diff --git a/eng/update-dependencies/BaseCommand.cs b/eng/update-dependencies/BaseCommand.cs
index d5d459528d..402b3e7fc3 100644
--- a/eng/update-dependencies/BaseCommand.cs
+++ b/eng/update-dependencies/BaseCommand.cs
@@ -3,13 +3,12 @@
 
 using System.CommandLine;
 using System.CommandLine.NamingConventionBinder;
-using System.Threading.Tasks;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 
 namespace Dotnet.Docker;
 
-public abstract class BaseCommand<TOptions>() where TOptions : IOptions
+public abstract class BaseCommand<TOptions>() : ICommand<TOptions> where TOptions : IOptions
 {
     public abstract Task<int> ExecuteAsync(TOptions options);
 
@@ -34,7 +33,7 @@ public static Command Create(string name, string description)
     private static BindingHandler Handler =>
         CommandHandler.Create<TOptions, IHost>(async (options, host) =>
             {
-                var thisCommand = host.Services.GetRequiredService<BaseCommand<TOptions>>();
+                var thisCommand = host.Services.GetRequiredService<ICommand<TOptions>>();
                 return await thisCommand.ExecuteAsync(options);
             });
 }
diff --git a/eng/update-dependencies/BaseUrlUpdater.cs b/eng/update-dependencies/BaseUrlUpdater.cs
index d9e7909061..4b65bfbdef 100644
--- a/eng/update-dependencies/BaseUrlUpdater.cs
+++ b/eng/update-dependencies/BaseUrlUpdater.cs
@@ -17,7 +17,7 @@ internal class BaseUrlUpdater : FileRegexUpdater
 {
     private const string BaseUrlGroupName = "BaseUrlValue";
     private readonly SpecificCommandOptions _options;
-    private readonly JObject _manifestVariables;
+    private readonly ManifestVariables _manifestVariables;
     private readonly string _manifestVariableName;
 
     /// <summary>
@@ -25,40 +25,36 @@ internal class BaseUrlUpdater : FileRegexUpdater
     /// If the base URL variable cannot be found in the manifest, the updater
     /// won't do anything.
     /// </summary>
-    public static IDependencyUpdater Create(string repoRoot, SpecificCommandOptions options)
+    public static IDependencyUpdater Create(ManifestVariables manifestVariables, SpecificCommandOptions options)
     {
-        // Load manifest and extract variables once so the constructor doesn't duplicate this logic
-        var manifest = ManifestHelper.LoadManifest(SpecificCommand.VersionsFilename);
-        var manifestVariables = (JObject?)manifest["variables"];
-
         if (manifestVariables is null)
         {
             Trace.TraceWarning("BaseUrlUpdater: manifest variables missing - skipping base URL update.");
             return new EmptyDependencyUpdater();
         }
 
+        var upstreamBranch = manifestVariables.GetValue("branch");
         string baseUrlVarName = ManifestHelper.GetBaseUrlVariableName(
-            options.DockerfileVersion,
-            options.SourceBranch,
-            options.VersionSourceName,
-            options.IsSdkOnly);
+            dockerfileVersion: options.DockerfileVersion,
+            branch: upstreamBranch,
+            versionSourceName: options.VersionSourceName,
+            sdkOnlyRelease: options.IsSdkOnly);
 
-        if (!manifestVariables.ContainsKey(baseUrlVarName))
+        if (!manifestVariables.HasValue(baseUrlVarName))
         {
             Trace.TraceWarning($"BaseUrlUpdater: variable '{baseUrlVarName}' not found - skipping base URL update.");
             return new EmptyDependencyUpdater();
         }
 
-        return new BaseUrlUpdater(repoRoot, options, manifestVariables, baseUrlVarName);
+        return new BaseUrlUpdater(options, manifestVariables, baseUrlVarName);
     }
 
     private BaseUrlUpdater(
-        string repoRoot,
         SpecificCommandOptions options,
-        JObject manifestVariables,
+        ManifestVariables manifestVariables,
         string manifestVariableName)
     {
-        Path = System.IO.Path.Combine(repoRoot, SpecificCommand.VersionsFilename);
+        Path = options.GetManifestVersionsFilePath();
         VersionGroupName = BaseUrlGroupName;
         _options = options;
         _manifestVariables = manifestVariables;
@@ -72,7 +68,7 @@ protected override string TryGetDesiredValue(IEnumerable<IDependencyInfo> depend
         usedDependencyInfos = Enumerable.Empty<IDependencyInfo>();
 
         string baseUrlVersionVarName = _manifestVariableName;
-        string unresolvedBaseUrl = _manifestVariables[baseUrlVersionVarName]?.ToString() ??
+        string unresolvedBaseUrl = _manifestVariables.Variables[baseUrlVersionVarName]?.ToString() ??
             throw new InvalidOperationException($"Variable with name '{baseUrlVersionVarName}' is missing.");
 
         if (_options.IsInternal)
diff --git a/eng/update-dependencies/CreatePullRequestOptions.cs b/eng/update-dependencies/CreatePullRequestOptions.cs
index 46e88b2d51..36f0bdc737 100644
--- a/eng/update-dependencies/CreatePullRequestOptions.cs
+++ b/eng/update-dependencies/CreatePullRequestOptions.cs
@@ -8,33 +8,43 @@ namespace Dotnet.Docker;
 
 public abstract record CreatePullRequestOptions
 {
-    private string? _targetBranch = null;
+    private string _azdoOrganizationUrl = "";
+
+    /// <summary>
+    /// The root of the dotnet-docker repo to run against.
+    /// </summary>
+    public string RepoRoot { get; init; } = Directory.GetCurrentDirectory();
 
     public string User { get; init; } = "";
     public string Email { get; init; } = "";
     public string Password { get; init; } = "";
-    public string AzdoOrganization { get; init; } = "";
+    public string AzdoOrganization
+    {
+        get => _azdoOrganizationUrl;
+        init => _azdoOrganizationUrl = value.TrimEnd('/');
+    }
     public string AzdoProject { get; init; } = "";
     public string AzdoRepo { get; init; } = "";
     public string VersionSourceName { get; init; } = "";
-    public string SourceBranch { get; init; } = "nightly";
-    public string TargetBranch
-    {
-        get => _targetBranch ?? SourceBranch;
-        init => _targetBranch = value;
-    }
+    public string SourceBranch { get; init; } = "";
+    public string TargetBranch { get; init; } = "nightly";
 
     public static List<Option> Options =>
     [
+        new Option<string>("--repo-root") { Description = "The root of the dotnet-docker repo to run against (defaults to current working directory)" },
         new Option<string>("--user") { Description = "GitHub or AzDO user used to make PR (if not specified, a PR will not be created)" },
         new Option<string>("--email") { Description = "GitHub or AzDO email used to make PR (if not specified, a PR will not be created)" },
         new Option<string>("--password") { Description = "GitHub or AzDO password used to make PR (if not specified, a PR will not be created)" },
-        new Option<string>("--azdo-organization") { Description = "Name of the AzDO organization" },
+        new Option<string>("--azdo-organization")
+        {
+            Description = "URL of the AzDO organization (like https://dev.azure.com/<orgname>), with or without a trailing slash."
+                + " The Azure Pipelines variable 'System.CollectionUri' provides this value.",
+        },
         new Option<string>("--azdo-project") { Description = "Name of the AzDO project" },
         new Option<string>("--azdo-repo") { Description = "Name of the AzDO repo" },
         new Option<string>("--version-source-name") { Description = "The name of the source from which the version information was acquired." },
-        new Option<string>("--source-branch") { Description = "Branch where the Dockerfiles are hosted" },
-        new Option<string>("--target-branch") { Description = "Target branch of the generated PR (defaults to value of source-branch)" },
+        new Option<string>("--source-branch") { Description = "If synchronizing multiple branches, the branch to pull updates from" },
+        new Option<string>("--target-branch") { Description = "Pull request will be submitted targeting this branch" },
     ];
 
     public static List<Argument> Arguments => [];
diff --git a/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs b/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs
new file mode 100644
index 0000000000..83893deff8
--- /dev/null
+++ b/eng/update-dependencies/CreatePullRequestOptionsExtensions.cs
@@ -0,0 +1,24 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Dotnet.Docker;
+
+internal static class CreatePullRequestOptionsExtensions
+{
+    public static string GetManifestVersionsFilePath(this CreatePullRequestOptions options) =>
+        Path.Combine(options.RepoRoot, "manifest.versions.json");
+
+    public static string GetAzdoRepoUrl(this CreatePullRequestOptions options)
+    {
+        // Validate that we have all the required pieces to construct the repo URL.
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoOrganization);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoProject);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.AzdoRepo);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.TargetBranch);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.SourceBranch);
+
+        // AzdoOrganization is a URL like https://dev.azure.com/<org>
+        // A valid Azure DevOps repository URL is formatted like https://dev.azure.com/<org>/<project>/_git/<repo>
+        return $"{options.AzdoOrganization}/{options.AzdoProject}/_git/{options.AzdoRepo}";
+    }
+}
diff --git a/eng/update-dependencies/DependencyInjectionExtensions.cs b/eng/update-dependencies/DependencyInjectionExtensions.cs
index 18b2e76475..ccc3ba6f52 100644
--- a/eng/update-dependencies/DependencyInjectionExtensions.cs
+++ b/eng/update-dependencies/DependencyInjectionExtensions.cs
@@ -17,7 +17,7 @@ public static void AddCommand<TCommand, TOptions>(
             where TCommand : BaseCommand<TOptions>
             where TOptions : IOptions
     {
-        serviceCollection.AddSingleton<BaseCommand<TOptions>, TCommand>();
+        serviceCollection.AddSingleton<ICommand<TOptions>, TCommand>();
     }
 
     /// <summary>
diff --git a/eng/update-dependencies/DockerfileShaUpdater.cs b/eng/update-dependencies/DockerfileShaUpdater.cs
index bdc3449219..fa6c82d88c 100644
--- a/eng/update-dependencies/DockerfileShaUpdater.cs
+++ b/eng/update-dependencies/DockerfileShaUpdater.cs
@@ -40,10 +40,17 @@ public class DockerfileShaUpdater : FileRegexUpdater
         private readonly SpecificCommandOptions _options;
         private readonly string _versions;
         private readonly Dictionary<string, string> _urls;
-        private readonly Lazy<JObject> _manifestVariables;
+        private readonly ManifestVariables _manifestVariables;
 
         public DockerfileShaUpdater(
-            string productName, string dockerfileVersion, string? buildVersion, string arch, string os, string versions, SpecificCommandOptions options)
+            string productName,
+            string dockerfileVersion,
+            string? buildVersion,
+            string arch,
+            string os,
+            string versions,
+            SpecificCommandOptions options,
+            ManifestVariables manifestVariables)
         {
             _productName = productName;
             _dockerfileVersion = new Version(dockerfileVersion);
@@ -52,6 +59,7 @@ public DockerfileShaUpdater(
             _os = os;
             _versions = versions;
             _options = options;
+            _manifestVariables = manifestVariables;
 
             // Maps a product name to a set of one or more candidate URLs referencing the associated artifact. The order of the URLs
             // should be in priority order with each subsequent URL being the fallback.
@@ -69,18 +77,6 @@ public DockerfileShaUpdater(
                 { "sdk",                            "$DOTNET_BASE_URL/Sdk/$VERSION_DIR/dotnet-sdk-$VERSION_FILE-$OS-$ARCH.$ARCHIVE_EXT" },
             };
 
-            _manifestVariables = new Lazy<JObject>(
-                () =>
-                {
-                    const string VariablesProperty = "variables";
-                    JToken? variables = ManifestHelper.LoadManifest(SpecificCommand.VersionsFilename)[VariablesProperty];
-                    if (variables is null)
-                    {
-                        throw new InvalidOperationException($"'{VariablesProperty}' property missing in '{SpecificCommand.VersionsFilename}'");
-                    }
-                    return (JObject)variables;
-                });
-
             if (!string.IsNullOrEmpty(_options.InternalAccessToken))
             {
                 s_httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
@@ -91,9 +87,12 @@ public DockerfileShaUpdater(
         }
 
         public static IEnumerable<IDependencyUpdater> CreateUpdaters(
-            string productName, string dockerfileVersion, string repoRoot, SpecificCommandOptions options)
+            string productName,
+            string dockerfileVersion,
+            SpecificCommandOptions options,
+            ManifestVariables variables)
         {
-            string versionsPath = System.IO.Path.Combine(repoRoot, SpecificCommand.VersionsFilename);
+            string versionsPath = options.GetManifestVersionsFilePath();
             string versions = File.ReadAllText(versionsPath);
 
             // The format of the sha variable name is '<productName>|<dockerfileVersion>|<os>|<arch>|sha'.
@@ -116,7 +115,8 @@ public static IEnumerable<IDependencyUpdater> CreateUpdaters(
                         GetArch(parts),
                         GetOs(parts),
                         versions,
-                        options)
+                        options,
+                        variables)
                     {
                         Path = versionsPath,
                         VersionGroupName = ShaValueGroupName
@@ -137,7 +137,7 @@ public static IEnumerable<IDependencyUpdater> CreateUpdaters(
         {
             usedBuildInfos = [dependencyBuildInfos.First(info => info.SimpleName == _productName)];
 
-            string baseUrl = ManifestHelper.GetBaseUrl(_manifestVariables.Value, _options);
+            string baseUrl = ManifestHelper.GetBaseUrl(_manifestVariables.Variables, _options);
             // Remove Aspire Dashboard case once https://github.com/dotnet/aspire/issues/2035 is fixed.
             string archiveExt = _os.Contains("win") || _productName.Contains("aspire-dashboard") ? "zip" : "tar.gz";
             string versionDir = _buildVersion ?? "";
@@ -275,7 +275,7 @@ private static string GetArch(string[] variableParts)
             // corresponding build in the daily build location, for example, will not be signed due. So when we're targeting
             // the daily build location, we wouldn't use the release checksums file and instead use the other means of
             // retrieving the checksums.
-            string baseUrl = ManifestHelper.GetBaseUrl(_manifestVariables.Value, _options);
+            string baseUrl = ManifestHelper.GetBaseUrl(_manifestVariables.Variables, _options);
             if (baseUrl != ReleaseDotnetBaseCdnUrl)
             {
                 return null;
diff --git a/eng/update-dependencies/FromStagingPipelineCommand.cs b/eng/update-dependencies/FromStagingPipelineCommand.cs
index 4fdbce61f2..b8b2e8b207 100644
--- a/eng/update-dependencies/FromStagingPipelineCommand.cs
+++ b/eng/update-dependencies/FromStagingPipelineCommand.cs
@@ -1,17 +1,20 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using Dotnet.Docker.Sync;
 using Microsoft.Extensions.Logging;
 
 namespace Dotnet.Docker;
 
 internal partial class FromStagingPipelineCommand(
     ILogger<FromStagingPipelineCommand> logger,
-    PipelineArtifactProvider pipelineArtifactProvider)
+    PipelineArtifactProvider pipelineArtifactProvider,
+    IInternalVersionsService internalVersionsService)
     : BaseCommand<FromStagingPipelineOptions>
 {
     private readonly ILogger<FromStagingPipelineCommand> _logger = logger;
     private readonly PipelineArtifactProvider _pipelineArtifactProvider = pipelineArtifactProvider;
+    private readonly IInternalVersionsService _internalVersionsService = internalVersionsService;
 
     public override async Task<int> ExecuteAsync(FromStagingPipelineOptions options)
     {
@@ -44,7 +47,10 @@ public override async Task<int> ExecuteAsync(FromStagingPipelineOptions options)
         string dockerfileVersion = VersionHelper.ResolveMajorMinorVersion(releaseConfig.RuntimeBuild).ToString();
 
         // Record pipeline run ID for this dockerfileVersion, for later use by sync-internal-release command
-        RecordInternalVersion(dockerfileVersion, options.StagingPipelineRunId.ToString());
+        _internalVersionsService.RecordInternalStagingBuild(
+            options.RepoRoot,
+            dockerfileVersion,
+            options.StagingPipelineRunId);
 
         var productVersions = (options.Internal, releaseConfig.SdkOnly) switch
         {
@@ -90,6 +96,7 @@ public override async Task<int> ExecuteAsync(FromStagingPipelineOptions options)
         var updateDependencies = new SpecificCommand();
         var updateDependenciesOptions = new SpecificCommandOptions()
         {
+            RepoRoot = options.RepoRoot,
             DockerfileVersion = dockerfileVersion.ToString(),
             ProductVersions = productVersions,
 
@@ -109,59 +116,6 @@ public override async Task<int> ExecuteAsync(FromStagingPipelineOptions options)
         return await updateDependencies.ExecuteAsync(updateDependenciesOptions);
     }
 
-    /// <summary>
-    /// Records the staging pipeline run ID in an easy to parse format. This
-    /// can be used by the sync-internal-release pipeline to record and
-    /// re-apply the same staging builds after resetting the state of the repo
-    /// to match the public release branch.
-    /// </summary>
-    /// <remarks>
-    /// This will only store one staging pipeline run ID per dockerfileVersion
-    /// </remarks>
-    /// <param name="dockerfileVersion">major-minor version</param>
-    /// <param name="stagingPipelineRunId">the build ID of the staging pipeline run</param>
-    private void RecordInternalVersion(string dockerfileVersion, string stagingPipelineRunId)
-    {
-        const string InternalVersionsFile = "internal-versions.txt";
-
-        // Internal versions file should have one line per dockerfileVersion
-        // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
-        //
-        // The preferable way to do this would be to record the version in
-        // manifest.versions.json, however that would require one of the following:
-        // 1) round-trip serialization, which would remove any whitespace/blank lines - which are
-        //    important for keeping the file readable and reducing git merge conflicts
-        // 2) lots of regex JSON manipulation which is error-prone and harder to maintain
-        //
-        // So for now, the separate file and format is a compromise.
-
-        var versionsFilePath = Path.GetFullPath(SpecificCommand.VersionsFilename);
-        var versionsFileDir = Path.GetDirectoryName(versionsFilePath) ?? "";
-        var internalVersionFile = Path.Combine(versionsFileDir, InternalVersionsFile);
-        Dictionary<string, string> versions = [];
-
-        _logger.LogInformation(
-            "Recording staging pipeline build ID in {internalVersionFile}",
-            internalVersionFile);
-
-        try
-        {
-            // File already exists - read existing versions
-            versions = File.ReadAllLines(internalVersionFile)
-                .Select(line => line.Split('=', 2))
-                .Where(parts => parts.Length == 2)
-                .ToDictionary(parts => parts[0], parts => parts[1]);
-        }
-        catch (FileNotFoundException)
-        {
-            // File doesn't exist - it will be created
-        }
-
-        versions[dockerfileVersion] = stagingPipelineRunId;
-        var versionLines = versions.Select(kv => $"{kv.Key}={kv.Value}");
-        File.WriteAllLines(internalVersionFile, versionLines);
-    }
-
     /// <summary>
     /// Formats a storage account URL has a specific format:
     /// - Starts with "https://"
diff --git a/eng/update-dependencies/FromStagingPipelineOptions.cs b/eng/update-dependencies/FromStagingPipelineOptions.cs
index 980403bc87..02e6880882 100644
--- a/eng/update-dependencies/FromStagingPipelineOptions.cs
+++ b/eng/update-dependencies/FromStagingPipelineOptions.cs
@@ -8,7 +8,7 @@ namespace Dotnet.Docker;
 
 internal record FromStagingPipelineOptions : CreatePullRequestOptions, IOptions
 {
-    public const string StagingStorageAccountOption = "--staging-storage-account";
+    public const string StagingStorageAccountOptionName = "--staging-storage-account";
     public const string InternalOption = "--internal";
 
     /// <summary>
@@ -37,14 +37,16 @@ internal record FromStagingPipelineOptions : CreatePullRequestOptions, IOptions
         ..CreatePullRequestOptions.Arguments,
     ];
 
+    public static Option<string> StagingStorageAccountOption = new(StagingStorageAccountOptionName)
+    {
+        Description = "The Azure Storage Account to use as a source for the update."
+            + " This should be one of two storage accounts: dotnetstagetest or dotnetstage."
+            + " For example: https://dotnetstagetest.blob.core.windows.net/"
+    };
+
     public static new List<Option> Options { get; } =
     [
-        new Option<string>(StagingStorageAccountOption)
-        {
-            Description = "The Azure Storage Account to use as a source for the update."
-                + " This should be one of two storage accounts: dotnetstagetest or dotnetstage."
-                + " For example: https://dotnetstagetest.blob.core.windows.net/"
-        },
+        StagingStorageAccountOption,
         new Option<bool>(InternalOption)
         {
             Description = "Whether or not to use the internal versions of the staged build. When not using an internal"
diff --git a/eng/update-dependencies/Git/GitRemoteInfo.cs b/eng/update-dependencies/Git/GitRemoteInfo.cs
index ba85d48cb6..2530ef6329 100644
--- a/eng/update-dependencies/Git/GitRemoteInfo.cs
+++ b/eng/update-dependencies/Git/GitRemoteInfo.cs
@@ -8,4 +8,4 @@ namespace Dotnet.Docker.Git;
 /// </summary>
 /// <param name="Name">The name of the remote (e.g., "origin").</param>
 /// <param name="Url">The URL of the remote repository.</param>
-public record GitRemoteInfo(string Name, string Url);
+internal sealed record GitRemoteInfo(string Name, string Url);
diff --git a/eng/update-dependencies/Git/GitRepoHelper.cs b/eng/update-dependencies/Git/GitRepoHelper.cs
index 0357f1d1f0..af052a17ce 100644
--- a/eng/update-dependencies/Git/GitRepoHelper.cs
+++ b/eng/update-dependencies/Git/GitRepoHelper.cs
@@ -13,7 +13,7 @@ namespace Dotnet.Docker.Git;
 /// <remarks>
 /// Use <see cref="IGitRepoHelperFactory"/> to instantiate this.
 /// </remarks>
-public sealed class GitRepoHelper(
+internal sealed class GitRepoHelper(
     string remoteRepoUrl,
     ILocalGitRepoHelper localGitRepoHelper,
     IRemoteGitRepoHelper remoteGitRepoHelper,
@@ -55,7 +55,7 @@ public async Task CheckoutRemoteBranchAsync(string branchName)
             throw new InvalidBranchException($"Branch '{branchName}' does not exist on remote.");
         }
 
-        await Local.CheckoutBranchAsync(branchName);
+        await Local.CheckoutRefAsync($"origin/{branchName}");
     }
 
     /// <inheritdoc />
diff --git a/eng/update-dependencies/Git/GitRepoHelperFactory.cs b/eng/update-dependencies/Git/GitRepoHelperFactory.cs
index 1e2f9e5769..70996dfcbf 100644
--- a/eng/update-dependencies/Git/GitRepoHelperFactory.cs
+++ b/eng/update-dependencies/Git/GitRepoHelperFactory.cs
@@ -11,18 +11,20 @@
 
 namespace Dotnet.Docker.Git;
 
-public interface IGitRepoHelperFactory
+internal interface IGitRepoHelperFactory
 {
     Task<IGitRepoHelper> CreateAsync(string repoUri);
 }
 
-public sealed class GitRepoHelperFactory(
+internal sealed class GitRepoHelperFactory(
+    ILogger<GitRepoHelperFactory> logger,
     IGitRepoCloner gitRepoCloner,
     ILocalGitRepoFactory localGitRepoFactory,
     IRemoteGitRepoFactory remoteFactory,
     IServiceProvider serviceProvider
 ) : IGitRepoHelperFactory
 {
+    private readonly ILogger<GitRepoHelperFactory> _logger = logger;
     private readonly IGitRepoCloner _gitRepoCloner = gitRepoCloner;
     private readonly ILocalGitRepoFactory _localGitRepoFactory = localGitRepoFactory;
     private readonly IRemoteGitRepoFactory _remoteFactory = remoteFactory;
@@ -38,6 +40,7 @@ await _gitRepoCloner.CloneAsync(
             targetDirectory: localCloneDir,
             checkoutSubmodules: false,
             gitDirectory: null);
+        _logger.LogInformation("Cloned '{RepoUri}' to '{LocalCloneDir}'", repoUri, localCloneDir);
 
         var localGitRepo = _localGitRepoFactory.Create(new NativePath(localCloneDir));
         var localGitRepoHelper = new LocalGitRepoHelper(
diff --git a/eng/update-dependencies/Git/IGitRepoHelper.cs b/eng/update-dependencies/Git/IGitRepoHelper.cs
index f413dc3c2a..9aed8f1467 100644
--- a/eng/update-dependencies/Git/IGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/IGitRepoHelper.cs
@@ -9,7 +9,7 @@ namespace Dotnet.Docker.Git;
 /// <summary>
 /// Handles operations that require interactions with both local and remote git repos.
 /// </summary>
-public interface IGitRepoHelper : IDisposable
+internal interface IGitRepoHelper : IDisposable
 {
     /// <summary>
     /// For any git operations that only affect the local repo.
diff --git a/eng/update-dependencies/Git/ILocalGitRepoHelper.cs b/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
index 0457ce2386..368e86e554 100644
--- a/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/ILocalGitRepoHelper.cs
@@ -6,7 +6,7 @@
 
 namespace Dotnet.Docker.Git;
 
-public interface ILocalGitRepoHelper
+internal interface ILocalGitRepoHelper
 {
     /// <summary>
     /// The local path where the repository is cloned.
@@ -22,10 +22,10 @@ public interface ILocalGitRepoHelper
     Task<string> CommitAsync(string message, (string Name, string Email) author);
 
     /// <summary>
-    /// Check out a local branch.
+    /// Check out a git ref locally.
     /// </summary>
-    /// <param name="branchName">A branch that exists locally.</param>
-    Task CheckoutBranchAsync(string branchName);
+    /// <param name="gitRef">A git ref that exists locally.</param>
+    Task CheckoutRefAsync(string gitRef);
 
     /// <summary>
     /// Create a new local branch. This does not push the branch to the remote.
@@ -69,4 +69,20 @@ public interface ILocalGitRepoHelper
     /// List all remotes for the local repository.
     /// </summary>
     Task<IEnumerable<GitRemoteInfo>> ListAllRemotesAsync();
+
+    /// <summary>
+    /// Restore the working tree with the contents from a restore source.
+    /// Uncommitted changes in the working tree will be lost.
+    /// </summary>
+    /// <remarks>
+    /// Because contents are restored to the working tree, they will not be
+    /// staged. If the changes resulting from this command need to be
+    /// committed, they must be staged first.
+    /// </remarks>
+    /// <param name="source">
+    /// Restore the working tree files with the content from this tree.
+    /// This can be a commit, branch or tag.
+    /// </param>
+    /// <see href="link">https://git-scm.com/docs/git-restore</see>
+    Task RestoreAsync(string source);
 }
diff --git a/eng/update-dependencies/Git/IRemoteGitRepoHelper.cs b/eng/update-dependencies/Git/IRemoteGitRepoHelper.cs
index 1390e2d4d0..b946c28268 100644
--- a/eng/update-dependencies/Git/IRemoteGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/IRemoteGitRepoHelper.cs
@@ -6,7 +6,7 @@
 
 namespace Dotnet.Docker.Git;
 
-public interface IRemoteGitRepoHelper
+internal interface IRemoteGitRepoHelper
 {
     /// <summary>
     /// Checks if a branch exists on the remote repository.
diff --git a/eng/update-dependencies/Git/InvalidBranchException.cs b/eng/update-dependencies/Git/InvalidBranchException.cs
index 26703c3ac0..2600e7e003 100644
--- a/eng/update-dependencies/Git/InvalidBranchException.cs
+++ b/eng/update-dependencies/Git/InvalidBranchException.cs
@@ -10,4 +10,4 @@ namespace Dotnet.Docker.Git;
 /// such as attempting to use a non-existent branch or an incorrectly named branch.
 /// </summary>
 /// <param name="message">The error message describing the invalid branch condition.</param>
-public sealed class InvalidBranchException(string message) : InvalidOperationException(message);
+internal sealed class InvalidBranchException(string message) : InvalidOperationException(message);
diff --git a/eng/update-dependencies/Git/LocalGitRepoHelper.cs b/eng/update-dependencies/Git/LocalGitRepoHelper.cs
index 51f57d7f5e..5de9bc9914 100644
--- a/eng/update-dependencies/Git/LocalGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/LocalGitRepoHelper.cs
@@ -10,7 +10,7 @@
 
 namespace Dotnet.Docker.Git;
 
-public sealed class LocalGitRepoHelper(
+internal sealed class LocalGitRepoHelper(
     string localPath,
     ILocalGitRepo localGitRepo,
     ILogger<LocalGitRepoHelper> logger
@@ -33,11 +33,10 @@ public async Task CreateAndCheckoutLocalBranchAsync(string branchName)
     }
 
     /// <inheritdoc />
-    public Task CheckoutBranchAsync(string branchName)
+    public Task CheckoutRefAsync(string gitRef)
     {
-        var branchRef = $"refs/heads/{branchName}";
-        _logger.LogInformation("Checking out ref {BranchRef}", branchRef);
-        return _localGitRepo.CheckoutAsync(branchRef);
+        _logger.LogInformation("Checking out ref {GitRef}", gitRef);
+        return _localGitRepo.CheckoutAsync(gitRef);
     }
 
     /// <inheritdoc />
@@ -63,11 +62,25 @@ public async Task StageAsync(params IEnumerable<string> paths)
     /// <inheritdoc />
     public async Task<string> CommitAsync(string message, (string Name, string Email) author)
     {
+        var gitStatusLines = await _localGitRepo.RunGitCommandAsync(["status"]);
+        var gitStatus = string.Join(Environment.NewLine, gitStatusLines);
+        _logger.LogInformation(
+            """
+            Git status:
+            {gitStatus}
+            """,
+            gitStatus);
+
         await _localGitRepo.CommitAsync(message, allowEmpty: false, author);
         var commitSha = await _localGitRepo.GetShaForRefAsync("HEAD");
+
+        _logger.LogInformation(
+            "Created commit {commitSha}, message: '{commitMessage}' ({authorName} <{authorEmail}>)",
+            commitSha, message, author.Name, author.Email);
+
         return commitSha;
     }
-    
+
     /// <inheritdoc />
     public async Task<bool> IsAncestorAsync(string ancestorRef, string descendantRef)
     {
@@ -99,4 +112,11 @@ public async Task<IEnumerable<GitRemoteInfo>> ListAllRemotesAsync()
             // There are typically two entries per remote (fetch and push); we only want one
             .Distinct();
     }
+
+    /// <inheritdoc />
+    public Task RestoreAsync(string source)
+    {
+        _logger.LogInformation("Restoring working tree from source {Source}", source);
+        return _localGitRepo.ExecuteGitCommand("restore", "--source", source, ".");
+    }
 }
diff --git a/eng/update-dependencies/Git/RemoteGitRepoFactory.cs b/eng/update-dependencies/Git/RemoteGitRepoFactory.cs
index a2a7815d6c..59d72bd4b9 100644
--- a/eng/update-dependencies/Git/RemoteGitRepoFactory.cs
+++ b/eng/update-dependencies/Git/RemoteGitRepoFactory.cs
@@ -10,7 +10,7 @@ namespace Dotnet.Docker.Git;
 /// <summary>
 /// Factory for creating <see cref="IRemoteGitRepo"/> instances based on repository URLs.
 /// </summary>
-public interface IRemoteGitRepoFactory
+internal interface IRemoteGitRepoFactory
 {
     /// <summary>
     /// Creates a remote Git repository client appropriate for the given repository URL.
@@ -21,7 +21,7 @@ public interface IRemoteGitRepoFactory
 }
 
 /// <inheritdoc />
-public sealed class RemoteGitRepoFactory(IServiceProvider serviceProvider) : IRemoteGitRepoFactory
+internal sealed class RemoteGitRepoFactory(IServiceProvider serviceProvider) : IRemoteGitRepoFactory
 {
     private readonly IServiceProvider _serviceProvider = serviceProvider;
 
diff --git a/eng/update-dependencies/Git/RemoteGitRepoHelper.cs b/eng/update-dependencies/Git/RemoteGitRepoHelper.cs
index c44cdf89d3..20fd42dd84 100644
--- a/eng/update-dependencies/Git/RemoteGitRepoHelper.cs
+++ b/eng/update-dependencies/Git/RemoteGitRepoHelper.cs
@@ -8,7 +8,7 @@
 
 namespace Dotnet.Docker.Git;
 
-public sealed class RemoteGitRepoHelper(
+internal sealed class RemoteGitRepoHelper(
     string remoteRepoUrl,
     IRemoteGitRepo remoteGitRepo,
     ILocalGitRepo localGitRepo,
diff --git a/eng/update-dependencies/GitHubReleaseUpdaterBase.cs b/eng/update-dependencies/GitHubReleaseUpdaterBase.cs
index 827f5903ba..79291cd999 100644
--- a/eng/update-dependencies/GitHubReleaseUpdaterBase.cs
+++ b/eng/update-dependencies/GitHubReleaseUpdaterBase.cs
@@ -8,13 +8,13 @@
 namespace Dotnet.Docker;
 
 internal abstract partial class GitHubReleaseUpdaterBase(
-    string repoRoot,
+    string manifestVersionsFilePath,
     string toolName,
     string variableName,
     string owner,
     string repo)
     : VariableUpdaterBase(
-        repoRoot,
+        manifestVersionsFilePath,
         variableName)
 {
     protected string ToolName { get; } = toolName;
diff --git a/eng/update-dependencies/GitHubReleaseVersionUpdater.cs b/eng/update-dependencies/GitHubReleaseVersionUpdater.cs
index 1756b1505a..b0541781f2 100644
--- a/eng/update-dependencies/GitHubReleaseVersionUpdater.cs
+++ b/eng/update-dependencies/GitHubReleaseVersionUpdater.cs
@@ -7,13 +7,13 @@ namespace Dotnet.Docker;
 /// Updates a variable to the latest GitHub Release tag
 /// </summary>
 internal class GitHubReleaseVersionUpdater(
-    string repoRoot,
+    string manifestVersionsFilePath,
     string toolName,
     string variableName,
     string owner,
     string repo)
     : GitHubReleaseUpdaterBase(
-        repoRoot,
+        manifestVersionsFilePath,
         toolName,
         variableName,
         owner,
diff --git a/eng/update-dependencies/ICommand.cs b/eng/update-dependencies/ICommand.cs
new file mode 100644
index 0000000000..8918bcfb79
--- /dev/null
+++ b/eng/update-dependencies/ICommand.cs
@@ -0,0 +1,16 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Dotnet.Docker;
+
+/// <summary>
+/// A generic CLI command that takes an options object.
+/// </summary>
+/// <typeparam name="TOptions">
+/// The type of options that the command accepts.
+/// </typeparam>
+/// <seealso cref="BaseCommand"/>
+public interface ICommand<TOptions> where TOptions : IOptions
+{
+    Task<int> ExecuteAsync(TOptions options);
+}
diff --git a/eng/update-dependencies/ManifestHelper.cs b/eng/update-dependencies/ManifestHelper.cs
index 3d3fb2716d..d961559021 100644
--- a/eng/update-dependencies/ManifestHelper.cs
+++ b/eng/update-dependencies/ManifestHelper.cs
@@ -1,8 +1,6 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
-using System;
-using System.IO;
 using System.Text.RegularExpressions;
 using Newtonsoft.Json.Linq;
 
@@ -21,8 +19,19 @@ public static partial class ManifestHelper
     /// </summary>
     /// <param name="manifestVariables">JSON object of the variables from the manifest.</param>
     /// <param name="options">Configured options from the app.</param>
-    public static string GetBaseUrl(JObject manifestVariables, SpecificCommandOptions options) =>
-        ResolveVariableValue(GetBaseUrlVariableName(options.DockerfileVersion, options.SourceBranch, options.VersionSourceName), manifestVariables);
+    public static string GetBaseUrl(JObject manifestVariables, SpecificCommandOptions options)
+    {
+        // The upstream branch represents which GitHub branch the current
+        // branch branched off of. This is either "nightly" or "main".
+        var upstreamBranch = ResolveVariableValue("branch", manifestVariables);
+
+        var baseUrlVariableName = GetBaseUrlVariableName(
+            dockerfileVersion: options.DockerfileVersion,
+            branch: upstreamBranch,
+            versionSourceName: options.VersionSourceName);
+
+        return ResolveVariableValue(baseUrlVariableName, manifestVariables);
+    }
 
     /// <summary>
     /// Constructs the name of the product version base URL variable.
@@ -106,13 +115,12 @@ public static string GetVariableValue(string variableName, JObject variables)
             ?? throw new ArgumentException($"Manifest does not contain a value for {variableName}");
 
     /// <summary>
-    /// Loads the manifest from the given filename.
+    /// Loads the manifest from the given file path.
     /// </summary>
-    /// <param name="filename">Name, not path, of the manifest file located at the root of the repo.</param>
-    public static JObject LoadManifest(string filename)
+    /// <param name="filePath">Path of the manifest file located at the root of the repo.</param>
+    public static JObject LoadManifest(string filePath)
     {
-        string path = Path.Combine(SpecificCommand.RepoRoot, filename);
-        string contents = File.ReadAllText(path);
+        string contents = File.ReadAllText(filePath);
         return JObject.Parse(contents);
     }
 
@@ -138,7 +146,7 @@ public static Regex GetManifestVariableRegex(string variableName, string valuePa
     /// </summary>
     /// <param name="value">Variable value to be resolved.</param>
     /// <param name="variables">JSON object of the variables from the manifest.</param>
-    private static string ResolveVariables(string value, JObject variables)
+    public static string ResolveVariables(string value, JObject variables)
     {
         MatchCollection matches = Regex.Matches(value, VariablePattern);
         foreach (Match match in matches)
diff --git a/eng/update-dependencies/ManifestVariables.cs b/eng/update-dependencies/ManifestVariables.cs
new file mode 100644
index 0000000000..df7dbe85e8
--- /dev/null
+++ b/eng/update-dependencies/ManifestVariables.cs
@@ -0,0 +1,39 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using Newtonsoft.Json.Linq;
+
+namespace Dotnet.Docker;
+
+/// <summary>
+/// Object that holds variables defined in a manifest file.
+/// </summary>
+public class ManifestVariables(JObject variables)
+{
+    public static ManifestVariables FromFile(string filePath)
+    {
+        var manifestObject = ManifestHelper.LoadManifest(filePath);
+        var manifestVariables = (JObject?)manifestObject["variables"] ?? [];
+        return new ManifestVariables(manifestVariables);
+    }
+
+    /// <summary>
+    /// The raw JSON object containing the variables from the manifest.
+    /// </summary>
+    public JObject Variables { get; } = variables;
+
+    /// <summary>
+    /// Checks whether the manifest contains a value for <paramref name="variableName"/>.
+    /// </summary>
+    public bool HasValue(string variableName) => Variables.ContainsKey(variableName);
+
+    /// <summary>
+    /// Resolves the value of a manifest variable, recursively resolving any
+    /// variables referenced in the value.
+    /// </summary>
+    public string GetValue(string variableName)
+    {
+        string variableValue = ManifestHelper.GetVariableValue(variableName, Variables);
+        return ManifestHelper.ResolveVariables(variableValue, Variables);
+    }
+}
diff --git a/eng/update-dependencies/NuGetConfigUpdater.cs b/eng/update-dependencies/NuGetConfigUpdater.cs
index 25fe51ecee..59595eb1f7 100644
--- a/eng/update-dependencies/NuGetConfigUpdater.cs
+++ b/eng/update-dependencies/NuGetConfigUpdater.cs
@@ -1,10 +1,6 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
-using System;
-using System.Collections.Generic;
-using System.IO;
-using System.Linq;
 using System.Text;
 using System.Xml.Linq;
 using Microsoft.DotNet.VersionTools.Dependencies;
@@ -17,17 +13,25 @@ namespace Dotnet.Docker;
 internal class NuGetConfigUpdater : IDependencyUpdater
 {
     private const string PkgSrcSuffix = "_internal";
-    private readonly string _repoRoot;
     private readonly SpecificCommandOptions _options;
     private readonly string _configPath;
 
-    public NuGetConfigUpdater(string repoRoot, SpecificCommandOptions options)
+    public NuGetConfigUpdater(ManifestVariables manifestVariables, SpecificCommandOptions options)
     {
-        _repoRoot = repoRoot;
         _options = options;
 
-        string configSuffix = _options.IsInternal ? ".internal" : _options.SourceBranch == "nightly" ? ".nightly" : string.Empty;
-        _configPath = Path.Combine(_repoRoot, $"tests/Microsoft.DotNet.Docker.Tests/TestAppArtifacts/NuGet.config{configSuffix}");
+        // The upstream branch represents which GitHub branch the current
+        // branch branched off of. This is either "nightly" or "main".
+        string upstreamBranch = manifestVariables.GetValue("branch");
+
+        string configSuffix = (_options.IsInternal, upstreamBranch) switch
+        {
+            (true, _) => ".internal",
+            (false, "nightly") => ".nightly",
+            _ => string.Empty
+        };
+
+        _configPath = Path.Combine(_options.RepoRoot, $"tests/Microsoft.DotNet.Docker.Tests/TestAppArtifacts/NuGet.config{configSuffix}");
     }
 
     public IEnumerable<DependencyUpdateTask> GetUpdateTasks(IEnumerable<IDependencyInfo> dependencyInfos)
diff --git a/eng/update-dependencies/Program.cs b/eng/update-dependencies/Program.cs
index f965c1f061..f4e126f650 100644
--- a/eng/update-dependencies/Program.cs
+++ b/eng/update-dependencies/Program.cs
@@ -62,7 +62,7 @@
                 logging.AddSimpleConsole(options =>
                 {
                     options.IncludeScopes = true;
-                    options.SingleLine = true;
+                    options.SingleLine = false;
                 });
             })
         .ConfigureServices(services =>
@@ -128,6 +128,7 @@
 
                 services.AddSingleton<AzdoAuthProvider>();
                 services.AddSingleton<PipelineArtifactProvider>();
+                services.AddSingleton<IInternalVersionsService, InternalVersionsService>();
 
                 // Dependencies that can be updated using the FromComponentCommand
                 services.AddKeyedSingleton<IDependencyVersionSource, ChiselVersionSource>("chisel");
diff --git a/eng/update-dependencies/RocksToolboxUpdater.cs b/eng/update-dependencies/RocksToolboxUpdater.cs
index 044762eaa6..f842ea15d3 100644
--- a/eng/update-dependencies/RocksToolboxUpdater.cs
+++ b/eng/update-dependencies/RocksToolboxUpdater.cs
@@ -14,9 +14,9 @@ internal static class RocksToolboxUpdater
 
     private const string Repo = "rocks-toolbox";
 
-    public static IDependencyUpdater GetUpdater(string repoRoot) =>
+    public static IDependencyUpdater GetUpdater(string manifestVersionsFilePath) =>
         new GitHubReleaseVersionUpdater(
-            repoRoot: repoRoot,
+            manifestVersionsFilePath: manifestVersionsFilePath,
             toolName: ToolName,
             variableName: $"{ToolName}|latest|version",
             owner: Owner,
diff --git a/eng/update-dependencies/SpecificCommand.cs b/eng/update-dependencies/SpecificCommand.cs
index 2a0d2fd675..e79da23452 100644
--- a/eng/update-dependencies/SpecificCommand.cs
+++ b/eng/update-dependencies/SpecificCommand.cs
@@ -4,6 +4,7 @@
 using System;
 using System.Collections.Generic;
 using System.Diagnostics;
+using System.Globalization;
 using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
@@ -13,14 +14,12 @@
 using Microsoft.DotNet.VersionTools.Automation.GitHubApi;
 using Microsoft.DotNet.VersionTools.Dependencies;
 using Microsoft.DotNet.VersionTools.Dependencies.BuildOutput;
+using Newtonsoft.Json.Linq;
 
 namespace Dotnet.Docker
 {
     public class SpecificCommand : BaseCommand<SpecificCommandOptions>
     {
-        public const string ManifestFilename = "manifest.json";
-        public const string VersionsFilename = "manifest.versions.json";
-
         private static SpecificCommandOptions? s_options;
 
         private static SpecificCommandOptions Options {
@@ -28,36 +27,40 @@ private static SpecificCommandOptions Options {
             set => s_options = value;
         }
 
-        public static string RepoRoot { get; } = Directory.GetCurrentDirectory();
-
         public override async Task<int> ExecuteAsync(SpecificCommandOptions options)
         {
             Options = options;
+            int exitCode = 0;
+
+            ErrorTraceListener errorTraceListener = new();
+            TextWriterTraceListener consoleTraceListener = new TextWriterTraceListener(Console.Out);
+            Trace.Listeners.Add(errorTraceListener);
+            Trace.Listeners.Add(consoleTraceListener);
 
             try
             {
-                ErrorTraceListener errorTraceListener = new();
-                Trace.Listeners.Add(errorTraceListener);
-                Trace.Listeners.Add(new TextWriterTraceListener(Console.Out));
-
                 IDependencyInfo[] productBuildInfos = Options.ProductVersions
                     .Select(kvp => CreateDependencyBuildInfo(kvp.Key, kvp.Value))
                     .ToArray();
                 IDependencyInfo[] toolBuildInfos =
                     await Task.WhenAll(Options.Tools.Select(Tools.GetToolBuildInfoAsync));
 
+                // Load manifest variables once, up front
+                var manifestFilePath = options.GetManifestVersionsFilePath();
+                var manifestVariables = ManifestVariables.FromFile(manifestFilePath);
+
                 List<DependencyUpdateResults> updateResults = [];
 
                 if (productBuildInfos.Length != 0)
                 {
-                    IEnumerable<IDependencyUpdater> productUpdaters = GetProductUpdaters();
+                    IEnumerable<IDependencyUpdater> productUpdaters = GetProductUpdaters(manifestVariables);
                     DependencyUpdateResults productUpdateResults = UpdateFiles(productBuildInfos, productUpdaters);
                     updateResults.Add(productUpdateResults);
                 }
 
                 if (toolBuildInfos.Length != 0)
                 {
-                    IEnumerable<IDependencyUpdater> toolUpdaters = Tools.GetToolUpdaters(RepoRoot);
+                    IEnumerable<IDependencyUpdater> toolUpdaters = Tools.GetToolUpdaters(repoRoot: Options.RepoRoot);
                     DependencyUpdateResults toolUpdateResults = UpdateFiles(toolBuildInfos, toolUpdaters);
                     updateResults.Add(toolUpdateResults);
                 }
@@ -118,10 +121,18 @@ public override async Task<int> ExecuteAsync(SpecificCommandOptions options)
             catch (Exception e)
             {
                 Console.Error.WriteLine($"Failed to update dependencies:{Environment.NewLine}{e}");
-                Environment.Exit(1);
+                exitCode = 1;
+            }
+            finally
+            {
+                Trace.Listeners.Remove(errorTraceListener);
+                Trace.Listeners.Remove(consoleTraceListener);
+                errorTraceListener.Dispose();
+                consoleTraceListener.Dispose();
+                s_options = null;
             }
 
-            return 0;
+            return exitCode;
         }
 
         private static DependencyUpdateResults UpdateFiles(
@@ -151,7 +162,7 @@ private static IDependencyInfo CreateDependencyBuildInfo(string name, string? ve
 
         private static void PushToAzdoBranch(string commitMessage, string targetBranch)
         {
-            using Repository repo = new(RepoRoot);
+            using Repository repo = new(Options.RepoRoot);
 
             // Commit the existing changes
             Commands.Stage(repo, "*");
@@ -173,7 +184,7 @@ private static void PushToAzdoBranch(string commitMessage, string targetBranch)
                 "azuredevops"
             );
 
-            var url = $"{Options.AzdoOrganization}{Options.AzdoProject}/_git/{Options.AzdoRepo}";
+            var url = Options.GetAzdoRepoUrl();
             Trace.WriteLine($"Adding remote {remoteName} with URL {url}");
             Remote remote = repo.Network.Remotes.Add(remoteName, url);
 
@@ -375,26 +386,29 @@ private static void DirectoryCopy(string sourceDirName, string destDirName)
             }
         }
 
-        private static IEnumerable<IDependencyUpdater> GetProductUpdaters()
+        private static IEnumerable<IDependencyUpdater> GetProductUpdaters(ManifestVariables manifestVariables)
         {
             // NOTE: The order in which the updaters are returned/invoked is important as there are cross dependencies
             // (e.g. sha updater requires the version numbers to be updated within the Dockerfiles)
 
             List<IDependencyUpdater> updaters =
             [
-                new NuGetConfigUpdater(RepoRoot, Options),
-                BaseUrlUpdater.Create(RepoRoot, Options)
+                new NuGetConfigUpdater(manifestVariables, Options),
+                BaseUrlUpdater.Create(manifestVariables, Options)
             ];
 
             foreach (string productName in Options.ProductVersions.Keys)
             {
-                updaters.Add(new VersionUpdater(VersionType.Build, productName, Options.DockerfileVersion, RepoRoot, Options));
-                updaters.Add(new VersionUpdater(VersionType.Product, productName, Options.DockerfileVersion, RepoRoot, Options));
+                updaters.Add(new VersionUpdater(VersionType.Build, productName, Options.DockerfileVersion, Options));
+                updaters.Add(new VersionUpdater(VersionType.Product, productName, Options.DockerfileVersion, Options));
 
-                foreach (IDependencyUpdater shaUpdater in DockerfileShaUpdater.CreateUpdaters(productName, Options.DockerfileVersion, RepoRoot, Options))
-                {
-                    updaters.Add(shaUpdater);
-                }
+                var shaUpdaters = DockerfileShaUpdater.CreateUpdaters(
+                    productName: productName,
+                    dockerfileVersion: Options.DockerfileVersion,
+                    options: Options,
+                    variables: manifestVariables);
+
+                updaters.AddRange(shaUpdaters);
             }
 
             return updaters;
@@ -402,8 +416,8 @@ private static IEnumerable<IDependencyUpdater> GetProductUpdaters()
 
         private static IEnumerable<IDependencyUpdater> GetGeneratedContentUpdaters() =>
         [
-            ScriptRunnerUpdater.GetDockerfileUpdater(RepoRoot),
-            ScriptRunnerUpdater.GetReadMeUpdater(RepoRoot)
+            ScriptRunnerUpdater.GetDockerfileUpdater(Options.RepoRoot),
+            ScriptRunnerUpdater.GetReadMeUpdater(Options.RepoRoot)
         ];
     }
 }
diff --git a/eng/update-dependencies/SpecificCommandOptions.cs b/eng/update-dependencies/SpecificCommandOptions.cs
index 17b7a0fbdb..2d010126c2 100644
--- a/eng/update-dependencies/SpecificCommandOptions.cs
+++ b/eng/update-dependencies/SpecificCommandOptions.cs
@@ -58,6 +58,11 @@ private static List<Option> GetOptions()
 
             List<Option> options =
             [
+                new Option<string>("--repo-root")
+                {
+                    Description = "The root of the dotnet-docker repo to run against."
+                        + " If not specified, the current working directory will be used."
+                },
                 new Option<IDictionary<string, string?>>("--product-versions", "--product-version")
                 {
                     Description = "Product versions to update (<product-name>=<version>)",
diff --git a/eng/update-dependencies/Sync/IInternalVersionsService.cs b/eng/update-dependencies/Sync/IInternalVersionsService.cs
new file mode 100644
index 0000000000..576c29c7eb
--- /dev/null
+++ b/eng/update-dependencies/Sync/IInternalVersionsService.cs
@@ -0,0 +1,33 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Dotnet.Docker.Sync;
+
+/// <summary>
+/// Abstraction for recording and reading internal staging build information
+/// local to the repo.
+/// </summary>
+/// <remarks>
+/// This can be used by the sync-internal-release pipeline to record and
+/// re-apply the same staging builds after resetting the state of the repo to
+/// match the public release branch.
+/// </remarks>
+internal interface IInternalVersionsService
+{
+    /// <summary>
+    /// Records a staging pipeline run ID in the repo.
+    /// </summary>
+    /// <remarks>
+    /// This will only store one staging pipeline run ID per dockerfileVersion.
+    /// If a version already exists for the same dockerfileVersion, it will be
+    /// overwritten.
+    /// </remarks>
+    /// <param name="dockerfileVersion">major-minor version</param>
+    /// <param name="stagingPipelineRunId">the build ID of the staging pipeline run</param>
+    void RecordInternalStagingBuild(string repoRoot, string dockerfileVersion, int stagingPipelineRunId);
+
+    /// <summary>
+    /// Gets any previously recorded internal staging builds in the repo.
+    /// </summary>
+    InternalStagingBuilds GetInternalStagingBuilds(string repoRoot);
+}
diff --git a/eng/update-dependencies/Sync/InternalStagingBuilds.cs b/eng/update-dependencies/Sync/InternalStagingBuilds.cs
new file mode 100644
index 0000000000..65136ad1b1
--- /dev/null
+++ b/eng/update-dependencies/Sync/InternalStagingBuilds.cs
@@ -0,0 +1,42 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Collections.Immutable;
+
+namespace Dotnet.Docker.Sync;
+
+/// <summary>
+/// Records information about what internal staging pipeline run IDs were used
+/// for which .NET Dockerfile versions.
+/// </summary>
+/// <param name="Versions">
+/// Mapping of Major.Minor .NET version to staging pipeline run ID.
+/// </param>
+internal sealed record InternalStagingBuilds(ImmutableDictionary<string, int> Versions)
+{
+    /// <summary>
+    /// Parses <see cref=" InternalStagingBuilds"/> from lines of text.
+    /// </summary>
+    /// <remarks>
+    /// Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
+    /// </remarks>
+    public static InternalStagingBuilds Parse(IEnumerable<string> lines)
+    {
+        var versions = lines
+            .Select(line => line.Split('=', 2))
+            .Where(parts => parts.Length == 2)
+            .ToImmutableDictionary(parts => parts[0], parts => int.Parse(parts[1]));
+
+        return new InternalStagingBuilds(versions);
+    }
+
+    /// <summary>
+    /// Returns a new <see cref="InternalStagingBuilds"/> with the specified
+    /// version added.
+    /// </summary>
+    public InternalStagingBuilds Add(string dockerfileVersion, int stagingPipelineRunId) =>
+        this with { Versions = Versions.SetItem(dockerfileVersion, stagingPipelineRunId) };
+
+    public override string ToString() =>
+        string.Join(Environment.NewLine, Versions.Select(kv => $"{kv.Key}={kv.Value}"));
+}
diff --git a/eng/update-dependencies/Sync/InternalVersionsService.cs b/eng/update-dependencies/Sync/InternalVersionsService.cs
new file mode 100644
index 0000000000..8e299b5206
--- /dev/null
+++ b/eng/update-dependencies/Sync/InternalVersionsService.cs
@@ -0,0 +1,48 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Collections.Immutable;
+
+namespace Dotnet.Docker.Sync;
+
+/// <inheritdoc/>
+internal sealed class InternalVersionsService : IInternalVersionsService
+{
+    private const string InternalVersionsFileName = "internal-versions.txt";
+
+    /// <inheritdoc/>
+    public InternalStagingBuilds GetInternalStagingBuilds(string repoRoot)
+    {
+        var internalVersionFile = Path.Combine(repoRoot, InternalVersionsFileName);
+        try
+        {
+            var fileContents = File.ReadAllLines(internalVersionFile);
+            return InternalStagingBuilds.Parse(fileContents);
+        }
+        catch (FileNotFoundException)
+        {
+            return new InternalStagingBuilds(ImmutableDictionary<string, int>.Empty);
+        }
+    }
+
+    /// <inheritdoc/>
+    public void RecordInternalStagingBuild(string repoRoot, string dockerfileVersion, int stagingPipelineRunId)
+    {
+        // Internal versions file should have one line per dockerfileVersion
+        // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
+        //
+        // The preferable way to do this would be to record the version in
+        // manifest.versions.json, however that would require one of the following:
+        // 1) round-trip serialization, which would remove any whitespace/blank lines - which are
+        //    important for keeping the file readable and reducing git merge conflicts
+        // 2) lots of regex JSON manipulation which is error-prone and harder to maintain
+        //
+        // So for now, the separate file and format is a compromise.
+
+        // Internal versions file should have one line per dockerfileVersion
+        // Each line should be formatted as: <dockerfileVersion>=<stagingPipelineRunId>
+        var builds = GetInternalStagingBuilds(repoRoot).Add(dockerfileVersion, stagingPipelineRunId);
+        var internalVersionFile = Path.Combine(repoRoot, InternalVersionsFileName);
+        File.WriteAllText(internalVersionFile, builds.ToString());
+    }
+}
diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
index b9ae8f4d60..05835ef748 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseCommand.cs
@@ -18,19 +18,21 @@ namespace Dotnet.Docker.Sync;
 /// internal/release/* branch may contain .NET versions that are not yet publicly available.
 /// "In sync" does not necessarily mean that the commit SHAs of both branches are identical.
 /// </remarks>
-public sealed class SyncInternalReleaseCommand(
+internal sealed class SyncInternalReleaseCommand(
     IGitRepoHelperFactory gitRepoHelperFactory,
+    ICommand<FromStagingPipelineOptions> updateFromStagingPipeline,
+    IInternalVersionsService internalVersionsService,
     ILogger<SyncInternalReleaseCommand> logger
 ) : BaseCommand<SyncInternalReleaseOptions>
 {
     private readonly IGitRepoHelperFactory _gitRepoHelperFactory = gitRepoHelperFactory;
+    private readonly ICommand<FromStagingPipelineOptions> _updateFromStagingPipeline = updateFromStagingPipeline;
+    private readonly IInternalVersionsService _internalVersionsService = internalVersionsService;
     private readonly ILogger<SyncInternalReleaseCommand> _logger = logger;
 
     public override async Task<int> ExecuteAsync(SyncInternalReleaseOptions options)
     {
-        ArgumentException.ThrowIfNullOrWhiteSpace(options.RemoteUrl);
-        ArgumentException.ThrowIfNullOrWhiteSpace(options.TargetBranch);
-        ArgumentException.ThrowIfNullOrWhiteSpace(options.SourceBranch);
+        var remoteUrl = options.GetAzdoRepoUrl();
 
         // Do not allow syncing starting from an internal branch.
         if (options.SourceBranch.StartsWith("internal/", StringComparison.OrdinalIgnoreCase))
@@ -39,7 +41,7 @@ public override async Task<int> ExecuteAsync(SyncInternalReleaseOptions options)
                 $"The source branch '{options.SourceBranch}' cannot be an internal branch.");
         }
 
-        using var repo = await _gitRepoHelperFactory.CreateAsync(options.RemoteUrl);
+        using var repo = await _gitRepoHelperFactory.CreateAsync(remoteUrl);
 
         // Verify that the source branch exists on the remote.
         var sourceBranchExists = await repo.Remote.RemoteBranchExistsAsync(options.SourceBranch);
@@ -59,8 +61,10 @@ await repo.Remote.CreateRemoteBranchAsync(
             return 0;
         }
 
-        var sourceSha = await repo.Remote.GetRemoteBranchShaAsync(options.SourceBranch);
-        var targetSha = await repo.Remote.GetRemoteBranchShaAsync(options.TargetBranch);
+        var sourceSha = await repo.Remote.GetRemoteBranchShaAsync(options.SourceBranch)
+            ?? throw new Exception("Failed to get source branch SHA even though branch exists on remote.");
+        var targetSha = await repo.Remote.GetRemoteBranchShaAsync(options.TargetBranch)
+            ?? throw new Exception("Failed to get target branch SHA even though branch exists on remote.");
 
         // If both branches are at the same commit, then there is nothing to do.
         if (sourceSha == targetSha)
@@ -85,25 +89,22 @@ await repo.Remote.CreateRemoteBranchAsync(
         if (targetIsAncestorOfSource)
         {
             _logger.LogInformation(
-                "Branch {TargetBranch} is an ancestor of {SourceBranch}",
+                "Branch {TargetBranch} is an ancestor of {SourceBranch} - creating fast-forward PR",
                 options.TargetBranch, options.SourceBranch);
 
             // "ff" here is an abbreviation for "fast-forward" - just want to keep branch names short
-            var pullRequestBranch = GetPrBranchName(action: "ff", options);
-
-            var pullRequestCreationInfo = new PullRequestCreationInfo(
-                Title: $"Fast-forward {options.TargetBranch} to {options.SourceBranch}",
-                Body: "",
-                BaseBranch: options.TargetBranch,
-                HeadBranch: pullRequestBranch);
+            var fastForwardPrBranch = GetPrBranchName(action: "ff", options);
+            await repo.Remote.CreateRemoteBranchAsync(
+                newBranch: fastForwardPrBranch,
+                baseBranch: options.SourceBranch);
 
-            await repo.Remote.CreateRemoteBranchAsync(newBranch: pullRequestBranch, baseBranch: options.SourceBranch);
-            var pullRequestApiUrl = await repo.Remote.CreatePullRequestAsync(pullRequestCreationInfo);
-            var pullRequestInfo = await repo.Remote.GetPullRequestInfoAsync(pullRequestApiUrl);
+            await CreatePullRequest(
+                repo: repo,
+                title: $"Fast-forward {options.TargetBranch} to {options.SourceBranch}",
+                body: "",
+                targetBranch: options.TargetBranch,
+                sourceBranch: fastForwardPrBranch);
 
-            _logger.LogInformation(
-                "Created pull request {PrTitle} at {PrUrl}",
-                pullRequestInfo.Title, pullRequestApiUrl);
             return 0;
         }
 
@@ -111,7 +112,137 @@ await repo.Remote.CreateRemoteBranchAsync(
             "Branch {TargetBranch} is not an ancestor of {SourceBranch}",
             options.TargetBranch, options.SourceBranch);
 
-        throw new NotImplementedException("Scenario is not yet implemented.");
+        // If we reach this point, then we know that:
+        // 1. Both branches exist on the remote.
+        // 2. The branches are at different commits.
+        // 3. The branches have diverged.
+        //
+        // Now we need to:
+        // 1. Read the internal-versions.txt file from the target branch to determine the
+        //    staging pipeline run IDs that were used for each internal .NET version.
+        // 2. Reset the target branch to the state of the source branch.
+        // 3. Re-apply internal .NET version updates.
+
+        // At this point, we need to verify that we have everything we need to
+        // access internal builds, commit changes, and submit a pull request.
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.StagingStorageAccount);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.User);
+        ArgumentException.ThrowIfNullOrWhiteSpace(options.Email);
+        var commitAuthor = (Name: options.User, Email: options.Email);
+
+        // Checkout both branches locally so that we can work with them directly.
+        await repo.CheckoutRemoteBranchAsync(options.SourceBranch);
+        await repo.CheckoutRemoteBranchAsync(options.TargetBranch);
+
+        var internalBuilds = _internalVersionsService.GetInternalStagingBuilds(repo.Local.LocalPath);
+
+        // Reset the target branch to match the source branch.
+        var prBranchName = GetPrBranchName(action: "sync", options);
+        await repo.Local.CreateAndCheckoutLocalBranchAsync(prBranchName);
+        await repo.Local.RestoreAsync(source: sourceSha);
+        await repo.Local.StageAsync(".");
+        await repo.Local.CommitAsync(
+            message: $"Reset {options.TargetBranch} to match {options.SourceBranch} commit {sourceSha}",
+            author: commitAuthor);
+
+        // Re-apply internal .NET version updates for each recorded staging pipeline run ID.
+        foreach (var (dockerfileVersion, stagingPipelineRunId) in internalBuilds.Versions)
+        {
+            await ApplyInternalBuildAsync(
+                options: options,
+                localRepo: repo.Local,
+                stagingPipelineRunId: stagingPipelineRunId,
+                stagingStorageAccount: options.StagingStorageAccount,
+                committerIdentity: commitAuthor);
+        }
+
+        // Finally, submit a pull request with all of the changes.
+        await repo.PushLocalBranchAsync(prBranchName);
+        await CreatePullRequest(
+            repo: repo,
+            title: $"Sync {options.TargetBranch} with {options.SourceBranch}",
+            body: "",
+            targetBranch: options.TargetBranch,
+            sourceBranch: prBranchName);
+
+        return 0;
+    }
+
+    /// <summary>
+    /// Helper method that creates a pull request and logs the result.
+    /// </summary>
+    private async Task CreatePullRequest(
+        IGitRepoHelper repo,
+        string title,
+        string body,
+        string targetBranch,
+        string sourceBranch)
+    {
+        var pullRequestCreationInfo = new PullRequestCreationInfo(
+            Title: title,
+            Body: body,
+            BaseBranch: targetBranch,
+            HeadBranch: sourceBranch);
+
+        _logger.LogInformation("Creating pull request {PullRequestInfo}", pullRequestCreationInfo);
+        var pullRequestApiUrl = await repo.Remote.CreatePullRequestAsync(pullRequestCreationInfo);
+        var pullRequestInfo = await repo.Remote.GetPullRequestInfoAsync(pullRequestApiUrl);
+
+        _logger.LogInformation(
+            "Created pull request {PullRequestTitle} at {PullRequestUrl}",
+            pullRequestInfo.Title, pullRequestApiUrl);
+    }
+
+    /// <summary>
+    /// Apply an internal build by invoking the FromStagingPipelineCommand.
+    /// </summary>
+    /// <param name="stagingPipelineRunId">
+    /// ID of the Azure DevOps pipeline run to get build information from.
+    /// </param>
+    /// <param name="committerIdentity">
+    /// The identity to use when committing changes.
+    /// </param>
+    private async Task ApplyInternalBuildAsync(
+        SyncInternalReleaseOptions options,
+        ILocalGitRepoHelper localRepo,
+        int stagingPipelineRunId,
+        string stagingStorageAccount,
+        (string Name, string Email) committerIdentity)
+    {
+        // Example build URL: https://dev.azure.com/<org>/<project>/_build/results?buildId=<stagingPipelineRunId>
+        var buildUrl = $"{options.AzdoOrganization}/{options.AzdoProject}/_build/results?buildId={stagingPipelineRunId}";
+
+        _logger.LogInformation(
+            "Applying internal build {BuildNumber} ({BuildUrl})",
+            stagingPipelineRunId, buildUrl);
+        _logger.LogInformation(
+            "Ignore any git-related logging output below, because git "
+            + "operations are being managed by a different command.");
+
+        var fromStagingPipelineOptions = new FromStagingPipelineOptions
+        {
+            RepoRoot = localRepo.LocalPath,
+            Internal = true,
+            StagingPipelineRunId = stagingPipelineRunId,
+            StagingStorageAccount = stagingStorageAccount,
+            AzdoOrganization = options.AzdoOrganization,
+            AzdoProject = options.AzdoProject,
+            AzdoRepo = options.AzdoRepo,
+        };
+
+        var exitCode = await _updateFromStagingPipeline.ExecuteAsync(fromStagingPipelineOptions);
+        if (exitCode != 0)
+        {
+            throw new InvalidOperationException(
+                $"Failed to apply internal build {stagingPipelineRunId}. Command exited with code {exitCode}.");
+        }
+
+        _logger.LogInformation(
+            "Finished applying internal build {BuildNumber} ({BuildUrl})",
+            stagingPipelineRunId, buildUrl);
+
+        await localRepo.StageAsync(".");
+        await localRepo.CommitAsync($"Update dependencies from build {stagingPipelineRunId}", committerIdentity);
     }
 
     private static string GetPrBranchName(string action, SyncInternalReleaseOptions options)
diff --git a/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs b/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs
index b867ea274a..4f5b4cb455 100644
--- a/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs
+++ b/eng/update-dependencies/Sync/SyncInternalReleaseOptions.cs
@@ -1,39 +1,27 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
-using System.Collections.Generic;
 using System.CommandLine;
 
 namespace Dotnet.Docker.Sync;
 
-public sealed record SyncInternalReleaseOptions : IOptions
+public sealed record SyncInternalReleaseOptions : CreatePullRequestOptions, IOptions
 {
-    public string RemoteUrl { get; set; } = string.Empty;
-    public string SourceBranch { get; set; } = string.Empty;
-    public string TargetBranch { get; set; } = string.Empty;
     public string PrBranchPrefix { get; set; } = "pr";
+    public string StagingStorageAccount { get; set; } = string.Empty;
 
-    public static List<Option> Options =>
+    public static new List<Option> Options =>
     [
         new Option<string>("--pr-branch-prefix")
         {
             Description = "Prefix to use for branches created for pull requests",
-        }
+        },
+        FromStagingPipelineOptions.StagingStorageAccountOption,
+        ..CreatePullRequestOptions.Options,
     ];
 
-    public static List<Argument> Arguments =>
+    public static new List<Argument> Arguments =>
     [
-        new Argument<string>("remote-url")
-        {
-            Description = "The URL of the remote git repository to sync (e.g., https://dev.azure.com/org/project/_git/repo)"
-        },
-        new Argument<string>("source-branch")
-        {
-            Description = "The source branch to sync from (typically a release/* branch)"
-        },
-        new Argument<string>("target-branch")
-        {
-            Description = "The target branch to sync to (typically an internal/release/* branch)"
-        },
+        ..CreatePullRequestOptions.Arguments,
     ];
 }
diff --git a/eng/update-dependencies/VariableUpdaterBase.cs b/eng/update-dependencies/VariableUpdaterBase.cs
index d50aa2a2de..e2f9721476 100644
--- a/eng/update-dependencies/VariableUpdaterBase.cs
+++ b/eng/update-dependencies/VariableUpdaterBase.cs
@@ -12,10 +12,10 @@ internal abstract class VariableUpdaterBase : FileRegexUpdater
     protected string VariableName { get; }
     protected Lazy<JObject> ManifestVariables { get; }
 
-    public VariableUpdaterBase(string repoRoot, string variableName)
+    public VariableUpdaterBase(string manifestVersionsFilePath, string variableName)
     {
         VariableName = variableName;
-        Path = System.IO.Path.Combine(repoRoot, SpecificCommand.VersionsFilename);
+        Path = manifestVersionsFilePath;
         VersionGroupName = "val";
         Regex = ManifestHelper.GetManifestVariableRegex(variableName, @$"(?<{VersionGroupName}>\S*)");
 
@@ -23,10 +23,10 @@ public VariableUpdaterBase(string repoRoot, string variableName)
             () =>
             {
                 const string VariablesProperty = "variables";
-                JToken? variables = ManifestHelper.LoadManifest(SpecificCommand.VersionsFilename)[VariablesProperty];
+                JToken? variables = ManifestHelper.LoadManifest(manifestVersionsFilePath)[VariablesProperty];
                 if (variables is null)
                 {
-                    throw new InvalidOperationException($"'{VariablesProperty}' property missing in '{SpecificCommand.VersionsFilename}'");
+                    throw new InvalidOperationException($"'{VariablesProperty}' property missing in '{manifestVersionsFilePath}'");
                 }
                 return (JObject)variables;
             });
diff --git a/eng/update-dependencies/VersionUpdater.cs b/eng/update-dependencies/VersionUpdater.cs
index cc318b4d6a..131dec8179 100644
--- a/eng/update-dependencies/VersionUpdater.cs
+++ b/eng/update-dependencies/VersionUpdater.cs
@@ -23,7 +23,7 @@ public class VersionUpdater : FileRegexUpdater
         private readonly SpecificCommandOptions _options;
         private readonly VersionType _versionType;
 
-        public VersionUpdater(VersionType versionType, string productName, string dockerfileVersion, string repoRoot, SpecificCommandOptions options)
+        public VersionUpdater(VersionType versionType, string productName, string dockerfileVersion, SpecificCommandOptions options)
         {
             _productName = productName;
             _options = options;
@@ -32,7 +32,7 @@ public VersionUpdater(VersionType versionType, string productName, string docker
 
             Trace.TraceInformation($"Updating {versionVariableName}");
 
-            Path = System.IO.Path.Combine(repoRoot, SpecificCommand.VersionsFilename);
+            Path = options.GetManifestVersionsFilePath();
             VersionGroupName = s_versionGroupName;
             Regex = GetVersionVariableRegex(versionVariableName);
         }
diff --git a/eng/update-dependencies/update-dependencies.csproj b/eng/update-dependencies/update-dependencies.csproj
index 948948c2e7..aaf2315d41 100644
--- a/eng/update-dependencies/update-dependencies.csproj
+++ b/eng/update-dependencies/update-dependencies.csproj
@@ -9,6 +9,12 @@
     <RootNamespace>Dotnet.Docker</RootNamespace>
   </PropertyGroup>
 
+  <ItemGroup>
+    <InternalsVisibleTo Include="UpdateDependencies.Tests" />
+    <!-- Allows Moq to create mocks of internal types -->
+    <InternalsVisibleTo Include="DynamicProxyGenAssembly2" />
+  </ItemGroup>
+
   <ItemGroup>
     <PackageReference Include="Azure.Identity" Version="1.14.2" />
     <PackageReference Include="Azure.Storage.Blobs" Version="12.24.0" />
diff --git a/manifest.versions.json b/manifest.versions.json
index c108bd27f1..9630e112ae 100644
--- a/manifest.versions.json
+++ b/manifest.versions.json
@@ -1,5 +1,7 @@
 {
   "variables": {
+    "branch": "nightly",
+
     "base-url|public|maintenance|main": "https://builds.dotnet.microsoft.com/dotnet",
     "base-url|public|maintenance|nightly": "https://builds.dotnet.microsoft.com/dotnet",
     "base-url|public|preview|main": "https://builds.dotnet.microsoft.com/dotnet",
diff --git a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
index 9dcd3584f9..62dd13de09 100644
--- a/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
+++ b/tests/UpdateDependencies.Tests/SyncInternalReleaseTests.cs
@@ -1,6 +1,8 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System.Collections.Immutable;
+using Dotnet.Docker;
 using Dotnet.Docker.Git;
 using Dotnet.Docker.Sync;
 using Microsoft.DotNet.DarcLib;
@@ -12,10 +14,12 @@ public sealed class SyncInternalReleaseTests
 {
     private const string ReleaseBranch = "release/1";
     private const string InternalReleaseBranch = $"internal/{ReleaseBranch}";
-    private const string AzdoOrg = "test-org";
+    private const string AzdoOrgName = "test-org";
+    private const string AzdoOrgUrl = $"https://dev.azure.com/{AzdoOrgName}";
     private const string AzdoProject = "test-project";
     private const string AzdoRepo = "test-repo";
-    private const string RemoteAzdoUrl = $"https://dev.azure.com/{AzdoOrg}/{AzdoProject}/_git/{AzdoRepo}";
+    private const string RemoteAzdoUrl = $"{AzdoOrgUrl}/{AzdoProject}/_git/{AzdoRepo}";
+    private const string LocalRepoPath = "/path/to/local-repo";
 
     /// <summary>
     /// Default set of command options with some correct values. These can be used in most tests.
@@ -24,7 +28,9 @@ public sealed class SyncInternalReleaseTests
     /// </summary>
     private static readonly SyncInternalReleaseOptions s_defaultOptions = new()
     {
-        RemoteUrl = RemoteAzdoUrl,
+        AzdoOrganization = AzdoOrgUrl,
+        AzdoProject = AzdoProject,
+        AzdoRepo = AzdoRepo,
         SourceBranch = ReleaseBranch,
         TargetBranch = InternalReleaseBranch
     };
@@ -37,14 +43,14 @@ public async Task WhitespaceArgumentsFails()
     {
         var options = new SyncInternalReleaseOptions
         {
-            RemoteUrl = "   ",
+            AzdoOrganization = "   ",
+            AzdoProject = "   ",
+            AzdoRepo = "   ",
             SourceBranch = "   ",
             TargetBranch = "   "
         };
 
-        var command = new SyncInternalReleaseCommand(
-            Mock.Of<IGitRepoHelperFactory>(),
-            Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+        var command = CreateCommand();
 
         await Should.ThrowAsync<ArgumentException>(() => command.ExecuteAsync(options));
     }
@@ -59,9 +65,7 @@ public async Task InternalSourceBranchFails()
     {
         var options = s_defaultOptions with { SourceBranch = "internal/foo" };
 
-        var command = new SyncInternalReleaseCommand(
-            Mock.Of<IGitRepoHelperFactory>(),
-            Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+        var command = CreateCommand();
 
         await Should.ThrowAsync<InvalidBranchException>(() => command.ExecuteAsync(options));
     }
@@ -77,7 +81,7 @@ public async Task CreateInternalBranch()
 
         var repoMock = new Mock<IGitRepoHelper>();
         var repoFactoryMock = new Mock<IGitRepoHelperFactory>();
-        repoFactoryMock.Setup(f => f.CreateAsync(options.RemoteUrl)).ReturnsAsync(repoMock.Object);
+        repoFactoryMock.Setup(f => f.CreateAsync(options.GetAzdoRepoUrl())).ReturnsAsync(repoMock.Object);
 
         // Setup:
         // Target branch does not exist on remote
@@ -85,9 +89,7 @@ public async Task CreateInternalBranch()
         // Source branch exists on remote
         repoMock.Setup(r => r.Remote.RemoteBranchExistsAsync(options.SourceBranch)).ReturnsAsync(true);
 
-        var command = new SyncInternalReleaseCommand(
-            repoFactoryMock.Object,
-            Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+        var command = CreateCommand(repoFactory: repoFactoryMock.Object);
 
         var exitCode = await command.ExecuteAsync(options);
         exitCode.ShouldBe(0);
@@ -109,7 +111,7 @@ public async Task AlreadyUpToDate()
         // not explicitly set up in this test.
         var repoMock = new Mock<IGitRepoHelper>(MockBehavior.Strict);
         var repoFactoryMock = new Mock<IGitRepoHelperFactory>();
-        repoFactoryMock.Setup(f => f.CreateAsync(options.RemoteUrl)).ReturnsAsync(repoMock.Object);
+        repoFactoryMock.Setup(f => f.CreateAsync(options.GetAzdoRepoUrl())).ReturnsAsync(repoMock.Object);
 
         // Setup: Both target and source branches exist on remote.
         repoMock.Setup(r => r.Remote.RemoteBranchExistsAsync(options.TargetBranch)).ReturnsAsync(true);
@@ -120,9 +122,7 @@ public async Task AlreadyUpToDate()
         repoMock.Setup(r => r.Remote.GetRemoteBranchShaAsync(options.SourceBranch)).ReturnsAsync(Sha);
         repoMock.Setup(r => r.Dispose());
 
-        var command = new SyncInternalReleaseCommand(
-            repoFactoryMock.Object,
-            Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+        var command = CreateCommand(repoFactory: repoFactoryMock.Object);
 
         // Command should succeed.
         var exitCode = await command.ExecuteAsync(options);
@@ -148,7 +148,7 @@ public async Task FastForward()
         repoMock.Setup(r => r.Remote).Returns(remoteRepoMock.Object);
 
         var repoFactoryMock = new Mock<IGitRepoHelperFactory>();
-        repoFactoryMock.Setup(f => f.CreateAsync(options.RemoteUrl)).ReturnsAsync(repoMock.Object);
+        repoFactoryMock.Setup(f => f.CreateAsync(options.GetAzdoRepoUrl())).ReturnsAsync(repoMock.Object);
 
         // Setup: Both target and source branches exist on remote.
         repoMock.Setup(r => r.Remote.RemoteBranchExistsAsync(options.TargetBranch)).ReturnsAsync(true);
@@ -170,9 +170,7 @@ public async Task FastForward()
             .Setup(r => r.GetPullRequestInfoAsync(It.IsAny<string>()))
             .ReturnsAsync(Mock.Of<PullRequest>());
 
-        var command = new SyncInternalReleaseCommand(
-            repoFactoryMock.Object,
-            Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+        var command = CreateCommand(repoFactory: repoFactoryMock.Object);
 
         // Command should succeed.
         var exitCode = await command.ExecuteAsync(options);
@@ -188,4 +186,171 @@ public async Task FastForward()
             Times.Once
         );
     }
+
+    /// <summary>
+    /// If the target and source branches have diverged, then a pull request
+    /// should be created that resets the target branch to match the source
+    /// branch, re-applying any internal .NET version updates that already
+    /// existed on the target branch.
+    /// </summary>
+    [Fact]
+    public async Task Sync()
+    {
+        var options = s_defaultOptions with
+        {
+            User = "Test User",
+            Email = "test@example.com",
+            StagingStorageAccount = "dotnetstage"
+        };
+
+        // Target and source branches both exist, but at different commits,
+        // and the target branch is not an ancestor of the source branch.
+        var gitScenario = new GitTestScenario(localRepoPath: LocalRepoPath, remoteRepoUrl: RemoteAzdoUrl)
+            .AddRemoteBranch(options.SourceBranch, "0000000000000000000000000000000000000001")
+            .AddRemoteBranch(options.TargetBranch, "0000000000000000000000000000000000000002");
+
+        // Actual value of the pull request URL is not important here, just that we allow one to
+        // be created and pretend it exists afterwards.
+        const string PullRequestUrl = nameof(PullRequestUrl);
+        var pullRequestIsCreated = false;
+        gitScenario.RepoMock
+            .Setup(repo => repo.Remote.CreatePullRequestAsync(It.IsAny<PullRequestCreationInfo>()))
+            .Callback(() => pullRequestIsCreated = true)
+            .ReturnsAsync(PullRequestUrl);
+        gitScenario.RepoMock
+            .Setup(repo => repo.Remote.GetPullRequestInfoAsync(PullRequestUrl))
+            .ReturnsAsync(() => pullRequestIsCreated
+                ? Mock.Of<PullRequest>()
+                : throw new Exception($"PR {PullRequestUrl} was not created first"));
+
+        // For this scenario, two internal versions have been checked in to this repo.
+        var internalVersions = new Dictionary<string, int> { { "8.0", 8000000 }, { "10.0", 1000000 } };
+        var internalVersionsService = CreateInternalVersionsService(LocalRepoPath, internalVersions);
+
+        var fromStagingPipelineCommandMock = new Mock<ICommand<FromStagingPipelineOptions>>();
+
+        var syncCommand = CreateCommand(
+            repoFactory: gitScenario.RepoFactoryMock.Object,
+            fromStagingPipelineCommand: fromStagingPipelineCommandMock.Object,
+            internalVersionsService: internalVersionsService);
+
+        // Run the command
+        var exitCode = await syncCommand.ExecuteAsync(options);
+        exitCode.ShouldBe(0);
+
+        // Verify that we re-applied all internal versions by calling the downstream command.
+        foreach ((string dotnetVersion, int buildId) in internalVersions)
+        {
+            fromStagingPipelineCommandMock.Verify(command =>
+                command.ExecuteAsync(It.Is<FromStagingPipelineOptions>(o =>
+                    o.RepoRoot == LocalRepoPath
+                    && o.StagingPipelineRunId == buildId
+                    && o.StagingStorageAccount == options.StagingStorageAccount
+                )),
+                Times.Once
+            );
+        }
+
+        // Verify that we created the expected number of commits.
+        // There should be one commit for resetting the target branch to match
+        // the source branch, and then one commit for each internal version
+        // that was re-applied.
+        var numberOfCommits = 1 + internalVersions.Count;
+        gitScenario.RepoMock.Verify(
+            repo => repo.Local.CommitAsync(
+                It.IsAny<string>(),
+                It.Is<(string Name, string Email)>(
+                    author => author.Name == options.User && author.Email == options.Email
+                )
+            ),
+            Times.Exactly(numberOfCommits)
+        );
+
+        // Verify that we pushed the updated target branch.
+        gitScenario.RepoMock.Verify(repo => repo.PushLocalBranchAsync(It.IsAny<string>()), Times.Once());
+
+        // Verify that we created exactly one pull request.
+        gitScenario.RepoMock.Verify(
+            repo => repo.Remote.CreatePullRequestAsync(
+                It.Is<PullRequestCreationInfo>(
+                    pr => pr.HeadBranch != options.SourceBranch && pr.BaseBranch == options.TargetBranch
+                )
+            ),
+            Times.Once()
+        );
+    }
+
+    /// <summary>
+    /// Helper method to create a <see cref="SyncInternalReleaseCommand"/> instance with optional
+    /// mocked dependencies. If dependencies are not provided, default mocks will be used.
+    /// </summary>
+    private SyncInternalReleaseCommand CreateCommand(
+        IGitRepoHelperFactory? repoFactory = null,
+        ICommand<FromStagingPipelineOptions>? fromStagingPipelineCommand = null,
+        IInternalVersionsService? internalVersionsService = null,
+        ILogger<SyncInternalReleaseCommand>? logger = null) =>
+            // New parameters should be null by default and initialized with mocks if not specified.
+            new(repoFactory ?? Mock.Of<IGitRepoHelperFactory>(),
+                fromStagingPipelineCommand ?? Mock.Of<ICommand<FromStagingPipelineOptions>>(),
+                internalVersionsService ?? Mock.Of<IInternalVersionsService>(),
+                logger ?? Mock.Of<ILogger<SyncInternalReleaseCommand>>());
+
+    /// <summary>
+    /// Helper method to create a mock version of <see cref="IInternalVersionsService"/>
+    /// </summary>
+    private static IInternalVersionsService CreateInternalVersionsService(
+        string repoPath, Dictionary<string, int> versions)
+    {
+        var internalStagingBuilds = new InternalStagingBuilds(versions.ToImmutableDictionary());
+
+        var mock = new Mock<IInternalVersionsService>();
+        mock.Setup(s => s.GetInternalStagingBuilds(repoPath))
+            .Returns(internalStagingBuilds);
+
+        return mock.Object;
+    }
+
+    /// <summary>
+    /// Helper class for setting up scenarios on a <see cref="IGitRepoHelper"/> mock.
+    /// </summary>
+    private class GitTestScenario
+    {
+        public Mock<IGitRepoHelper> RepoMock { get; } = new();
+
+        /// <summary>
+        /// Factory that returns <see cref="RepoMock"/> when
+        /// <see cref="IGitRepoHelperFactory.CreateAsync"/> is called.
+        /// </summary>
+        public Mock<IGitRepoHelperFactory> RepoFactoryMock { get; } = new();
+
+        /// <summary>
+        /// Create a new scenario for the given local and remote repos.
+        /// </summary>
+        public GitTestScenario(string localRepoPath, string remoteRepoUrl)
+        {
+            RepoMock.Setup(r => r.Local.LocalPath).Returns(localRepoPath);
+            RepoFactoryMock.Setup(f => f.CreateAsync(remoteRepoUrl)).ReturnsAsync(RepoMock.Object);
+        }
+
+        /// <summary>
+        /// Pretend that a branch exists on the remote with the given name and commit SHA.
+        /// </summary>
+        public GitTestScenario AddRemoteBranch(string branchName, string commitSha)
+        {
+            RepoMock.Setup(r => r.Remote.RemoteBranchExistsAsync(branchName)).ReturnsAsync(true);
+            RepoMock.Setup(r => r.Remote.GetRemoteBranchShaAsync(branchName)).ReturnsAsync(commitSha);
+            return this;
+        }
+
+        /// <summary>
+        /// Declare that <paramref name="ancestorBranch"/> is an ancestor of
+        /// <paramref name="descendantBranch"/>.
+        /// </summary>
+        public GitTestScenario SetAncestor(string descendantBranch, string ancestorBranch)
+        {
+            RepoMock.Setup(r => r.Local.IsAncestorAsync($"origin/{ancestorBranch}", $"origin/{descendantBranch}"))
+                .ReturnsAsync(true);
+            return this;
+        }
+    }
 }