From f89bed9b1fc098f38311e83b589f99d8662060cd Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 19:05:58 +0000
Subject: [PATCH 1/7] Initial plan


From 36d3f2ef4803b523f48dc698c71019c10421920e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 19:09:08 +0000
Subject: [PATCH 2/7] Fix clean validation workflow failing due to az CLI
 azure-firewall extension change

Pre-install the azure-firewall extension explicitly and enable preview extension
dynamic install to fix checksum mismatch errors.

Closes #4971
---
 CHANGELOG.md                  | 1 +
 devops/scripts/control_tre.sh | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7666f07aa1..0f7c360d6c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ BUG FIXES:
 * Fix dependabot high moderate alerts for packages aiohttp and pytest, pytest-asyncio
 * Fix spelling in docs using codespell ([#4954](https://github.com/microsoft/AzureTRE/issues/4954))
 * Replace deprecated yaspell with codespell and add pre-commit hook installer to devcontainer. ([#4953](https://github.com/microsoft/AzureTRE/issues/4953))
+* Fix clean validation workflow failing due to azure-firewall extension checksum mismatch by pre-installing the extension explicitly ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
 
 ## (0.28.0) (March 2, 2026)
 **BREAKING CHANGES**
diff --git a/devops/scripts/control_tre.sh b/devops/scripts/control_tre.sh
index e2ae51214c..6d7287390e 100755
--- a/devops/scripts/control_tre.sh
+++ b/devops/scripts/control_tre.sh
@@ -23,6 +23,8 @@ if [[ $(az group list --output json --query "[?name=='${core_rg_name}'] | length
 fi
 
 az config set extension.use_dynamic_install=yes_without_prompt
+az config set extension.dynamic_install_allow_preview=true
+az extension add --name azure-firewall --allow-preview true --upgrade
 az --version
 
 if [[ "$1" == *"start"* ]]; then

From c0fd04d4ff7e35cb898751a77e4d39467b41a8da Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 19:29:54 +0000
Subject: [PATCH 3/7] Fix clean validation workflow by replacing az network
 firewall commands with az rest

The azure-firewall CLI extension has a persistent checksum mismatch that prevents
installation via both dynamic install and explicit az extension add. Eliminate the
extension dependency entirely by replacing all az network firewall commands with
direct ARM REST API calls using az rest.

Closes #4971
---
 CHANGELOG.md                  |  2 +-
 devops/scripts/control_tre.sh | 47 +++++++++++++++++++++++------------
 2 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f7c360d6c..8e939b5d0b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ BUG FIXES:
 * Fix dependabot high moderate alerts for packages aiohttp and pytest, pytest-asyncio
 * Fix spelling in docs using codespell ([#4954](https://github.com/microsoft/AzureTRE/issues/4954))
 * Replace deprecated yaspell with codespell and add pre-commit hook installer to devcontainer. ([#4953](https://github.com/microsoft/AzureTRE/issues/4953))
-* Fix clean validation workflow failing due to azure-firewall extension checksum mismatch by pre-installing the extension explicitly ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
+* Fix clean validation workflow failing due to azure-firewall extension checksum mismatch by replacing `az network firewall` extension commands with `az rest` ARM REST API calls, removing the extension dependency entirely ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
 
 ## (0.28.0) (March 2, 2026)
 **BREAKING CHANGES**
diff --git a/devops/scripts/control_tre.sh b/devops/scripts/control_tre.sh
index 6d7287390e..eca15b4f7e 100755
--- a/devops/scripts/control_tre.sh
+++ b/devops/scripts/control_tre.sh
@@ -23,22 +23,37 @@ if [[ $(az group list --output json --query "[?name=='${core_rg_name}'] | length
 fi
 
 az config set extension.use_dynamic_install=yes_without_prompt
-az config set extension.dynamic_install_allow_preview=true
-az extension add --name azure-firewall --allow-preview true --upgrade
 az --version
 
