diff --git a/Changelog.md b/Changelog.md
index 9927e158..6c3a721a 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.97] - 2026-08-11
+### Pipeline
+- Fixed the VS Code extension release pipeline failing at the publish step with `npm error code E401`. The step ran `npx @vscode/vsce`, and because the argument is a package name rather than a bin name, npx cannot short circuit to the copy installed by the preceding `npm install -g @vscode/vsce` step and always fetches the package manifest from the npm registry, which is not authenticated inside the `AzureCLI@2` task. The step now invokes the globally installed `vsce.cmd` by its full path, so publishing needs no registry access, and fails with an explicit message if the binary is missing.
+- Removed the `npm_config_registry` environment variable from the publish step. It was only there to make the `npx` fetch resolve, is redundant with the `.npmrc` copied into the staging directory, and does not affect where the extension is published - `vsce publish` uploads to the Visual Studio Marketplace, not to an npm registry.
+- Hardened the VS Code publish step against an unexpected artifact count. It previously passed a `Resolve-Path` result straight to `--packagePath`, which yields `$null` when signing produced no `.vsix` and an array that splats into multiple arguments when it produced more than one. The step now resolves the artifact explicitly and fails with a clear message unless exactly one is present.
+
 ## [1.0.96] - 2026-08-03
 ### Dependencies
 - Consolidated the open Dependabot pull requests (#765, #766, #767, #768, #769) into a single update for the VS Code extension: `linkify-it` 5.0.1 to 5.0.2, `fast-uri` 3.1.2 to 3.1.4, `undici` 7.24.6 to 7.29.0, and `brace-expansion` 1.1.14 to 1.1.16 and 5.0.5 to 5.0.8.
diff --git a/Pipelines/vscode/devskim-vscode-release.yml b/Pipelines/vscode/devskim-vscode-release.yml
index eda4fc50..69720cb8 100644
--- a/Pipelines/vscode/devskim-vscode-release.yml
+++ b/Pipelines/vscode/devskim-vscode-release.yml
@@ -183,19 +183,39 @@ extends:
             scriptLocation: 'inlineScript'
             workingDirectory: '$(Build.StagingDirectory)'
             inlineScript: |
-                $packPath = Resolve-Path $env:BUILD_STAGINGDIRECTORY\*.vsix
+                # Fail fast if signing/staging did not produce exactly one artifact, rather than
+                # passing a null or multi-element Resolve-Path result to --packagePath.
+                $vsixFiles = @(Get-ChildItem -Path $env:BUILD_STAGINGDIRECTORY -Filter '*.vsix' -File)
+                if ($vsixFiles.Count -ne 1)
+                {
+                    throw "Expected exactly one .vsix in $env:BUILD_STAGINGDIRECTORY, found $($vsixFiles.Count)"
+                }
+                $packPath = $vsixFiles[0].FullName
+                # Invoke the vsce installed globally in the previous step by its full path.
+                # `npx @vscode/vsce` cannot be used here: npx only short circuits to an already
+                # installed binary when the argument matches a bin name, so a package name always
+                # forces a manifest fetch from the npm registry, which fails with E401 in this task.
+                # On Windows npm's global bin directory is the global prefix itself, so `npm prefix -g`
+                # locates the shim (`npm bin` was removed in npm v9 and is not an option).
+                $vsce = Join-Path (npm prefix -g) 'vsce.cmd'
+                if (-not (Test-Path $vsce))
+                {
+                    throw "vsce was not found at $vsce - check the 'Install vsce and dependencies' step"
+                }
                 if ("$(ReleaseVersion)".Contains("-"))
                 {
                     echo "Publishing as --pre-release = $(ReleaseVersion)"
-                    npx @vscode/vsce publish --packagePath $packPath --pre-release --azure-credential
+                    & $vsce publish --packagePath $packPath --pre-release --azure-credential
                 }
                 else
                 {
                     echo "Publishing as official release = $(ReleaseVersion)"
-                    npx @vscode/vsce publish --packagePath $packPath --azure-credential
+                    & $vsce publish --packagePath $packPath --azure-credential
+                }
+                if ($LASTEXITCODE -ne 0)
+                {
+                    throw "vsce publish failed with exit code $LASTEXITCODE"
                 }
-          env:
-            npm_config_registry: "https://pkgs.dev.azure.com/microsoft-sdl/General/_packaging/PublicRegistriesFeed/npm/registry/"
 
       - job: gitHubReleaseJob
         # Based on Documentation: https://eng.ms/docs/cloud-ai-platform/devdiv/one-engineering-system-1es/1es-docs/1es-pipeline-templates/features/releasepipelines/releaseworkflows/releasejob?tabs=standardreleasejob