diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 924a70b4..6ee2ea3c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -34,6 +34,13 @@ jobs:
         with:
           node-version: 16.x
 
+      # On new macos-latest machines, Python 3.9+ is used, and it's causing issues with binding.gyp
+      - name: Use Python 3.8
+        if: ${{ matrix.os == 'macos-latest' }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.8
+
       - name: Windows setup
         if: ${{ matrix.os == 'windows-latest' }}
         run: |
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index 741b5c62..0984f1b0 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -53,6 +53,12 @@ extends:
       name: VSEngSS-MicroBuild2022-1ES
     sdl:
       sourceAnalysisPool: VSEngSS-MicroBuild2022-1ES
+      tsa:
+        enabled: true
+        GdnPublishTsaOnboard: true
+        GdnPublishTsaConfigFile: $(Build.SourcesDirectory)\build\tsa.gdntsa
+      policheck:
+        enabled: true
       spotBugs:
         enabled: false # Turn this off, this isn't java.
     customBuildTags:
diff --git a/build/build.yml b/build/build.yml
index 020385d7..396e6d3f 100644
--- a/build/build.yml
+++ b/build/build.yml
@@ -13,14 +13,6 @@ jobs:
   variables:
     TeamName: C++ Cross Platform and Cloud
   templateContext:
-    sdl:
-    ${{ if ne(variables['Build.Reason'], 'PullRequest') }}:
-      tsa:
-        enabled: true
-        GdnPublishTsaOnboard: true
-        GdnPublishTsaConfigFile: $(Build.SourcesDirectory)\build\tsa.gdntsa
-      policheck:
-        enabled: true
     outputs:
     - output: pipelineArtifact
       displayName: 'Publish extension VSIXes as artifact'