+SUBSCRIPTION_ID=$(az account show --query id -o tsv)
+FW_API_URL="https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${core_rg_name}/providers/Microsoft.Network/azureFirewalls/${fw_name}?api-version=2024-05-01"
+
 if [[ "$1" == *"start"* ]]; then
-  if [[ $(az network firewall list --output json --query "[?resourceGroup=='${core_rg_name}'&&name=='${fw_name}'] | length(@)") != 0 ]]; then
-    CURRENT_PUBLIC_IP=$(az network firewall ip-config list -f "${fw_name}" -g "${core_rg_name}" --query "[0].publicIpAddress" -o tsv)
-    if [ -z "$CURRENT_PUBLIC_IP" ]; then
-      FW_SKU_TIER=$(az network firewall show --n "${fw_name}" -g "${core_rg_name}" --query "sku.tier" -o tsv)
+  if FW_JSON=$(az rest --method get --url "${FW_API_URL}" --output json 2>/dev/null); then
+    CURRENT_PUBLIC_IP=$(echo "${FW_JSON}" | jq -r '.properties.ipConfigurations[0].properties.publicIPAddress.id // empty')
+    if [ -z "${CURRENT_PUBLIC_IP}" ]; then
+      FW_SKU_TIER=$(echo "${FW_JSON}" | jq -r '.properties.sku.tier')
+      VNET_SUBNET_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${core_rg_name}/providers/Microsoft.Network/virtualNetworks/${vnet_name}/subnets/AzureFirewallSubnet"
+      FW_PIP_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${core_rg_name}/providers/Microsoft.Network/publicIPAddresses/${fw_pip_name}"
       if [ "$FW_SKU_TIER" == "Basic" ]; then
         echo "Starting Firewall (Basic SKU) - creating ip-config and management-ip-config"
-        az network firewall ip-config create -f "${fw_name}" -g "${core_rg_name}" -n "fw-ip-configuration" --public-ip-address "${fw_pip_name}" --vnet-name "${vnet_name}" --m-name "fw-management-ip-configuration" --m-public-ip-address "pip-fw-management-$TRE_ID" --m-vnet-name "${vnet_name}"> /dev/null &
+        MGMT_PIP_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${core_rg_name}/providers/Microsoft.Network/publicIPAddresses/pip-fw-management-${TRE_ID}"
+        MGMT_SUBNET_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${core_rg_name}/providers/Microsoft.Network/virtualNetworks/${vnet_name}/subnets/AzureFirewallManagementSubnet"
+        UPDATED_FW=$(echo "${FW_JSON}" | jq -c \
+          --arg pip_id "${FW_PIP_ID}" \
+          --arg subnet_id "${VNET_SUBNET_ID}" \
+          --arg mgmt_pip_id "${MGMT_PIP_ID}" \
+          --arg mgmt_subnet_id "${MGMT_SUBNET_ID}" \
+          '.properties.ipConfigurations = [{"name": "fw-ip-configuration", "properties": {"publicIPAddress": {"id": $pip_id}, "subnet": {"id": $subnet_id}}}] |
+           .properties.managementIpConfiguration = {"name": "fw-management-ip-configuration", "properties": {"publicIPAddress": {"id": $mgmt_pip_id}, "subnet": {"id": $mgmt_subnet_id}}}')
       else
         echo "Starting Firewall - creating ip-config"
-        az network firewall ip-config create -f "${fw_name}" -g "${core_rg_name}" -n "fw-ip-configuration" --public-ip-address "${fw_pip_name}" --vnet-name "${vnet_name}" > /dev/null &
+        UPDATED_FW=$(echo "${FW_JSON}" | jq -c \
+          --arg pip_id "${FW_PIP_ID}" \
+          --arg subnet_id "${VNET_SUBNET_ID}" \
+          '.properties.ipConfigurations = [{"name": "fw-ip-configuration", "properties": {"publicIPAddress": {"id": $pip_id}, "subnet": {"id": $subnet_id}}}]')
       fi
+      az rest --method put --url "${FW_API_URL}" --body "${UPDATED_FW}" > /dev/null &
     else
       echo "Firewall ip-config already exists"
     fi
@@ -75,12 +90,12 @@ if [[ "$1" == *"start"* ]]; then
   # We don't start workspace VMs despite maybe stopping them because we don't know if they need to be on.
 
