diff --git a/.azure-pipelines/hidi-release.yml b/.azure-pipelines/hidi-release.yml
index a11c53fb4..aec3b08bb 100644
--- a/.azure-pipelines/hidi-release.yml
+++ b/.azure-pipelines/hidi-release.yml
@@ -292,7 +292,7 @@ extends:
                     - task: GitHubRelease@1
                       displayName: Attach signed hidi release artifacts
                       inputs:
-                        gitHubConnection: Github-MaggieKimani1
+                        gitHubConnection: 'microsoftgraph (22)'
                         action: edit
                         tagSource: userSpecifiedTag
                         tag: 'hidi-v$(HidiReleaseVersion)'
@@ -303,6 +303,10 @@ extends:
                           $(Pipeline.Workspace)\hidi\hidi-win-x64-$(HidiReleaseVersion).zip
                         addChangeLog: false
           - deployment: publish_container
+            pool:
+              name: Azure-Pipelines-1ESPT-ExDShared
+              image: ubuntu-latest
+              os: linux
             templateContext:
               type: releaseJob
               isProduction: true
@@ -314,8 +318,6 @@ extends:
             strategy:
               runOnce:
                 deploy:
-                  pool:
-                    vmImage: ubuntu-latest
                   steps:
                     - pwsh: |
                         $ErrorActionPreference = 'Stop'
diff --git a/src/Microsoft.OpenApi.Hidi/readme.md b/src/Microsoft.OpenApi.Hidi/readme.md
index e2795783d..28cb27c9d 100644
--- a/src/Microsoft.OpenApi.Hidi/readme.md
+++ b/src/Microsoft.OpenApi.Hidi/readme.md
@@ -114,6 +114,10 @@ private keys are excluded. The container release job consumes this artifact as
 a 1ES input without checking out the repository. NuGet and Windows release
 artifacts continue to use the separate `Hidi` artifact.
 
+The container deployment selects the approved `Azure-Pipelines-1ESPT-ExDShared`
+pool with `image: ubuntu-latest` and `os: linux` at deployment-job scope.
+The build and NuGet/Windows artifact release jobs retain the Windows default pool.
+
 The container release job retains the existing `docker-images-deploy`
 environment and its approvals/checks. The destination pipeline must be authorized
 for that protected environment before official publishing can execute. Signed