diff --git a/.azure-pipelines/ci.yml b/.azure-pipelines/ci.yml
index 927d09106b..f5efd26d59 100644
--- a/.azure-pipelines/ci.yml
+++ b/.azure-pipelines/ci.yml
@@ -17,7 +17,8 @@
 #     AZURE_AGENT_LINUX_ARM_SKU
 #   Variables (secret):
 #     AZURE_APP_INSIGHTS_KEY
-#   Service connection (Azure RM, WIF): Azure Container Networking - Build Validations - Federated
+#   Service connection for publishing runs (Azure RM, WIF):
+#     Azure Container Networking - Build Validations - Federated
 #   Settings: "Limit building pull requests from forked GitHub repositories" = Disable
 
 trigger:
@@ -31,12 +32,8 @@ pr:
       - main
 
 parameters:
-  # TEMPORARY (revert this parameter and the isMergeGroup if/else below after
-  # dark-launch validation): when true, forces full merge-group behavior on any
-  # trigger (push to ACR, embed APP_INSIGHTS_ID, run manifests + e2e + perf).
-  # Use it to validate the full pipeline from a manual queue against any branch.
-  - name: forceMergeGroup
-    displayName: Force merge-group behavior (push + telemetry + tests)
+  - name: runE2EValidation
+    displayName: Publish branch images and run E2E
     type: boolean
     default: false
 
@@ -46,10 +43,10 @@ variables:
   - name: imageNamespace
     value: microsoft/retina
   # True only when the build was triggered by a push to a merge-queue temp branch,
-  # OR when the forceMergeGroup parameter is checked at queue time.
+  # OR when the runE2EValidation parameter is checked at queue time.
   # PR builds and manual queues with the checkbox off evaluate to False -> dry-run.
   - name: isMergeGroup
-    ${{ if eq(parameters.forceMergeGroup, true) }}:
+    ${{ if eq(parameters.runE2EValidation, true) }}:
       value: 'True'
     ${{ else }}:
       value: $[ startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/') ]
@@ -72,19 +69,18 @@ jobs:
       - bash: make qemu-user-static
         displayName: Set up QEMU
       - template: steps/setup-go.yml
-      - task: AzureCLI@2
-        displayName: Build and push retina image
-        env:
-          IS_MERGE_GROUP: $(isMergeGroup)
-          APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
-        inputs:
-          azureSubscription: $(azureServiceConnection)
-          scriptType: bash
-          scriptLocation: inlineScript
-          inlineScript: |
-            set -euo pipefail
-            TAG=$(make version)
-            if [ "$IS_MERGE_GROUP" == "True" ]; then
+      - ${{ if or(eq(parameters.runE2EValidation, true), startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/')) }}:
+        - task: AzureCLI@2
+          displayName: Build and push retina image
+          env:
+            APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
+          inputs:
+            azureSubscription: $(azureServiceConnection)
+            scriptType: bash
+            scriptLocation: inlineScript
+            inlineScript: |
+              set -euo pipefail
+              TAG=$(make version)
               az acr login -n $(ACR_NAME)
               make retina-image \
                 IMAGE_NAMESPACE=$(imageNamespace) \
@@ -93,12 +89,15 @@ jobs:
                 APP_INSIGHTS_ID=$APP_INSIGHTS_ID \
                 TAG=$TAG \
                 BUILDX_ACTION=--push
-            else
-              make retina-image \
-                IMAGE_NAMESPACE=$(imageNamespace) \
-                PLATFORM=linux/$(arch) \
-                TAG=$TAG
-            fi
+      - ${{ else }}:
+        - bash: |
+            set -euo pipefail
+            TAG=$(make version)
+            make retina-image \
+              IMAGE_NAMESPACE=$(imageNamespace) \
+              PLATFORM=linux/$(arch) \
+              TAG=$TAG
+          displayName: Build retina image
 
