diff --git a/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml b/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
index c7ece396e0..7827494c5c 100644
--- a/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
+++ b/eng/common/pipelines/templates/steps/set-vcpkg-cache-vars.yml
@@ -6,9 +6,10 @@ parameters:
 
 steps:
   - pwsh: |
-      Write-Host "Setting vcpkg cache variables for read only access to vcpkg binary and asset caches"
+      Write-Host "Setting vcpkg cache variables for read only access to the vcpkg binary cache"
       Write-Host '##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azcopy,https://azuresdkartifacts.blob.core.windows.net/public-vcpkg-container,read'
-      Write-Host '##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES_SECRET;issecret=true;]clear;x-azurl,https://azuresdkartifacts.blob.core.windows.net/public-vcpkg-container,,read'
+      Write-Host "Setting Terrapin asset source for read only access to the vcpkg source mirror"
+      Write-Host '##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES]clear;x-azurl,https://vcpkg.storage.devpackages.microsoft.io/artifacts/;x-block-origin'
     displayName: Set vcpkg variables
 
   - ${{if eq(variables['System.TeamProject'], 'internal') }}:
diff --git a/eng/common/scripts/Set-VcpkgWriteModeCache.ps1 b/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
index 37bca90019..27bdef477d 100755
--- a/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
+++ b/eng/common/scripts/Set-VcpkgWriteModeCache.ps1
@@ -20,4 +20,3 @@ Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SAS_TOKEN;issecret=true
 
 Write-Host "Setting vcpkg binary cache to read and write"
 Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azcopy-sas,https://$StorageAccountName.blob.core.windows.net/$StorageContainerName,$vcpkgBinarySourceSas,readwrite"
-Write-Host "##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES_SECRET;issecret=true;]clear;x-azurl,https://$StorageAccountName.blob.core.windows.net/$StorageContainerName,$vcpkgBinarySourceSas,readwrite"
diff --git a/eng/pipelines/templates/steps/cmake-build.yml b/eng/pipelines/templates/steps/cmake-build.yml
index 38f1dac72c..b2a7d6d0a5 100644
--- a/eng/pipelines/templates/steps/cmake-build.yml
+++ b/eng/pipelines/templates/steps/cmake-build.yml
@@ -30,10 +30,33 @@ steps:
       Write-Host "##vso[task.setvariable variable=CargoConfigPath]$configPath"
     displayName: Configure cargo to use the azure-sdk-for-rust feed
 
+  # Workaround issue in public pipelines. Revert when root cause issue is fixed:
+  # https://github.com/microsoft/azure-pipelines-tasks/issues/22421
+  # CargoAuthenticate@0 authenticates with SYSTEM_ACCESSTOKEN, which Azure DevOps does
+  # not deliver to fork builds. The task still "succeeds", but writes the anonymous
+  # identity, and cargo then fails the index fetch with 401 / TF400813 for user
+  # aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa. NuGetAuthenticate@1 authenticates with the
+  # build's service connection, whose token Azure DevOps does deliver to fork builds, and
+  # publishes it as VSS_NUGET_ACCESSTOKEN for later steps. It runs as
+  # `public Build Service (azure-sdk)`, which holds Feed and Upstream Reader on the cargo
+  # feed.
+  #
+  # This is declared here rather than relying on nuget-config.yml because
+  # archetype-sdk-client.yml includes this template without it.
+  - task: NuGetAuthenticate@1
+    displayName: Acquire an Azure Artifacts token that fork builds can use
+
   - task: CargoAuthenticate@0
     displayName: Authenticate cargo to the azure-sdk-for-rust feed
     inputs:
       configFile: $(CargoConfigPath)
+    # Workaround issue in public pipelines. Revert when root cause is fixed:
+    # https://github.com/microsoft/azure-pipelines-tasks/issues/22421
+    #
+    # NuGetAuthenticate@1 above publishes the endpoint token as VSS_NUGET_ACCESSTOKEN,
+    # which is populated in fork builds and useful as SYSTEM_ACCESSTOKEN here.
+    env:
+      SYSTEM_ACCESSTOKEN: $(VSS_NUGET_ACCESSTOKEN)
 
   - script: cmake --version
     workingDirectory: build
@@ -49,7 +72,6 @@ steps:
     displayName: cmake generate
     env:
       VCPKG_BINARY_SOURCES: $(VCPKG_BINARY_SOURCES_SECRET)
-      X_VCPKG_ASSET_SOURCES: $(X_VCPKG_ASSET_SOURCES_SECRET)
 
 # Core should build all cmake targets
   - ${{ if and(eq(parameters.Build, true), eq(parameters.ServiceDirectory, 'core')) }}:
diff --git a/eng/templates/config.toml.template b/eng/templates/config.toml.template
index 3d77616cd4..3299314b3d 100644
--- a/eng/templates/config.toml.template
+++ b/eng/templates/config.toml.template
@@ -6,15 +6,21 @@
 # CMake/Corrosion invokes cargo for the azure-core-amqp rust_wrapper crate.
 #
 # CargoAuthenticate@0 parses the [registries] table below and exports the
-# CARGO_REGISTRIES_AZURE_SDK_FOR_RUST_TOKEN / _CREDENTIAL_PROVIDER variables that cargo
-# needs to authenticate against the feed.
+# CARGO_REGISTRIES_AZURE_SDK_FOR_RUST_PUBLIC_TOKEN / _CREDENTIAL_PROVIDER variables that
+# cargo needs to authenticate against the feed.
+#
+# The feed is the project-scoped `public` one shared with azure-sdk-for-rust, and the
+# `~force-auth` suffix on the feed name is required. Without it Azure DevOps answers the
+# index anonymously, and cargo fails with "token rejected ... got 401" for the anonymous
+# identity aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa. See
+# https://learn.microsoft.com/azure/devops/artifacts/cargo/cargo-upstream-source.
 #
 # The [source] replacement is what actually redirects index.crates.io and
 # static.crates.io to the feed. Cargo does not honor environment variables for the
 # [source] table, so an on-disk config file is required.
 
 [registries]
-azure-sdk-for-rust = { index = "sparse+https://pkgs.dev.azure.com/azure-sdk/_packaging/azure-sdk-for-rust/Cargo/index/" }
+azure-sdk-for-rust-public = { index = "sparse+https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-rust-public~force-auth/Cargo/index/" }
 
 [source.crates-io]
-replace-with = "azure-sdk-for-rust"
+replace-with = "azure-sdk-for-rust-public"