 elif [[ "$1" == *"stop"* ]]; then
-  if [[ $(az network firewall list --output json --query "[?resourceGroup=='${core_rg_name}'&&name=='${fw_name}'] | length(@)") != 0 ]]; then
-    IPCONFIG_NAME=$(az network firewall ip-config list -f "${fw_name}" -g "${core_rg_name}" --query "[0].name" -o tsv)
-
-    if [ -n "$IPCONFIG_NAME" ]; then
+  if FW_JSON=$(az rest --method get --url "${FW_API_URL}" --output json 2>/dev/null); then
+    FW_IPCONFIG=$(echo "${FW_JSON}" | jq -r '.properties.ipConfigurations[0].name // empty')
+    if [ -n "${FW_IPCONFIG}" ]; then
       echo "Deleting Firewall ip-config"
-      az network firewall update --name "${fw_name}" --resource-group "${core_rg_name}" --remove ipConfigurations --remove managementIpConfiguration &
+      UPDATED_FW=$(echo "${FW_JSON}" | jq -c '.properties.ipConfigurations = [] | del(.properties.managementIpConfiguration)')
+      az rest --method put --url "${FW_API_URL}" --body "${UPDATED_FW}" > /dev/null &
     else
       echo "No Firewall ip-config found"
     fi
@@ -131,9 +146,9 @@ wait
 
 # Report final FW status
 FW_STATE="Stopped"
-if [[ $(az network firewall list --output json --query "[?resourceGroup=='${core_rg_name}'&&name=='${fw_name}'] | length(@)") != 0 ]]; then
-  PUBLIC_IP=$(az network firewall ip-config list -f "${fw_name}" -g "${core_rg_name}" --query "[0].publicIpAddress" -o tsv)
-  if [ -n "$PUBLIC_IP" ]; then
+if FW_JSON=$(az rest --method get --url "${FW_API_URL}" --output json 2>/dev/null); then
+  PUBLIC_IP=$(echo "${FW_JSON}" | jq -r '.properties.ipConfigurations[0].properties.publicIPAddress.id // empty')
+  if [ -n "${PUBLIC_IP}" ]; then
     FW_STATE="Running"
   fi
 fi

From c1f4ab7f1dcad80e3faadd95ee12eb5f375574c4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 19:46:41 +0000
Subject: [PATCH 4/7] Fix az config checksum issue: replace az config set with
 AZURE_EXTENSION_USE_DYNAMIC_INSTALL env var

Revert az rest approach and restore az network firewall commands.
Replace az config set (experimental, causing checksum errors) with
AZURE_EXTENSION_USE_DYNAMIC_INSTALL environment variable instead.

Closes #4971
---
 CHANGELOG.md                  |  2 +-
 devops/scripts/control_tre.sh | 48 ++++++++++++-----------------------
 2 files changed, 17 insertions(+), 33 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8e939b5d0b..b5f5f867a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ BUG FIXES:
 * Fix dependabot high moderate alerts for packages aiohttp and pytest, pytest-asyncio
 * Fix spelling in docs using codespell ([#4954](https://github.com/microsoft/AzureTRE/issues/4954))
 * Replace deprecated yaspell with codespell and add pre-commit hook installer to devcontainer. ([#4953](https://github.com/microsoft/AzureTRE/issues/4953))
-* Fix clean validation workflow failing due to azure-firewall extension checksum mismatch by replacing `az network firewall` extension commands with `az rest` ARM REST API calls, removing the extension dependency entirely ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
+* Fix clean validation workflow failing due to `az config` checksum mismatch by replacing `az config set` with the `AZURE_EXTENSION_USE_DYNAMIC_INSTALL` environment variable ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
 
