # Populate dotnetbuilds-internal-container-read-token
+      - template: /eng/common/templates-official/steps/get-delegation-sas.yml
+        parameters:
+          federatedServiceConnection: 'dotnetbuilds-internal-read'
+          outputVariableName: 'dotnetbuilds-internal-container-read-token'
+          expiryInHours: 1
+          base64Encode: false
+          storageAccount: dotnetbuilds
+          container: internal
+          permissions: rl
 
       # Add COMPlus_* environment variables to build steps.
       - ${{ if ne(parameters.steps, '')}}: