diff --git a/.azure-devops/azure-pipelines.yml b/.azure-devops/azure-pipelines.yml
index 24c974b70..6ee7cb6db 100644
--- a/.azure-devops/azure-pipelines.yml
+++ b/.azure-devops/azure-pipelines.yml
@@ -203,8 +203,18 @@ jobs:
       env:
         IMAGE_TAG: $(IMAGE_TAG)
 
-    - script: skopeo --version
-      displayName: Skopeo version
+    # This can be omitted once runner images have a version of Skopeo > 1.4.1
+    - script: |
+        sudo apt purge buildah golang-github-containers-common podman skopeo
+        sudo apt autoremove --purge
+        REPO_URL="https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/unstable"
+        source /etc/os-release
+        sudo sh -c "echo 'deb ${REPO_URL}/x${NAME}_${VERSION_ID}/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:unstable.list"
+        sudo wget -qnv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/x${NAME}_${VERSION_ID}/Release.key -O Release.key
+        sudo apt-key add Release.key
+        sudo apt-get update
+        sudo apt-get install skopeo
+      displayName: Update skopeo
 
 
     - script: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index eb0787d29..d9e4c2e6b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -30,7 +30,7 @@ Additionally, it is desirable to add new tests to cover any new functionality.
 
 When a PR is created, some tests will be automatically triggered against the PR. The full suite of tests requires secrets and needs to be triggered by a maintainer.
 
-Testing and publishing the AzDO task requires the `AZDO_TOKEN` GitHub secret to be an AzDO PAT for monacotools with Build Read & Execute, Marketplace Publish and Packing Read & Write permissions.
+Testing and publishing the AzDO task requires the `AZDO_TOKEN` GitHub secret to be an AzDO PAT for monacotools with Build Read & Execute, Marketplace Acquire & Manage, Extensions Read & Manage and Packing Read & Write permissions.
 
 ## Miscellaneous
 
diff --git a/scripts/test-azdo.sh b/scripts/test-azdo.sh
index 4f0045304..5a9649577 100755
--- a/scripts/test-azdo.sh
+++ b/scripts/test-azdo.sh
@@ -16,8 +16,11 @@ echo "Using VSIX_FILE=$vsix_file"
 echo "Publishing private extension version..."
 tfx extension publish  --token "$AZDO_TOKEN" --vsix "$vsix_file" --override "{\"public\": false, \"publisher\": \"devcontainers-dev\"}" --share-with monacotools
 
+echo "Uninstalling private extension"
+tfx extension uninstall --token "$AZDO_TOKEN" --service-url "$AZDO_ORG" --extension-id "ci" --publisher "devcontainers-dev" || true
+
 echo "Installing private extension"
-tfx extension install  --token "$AZDO_TOKEN" --vsix "$vsix_file" --service-url "$AZDO_ORG"
+tfx extension install --token "$AZDO_TOKEN" --vsix "$vsix_file" --service-url "$AZDO_ORG"
 
 sleep 30s # hacky workaround for AzDO picking up stale extension version