 ## (0.28.0) (March 2, 2026)
 **BREAKING CHANGES**
diff --git a/devops/scripts/control_tre.sh b/devops/scripts/control_tre.sh
index eca15b4f7e..d817766763 100755
--- a/devops/scripts/control_tre.sh
+++ b/devops/scripts/control_tre.sh
@@ -22,38 +22,22 @@ if [[ $(az group list --output json --query "[?name=='${core_rg_name}'] | length
   exit 0
 fi
 
-az config set extension.use_dynamic_install=yes_without_prompt
+export AZURE_EXTENSION_USE_DYNAMIC_INSTALL=yes_without_prompt
+az extension add --name azure-firewall --allow-preview true --upgrade
 az --version
 
-SUBSCRIPTION_ID=$(az account show --query id -o tsv)
-FW_API_URL="https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${core_rg_name}/providers/Microsoft.Network/azureFirewalls/${fw_name}?api-version=2024-05-01"
-
 if [[ "$1" == *"start"* ]]; then
-  if FW_JSON=$(az rest --method get --url "${FW_API_URL}" --output json 2>/dev/null); then
-    CURRENT_PUBLIC_IP=$(echo "${FW_JSON}" | jq -r '.properties.ipConfigurations[0].properties.publicIPAddress.id // empty')
-    if [ -z "${CURRENT_PUBLIC_IP}" ]; then
-      FW_SKU_TIER=$(echo "${FW_JSON}" | jq -r '.properties.sku.tier')
-      VNET_SUBNET_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${core_rg_name}/providers/Microsoft.Network/virtualNetworks/${vnet_name}/subnets/AzureFirewallSubnet"
-      FW_PIP_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${core_rg_name}/providers/Microsoft.Network/publicIPAddresses/${fw_pip_name}"
+  if [[ $(az network firewall list --output json --query "[?resourceGroup=='${core_rg_name}'&&name=='${fw_name}'] | length(@)") != 0 ]]; then
+    CURRENT_PUBLIC_IP=$(az network firewall ip-config list -f "${fw_name}" -g "${core_rg_name}" --query "[0].publicIpAddress" -o tsv)
+    if [ -z "$CURRENT_PUBLIC_IP" ]; then
+      FW_SKU_TIER=$(az network firewall show --n "${fw_name}" -g "${core_rg_name}" --query "sku.tier" -o tsv)
       if [ "$FW_SKU_TIER" == "Basic" ]; then
         echo "Starting Firewall (Basic SKU) - creating ip-config and management-ip-config"
-        MGMT_PIP_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${core_rg_name}/providers/Microsoft.Network/publicIPAddresses/pip-fw-management-${TRE_ID}"
-        MGMT_SUBNET_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${core_rg_name}/providers/Microsoft.Network/virtualNetworks/${vnet_name}/subnets/AzureFirewallManagementSubnet"
-        UPDATED_FW=$(echo "${FW_JSON}" | jq -c \
-          --arg pip_id "${FW_PIP_ID}" \
-          --arg subnet_id "${VNET_SUBNET_ID}" \
-          --arg mgmt_pip_id "${MGMT_PIP_ID}" \
-          --arg mgmt_subnet_id "${MGMT_SUBNET_ID}" \
-          '.properties.ipConfigurations = [{"name": "fw-ip-configuration", "properties": {"publicIPAddress": {"id": $pip_id}, "subnet": {"id": $subnet_id}}}] |
-           .properties.managementIpConfiguration = {"name": "fw-management-ip-configuration", "properties": {"publicIPAddress": {"id": $mgmt_pip_id}, "subnet": {"id": $mgmt_subnet_id}}}')
+        az network firewall ip-config create -f "${fw_name}" -g "${core_rg_name}" -n "fw-ip-configuration" --public-ip-address "${fw_pip_name}" --vnet-name "${vnet_name}" --m-name "fw-management-ip-configuration" --m-public-ip-address "pip-fw-management-$TRE_ID" --m-vnet-name "${vnet_name}"> /dev/null &
       else
         echo "Starting Firewall - creating ip-config"
-        UPDATED_FW=$(echo "${FW_JSON}" | jq -c \
-          --arg pip_id "${FW_PIP_ID}" \
-          --arg subnet_id "${VNET_SUBNET_ID}" \
-          '.properties.ipConfigurations = [{"name": "fw-ip-configuration", "properties": {"publicIPAddress": {"id": $pip_id}, "subnet": {"id": $subnet_id}}}]')
+        az network firewall ip-config create -f "${fw_name}" -g "${core_rg_name}" -n "fw-ip-configuration" --public-ip-address "${fw_pip_name}" --vnet-name "${vnet_name}" > /dev/null &
       fi
-      az rest --method put --url "${FW_API_URL}" --body "${UPDATED_FW}" > /dev/null &
     else
       echo "Firewall ip-config already exists"
     fi
@@ -90,12 +74,12 @@ if [[ "$1" == *"start"* ]]; then
   # We don't start workspace VMs despite maybe stopping them because we don't know if they need to be on.
 
 elif [[ "$1" == *"stop"* ]]; then
-  if FW_JSON=$(az rest --method get --url "${FW_API_URL}" --output json 2>/dev/null); then
-    FW_IPCONFIG=$(echo "${FW_JSON}" | jq -r '.properties.ipConfigurations[0].name // empty')
-    if [ -n "${FW_IPCONFIG}" ]; then
+  if [[ $(az network firewall list --output json --query "[?resourceGroup=='${core_rg_name}'&&name=='${fw_name}'] | length(@)") != 0 ]]; then
+    IPCONFIG_NAME=$(az network firewall ip-config list -f "${fw_name}" -g "${core_rg_name}" --query "[0].name" -o tsv)
+
+    if [ -n "$IPCONFIG_NAME" ]; then
       echo "Deleting Firewall ip-config"
-      UPDATED_FW=$(echo "${FW_JSON}" | jq -c '.properties.ipConfigurations = [] | del(.properties.managementIpConfiguration)')
-      az rest --method put --url "${FW_API_URL}" --body "${UPDATED_FW}" > /dev/null &
+      az network firewall update --name "${fw_name}" --resource-group "${core_rg_name}" --remove ipConfigurations --remove managementIpConfiguration &
     else
       echo "No Firewall ip-config found"
     fi
@@ -146,9 +130,9 @@ wait
 
 # Report final FW status
 FW_STATE="Stopped"
-if FW_JSON=$(az rest --method get --url "${FW_API_URL}" --output json 2>/dev/null); then
-  PUBLIC_IP=$(echo "${FW_JSON}" | jq -r '.properties.ipConfigurations[0].properties.publicIPAddress.id // empty')
-  if [ -n "${PUBLIC_IP}" ]; then
+if [[ $(az network firewall list --output json --query "[?resourceGroup=='${core_rg_name}'&&name=='${fw_name}'] | length(@)") != 0 ]]; then
+  PUBLIC_IP=$(az network firewall ip-config list -f "${fw_name}" -g "${core_rg_name}" --query "[0].publicIpAddress" -o tsv)
+  if [ -n "$PUBLIC_IP" ]; then
     FW_STATE="Running"
   fi
 fi

From 4c75f4be79e0fe60e3586a75469f8ec06255a071 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 19:47:13 +0000
Subject: [PATCH 5/7] Update CHANGELOG to mention azure-firewall extension
 installation and revert from az rest

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b5f5f867a3..776409cd17 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ BUG FIXES:
 * Fix dependabot high moderate alerts for packages aiohttp and pytest, pytest-asyncio
 * Fix spelling in docs using codespell ([#4954](https://github.com/microsoft/AzureTRE/issues/4954))
 * Replace deprecated yaspell with codespell and add pre-commit hook installer to devcontainer. ([#4953](https://github.com/microsoft/AzureTRE/issues/4953))
-* Fix clean validation workflow failing due to `az config` checksum mismatch by replacing `az config set` with the `AZURE_EXTENSION_USE_DYNAMIC_INSTALL` environment variable ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
+* Fix clean validation workflow by replacing `az config set` (experimental, causing checksum errors) with the `AZURE_EXTENSION_USE_DYNAMIC_INSTALL` environment variable and explicitly installing the `azure-firewall` extension via `az extension add` ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
 
 ## (0.28.0) (March 2, 2026)
 **BREAKING CHANGES**

From 7621973578f267b7263d3a54ce3d2cc811d5ac7e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 09:41:05 +0000
Subject: [PATCH 6/7] Pin Azure CLI version in clean_validation_envs.yml and
 revert control_tre.sh changes

The workflow was failing due to transient checksum errors from the unpinned
Azure CLI package being updated at runtime. Fix by pinning Azure CLI to 2.81.0
(matching the version used in other workflows like lets_encrypt.yml).

Revert all changes to control_tre.sh as they are no longer needed.

Closes #4971
---
 .github/workflows/clean_validation_envs.yml | 9 +++++++++
 CHANGELOG.md                                | 2 +-
 devops/scripts/control_tre.sh               | 3 +--
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/clean_validation_envs.yml b/.github/workflows/clean_validation_envs.yml
index 4069d1dc4c..162d5f8c39 100644
--- a/.github/workflows/clean_validation_envs.yml
+++ b/.github/workflows/clean_validation_envs.yml
@@ -28,6 +28,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Install specific Azure CLI version
+        run: |
+          AZ_DIST=$(lsb_release -cs)
+          AZ_VER=2.81.0
+
+          apt-cache policy azure-cli
+          sudo apt-get install azure-cli="${AZ_VER}-1~${AZ_DIST}" --allow-downgrades
+          az version
+
       - name: Azure Login
         uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
         with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 776409cd17..83cfbd8364 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ BUG FIXES:
 * Fix dependabot high moderate alerts for packages aiohttp and pytest, pytest-asyncio
 * Fix spelling in docs using codespell ([#4954](https://github.com/microsoft/AzureTRE/issues/4954))
 * Replace deprecated yaspell with codespell and add pre-commit hook installer to devcontainer. ([#4953](https://github.com/microsoft/AzureTRE/issues/4953))
-* Fix clean validation workflow by replacing `az config set` (experimental, causing checksum errors) with the `AZURE_EXTENSION_USE_DYNAMIC_INSTALL` environment variable and explicitly installing the `azure-firewall` extension via `az extension add` ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
+* Fix clean validation workflow by pinning the Azure CLI version to avoid transient checksum errors from unpinned Azure CLI packages ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
 
 ## (0.28.0) (March 2, 2026)
 **BREAKING CHANGES**
diff --git a/devops/scripts/control_tre.sh b/devops/scripts/control_tre.sh
index d817766763..e2ae51214c 100755
--- a/devops/scripts/control_tre.sh
+++ b/devops/scripts/control_tre.sh
@@ -22,8 +22,7 @@ if [[ $(az group list --output json --query "[?name=='${core_rg_name}'] | length
   exit 0
 fi
 
-export AZURE_EXTENSION_USE_DYNAMIC_INSTALL=yes_without_prompt
-az extension add --name azure-firewall --allow-preview true --upgrade
+az config set extension.use_dynamic_install=yes_without_prompt
 az --version
 
 if [[ "$1" == *"start"* ]]; then

From 29ae0257d30eed76ffb6872b71fc584edfcea71d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 09:41:39 +0000
Subject: [PATCH 7/7] Fix CHANGELOG capitalization

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 83cfbd8364..bd43b24abf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ BUG FIXES:
 * Fix dependabot high moderate alerts for packages aiohttp and pytest, pytest-asyncio
 * Fix spelling in docs using codespell ([#4954](https://github.com/microsoft/AzureTRE/issues/4954))
 * Replace deprecated yaspell with codespell and add pre-commit hook installer to devcontainer. ([#4953](https://github.com/microsoft/AzureTRE/issues/4953))
-* Fix clean validation workflow by pinning the Azure CLI version to avoid transient checksum errors from unpinned Azure CLI packages ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
+* Fix Clean Validation workflow by pinning the Azure CLI version to avoid transient checksum errors from unpinned Azure CLI packages ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
 
 ## (0.28.0) (March 2, 2026)
 **BREAKING CHANGES**