   - job: build_windows_binaries
     displayName: Build Windows Binaries
@@ -158,19 +157,18 @@ jobs:
           }
           throw "Docker daemon failed to start within $timeout seconds"
         displayName: Ensure Docker daemon is running
-      - task: AzureCLI@2
-        displayName: Build and push retina Windows image
-        env:
-          IS_MERGE_GROUP: $(isMergeGroup)
-          APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
-        inputs:
-          azureSubscription: $(azureServiceConnection)
-          scriptType: bash
-          scriptLocation: inlineScript
-          inlineScript: |
-            set -euo pipefail
-            TAG=$(make version)
-            if [ "$IS_MERGE_GROUP" == "True" ]; then
+      - ${{ if or(eq(parameters.runE2EValidation, true), startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/')) }}:
+        - task: AzureCLI@2
+          displayName: Build and push retina Windows image
+          env:
+            APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
+          inputs:
+            azureSubscription: $(azureServiceConnection)
+            scriptType: bash
+            scriptLocation: inlineScript
+            inlineScript: |
+              set -euo pipefail
+              TAG=$(make version)
               az acr login -n $(ACR_NAME)
               make retina-image-win \
                 IMAGE_NAMESPACE=$(imageNamespace) \
@@ -182,15 +180,18 @@ jobs:
                 REPO_PATH=. \
                 TAG=$TAG
               docker push $(ACR_NAME)/$(imageNamespace)/retina-agent:${TAG}-windows-ltsc$(year)-$(arch)
-            else
-              make retina-image-win \
-                IMAGE_NAMESPACE=$(imageNamespace) \
-                PLATFORM=$(platform)/$(arch) \
-                WINDOWS_YEARS=$(year) \
-                BINARIES_PATH=output/windows_$(arch) \
-                REPO_PATH=. \
-                TAG=$TAG
-            fi
+      - ${{ else }}:
+        - bash: |
+            set -euo pipefail
+            TAG=$(make version)
+            make retina-image-win \
+              IMAGE_NAMESPACE=$(imageNamespace) \
+              PLATFORM=$(platform)/$(arch) \
+              WINDOWS_YEARS=$(year) \
+              BINARIES_PATH=output/windows_$(arch) \
+              REPO_PATH=. \
+              TAG=$TAG
+          displayName: Build retina Windows image
 
   - job: operator_images
     displayName: Build Operator Images
@@ -209,19 +210,18 @@ jobs:
       - bash: make qemu-user-static
         displayName: Set up QEMU
       - template: steps/setup-go.yml
-      - task: AzureCLI@2
-        displayName: Build and push operator image
-        env:
-          IS_MERGE_GROUP: $(isMergeGroup)
-          APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
-        inputs:
-          azureSubscription: $(azureServiceConnection)
-          scriptType: bash
-          scriptLocation: inlineScript
-          inlineScript: |
-            set -euo pipefail
-            TAG=$(make version)
-            if [ "$IS_MERGE_GROUP" == "True" ]; then
+      - ${{ if or(eq(parameters.runE2EValidation, true), startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/')) }}:
+        - task: AzureCLI@2
+          displayName: Build and push operator image
+          env:
+            APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
+          inputs:
+            azureSubscription: $(azureServiceConnection)
+            scriptType: bash
+            scriptLocation: inlineScript
+            inlineScript: |
+              set -euo pipefail
+              TAG=$(make version)
               az acr login -n $(ACR_NAME)
               make retina-operator-image \
                 IMAGE_NAMESPACE=$(imageNamespace) \
@@ -230,12 +230,15 @@ jobs:
                 APP_INSIGHTS_ID=$APP_INSIGHTS_ID \
                 TAG=$TAG \
                 BUILDX_ACTION=--push
-            else
-              make retina-operator-image \
-                IMAGE_NAMESPACE=$(imageNamespace) \
-                PLATFORM=linux/$(arch) \
-                TAG=$TAG
-            fi
+      - ${{ else }}:
+        - bash: |
+            set -euo pipefail
+            TAG=$(make version)
+            make retina-operator-image \
+              IMAGE_NAMESPACE=$(imageNamespace) \
+              PLATFORM=linux/$(arch) \
+              TAG=$TAG
+          displayName: Build operator image
 
   - job: retina_shell_images
     displayName: Build Retina Shell Images
@@ -254,18 +257,16 @@ jobs:
       - bash: make qemu-user-static
         displayName: Set up QEMU
       - template: steps/setup-go.yml
-      - task: AzureCLI@2
-        displayName: Build and push retina-shell image
-        env:
-          IS_MERGE_GROUP: $(isMergeGroup)
-        inputs:
-          azureSubscription: $(azureServiceConnection)
-          scriptType: bash
-          scriptLocation: inlineScript
-          inlineScript: |
-            set -euo pipefail
-            TAG=$(make version)
-            if [ "$IS_MERGE_GROUP" == "True" ]; then
+      - ${{ if or(eq(parameters.runE2EValidation, true), startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/')) }}:
+        - task: AzureCLI@2
+          displayName: Build and push retina-shell image
+          inputs:
+            azureSubscription: $(azureServiceConnection)
+            scriptType: bash
+            scriptLocation: inlineScript
+            inlineScript: |
+              set -euo pipefail
+              TAG=$(make version)
               az acr login -n $(ACR_NAME)
               make retina-shell-image \
                 IMAGE_NAMESPACE=$(imageNamespace) \
@@ -273,12 +274,15 @@ jobs:
                 IMAGE_REGISTRY=$(ACR_NAME) \
                 TAG=$TAG \
                 BUILDX_ACTION=--push
-            else
-              make retina-shell-image \
-                IMAGE_NAMESPACE=$(imageNamespace) \
-                PLATFORM=linux/$(arch) \
-                TAG=$TAG
-            fi
+      - ${{ else }}:
+        - bash: |
+            set -euo pipefail
+            TAG=$(make version)
+            make retina-shell-image \
+              IMAGE_NAMESPACE=$(imageNamespace) \
+              PLATFORM=linux/$(arch) \
+              TAG=$TAG
+          displayName: Build retina-shell image
 
   - job: kubectl_retina_images
     displayName: Build Kubectl Retina Images
@@ -297,18 +301,16 @@ jobs:
       - bash: make qemu-user-static
         displayName: Set up QEMU
       - template: steps/setup-go.yml
-      - task: AzureCLI@2
-        displayName: Build and push kubectl-retina image
-        env:
-          IS_MERGE_GROUP: $(isMergeGroup)
-        inputs:
-          azureSubscription: $(azureServiceConnection)
-          scriptType: bash
-          scriptLocation: inlineScript
-          inlineScript: |
-            set -euo pipefail
-            TAG=$(make version)
-            if [ "$IS_MERGE_GROUP" == "True" ]; then
+      - ${{ if or(eq(parameters.runE2EValidation, true), startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/')) }}:
+        - task: AzureCLI@2
+          displayName: Build and push kubectl-retina image
+          inputs:
+            azureSubscription: $(azureServiceConnection)
+            scriptType: bash
+            scriptLocation: inlineScript
+            inlineScript: |
+              set -euo pipefail
+              TAG=$(make version)
               az acr login -n $(ACR_NAME)
               make kubectl-retina-image \
                 IMAGE_NAMESPACE=$(imageNamespace) \
@@ -316,12 +318,15 @@ jobs:
                 IMAGE_REGISTRY=$(ACR_NAME) \
                 TAG=$TAG \
                 BUILDX_ACTION=--push
-            else
-              make kubectl-retina-image \
-                IMAGE_NAMESPACE=$(imageNamespace) \
-                PLATFORM=linux/$(arch) \
-                TAG=$TAG
-            fi
+      - ${{ else }}:
+        - bash: |
+            set -euo pipefail
+            TAG=$(make version)
+            make kubectl-retina-image \
+              IMAGE_NAMESPACE=$(imageNamespace) \
+              PLATFORM=linux/$(arch) \
+              TAG=$TAG
+          displayName: Build kubectl-retina image
 
   - job: manifests
     displayName: Generate Manifests