diff --git a/windows-release/stage-publish-store.yml b/windows-release/stage-publish-store.yml
index e342a18a..5dabcfd7 100644
--- a/windows-release/stage-publish-store.yml
+++ b/windows-release/stage-publish-store.yml
@@ -9,6 +9,9 @@ jobs:
   pool:
     vmImage: windows-2022
 
+  variables:
+  - group: MSFTStorePublish
+
   workspace:
     clean: all
 
@@ -34,6 +37,59 @@ jobs:
         artifactName: msixupload
         downloadPath: $(Build.BinariesDirectory)
 
-  # TODO: do publish step
-  # If we are *not* real-signed, DO NOT PUBLISH
-  # condition: and(succeeded(), eq(variables['IsRealSigned'], 'true'))
+  - task: UseDotNet@2
+    displayName: Setup .NET Runtime
+    inputs:
+      packageType: runtime
+
+  - task: UseMSStoreCLI@0
+    displayName: Setup Microsoft Store Developer CLI
+
+  - powershell: >
+      msstore
+      reconfigure
+      --tenantId $(MSSTORE_TENANT_ID)
+      --sellerId $(MSSTORE_SELLER_ID)
+      --clientId $(MSSTORE_CLIENT_ID)
+      --clientSecret $(MSSTORE_CLIENT_SECRET)
+    displayName: Configure Microsoft Store Developer CLI
+
+  - powershell: |
+      dir *.msix, *.msixupload | `
+      %{ if ($_ -match 'python-(\d+\.\d+).+') { $Matches[1] } } | `
+      ?{ $_ } | `
+      select -Unique | `
+      %{
+        $id = @{
+          '3.13'='9PNRBTZXMB4Z';
+          '3.12'='9NCVDN91XZQP';
+          '3.11'='9NRWMJP3717K';
+          '3.10'='9PJPW5LDXLZ5';
+          '3.9'='9P7QFQMJRFP7';
+          '3.8'='9MSSZTT1N39L';
+        }[$_];
+        @{
+          files = (dir "python-$_*.msix", "python-$_*.msixupload").FullName;
+          product = "Python $_";
+          id = $id;
+          current = ConvertFrom-Json (msstore submission get -v $id);
+          meta = ConvertFrom-Json (msstore submission getlistingassets -v $id);
+        }
+      } | `
+      ?{ $_.id } | `
+      %{
+        Write-Host "Generating publish file for $($_.product) ($($_.id))"
+        $p1 = ConvertTo-Json $_.current -Compress
+        $p2 = ConvertTo-Json $_.meta -Compress
+        # If we are *not* real-signed, DO NOT PUBLISH
+        if ($env:IsRealSigned -eq 'true') {
+          msstore submission update -v $_.id $p1
+          msstore submission updatemetadata -v $_.id $p2
+        } else {
+          Write-Host "Skipping publish of $($_.id)"
+          Write-Verbose "msstore submission update -v $_.id $p1"
+          Write-Verbose "msstore submission updatemetadata -v $_.id $p2"
+        }
+      }
+    displayName: Publish Store package update
+    workingDirectory: $(Build.BinariesDirectory)/msixupload
diff --git a/windows-release/tcltk-build.yml b/windows-release/tcltk-build.yml
index 95a5d771..4ac418a2 100644
--- a/windows-release/tcltk-build.yml
+++ b/windows-release/tcltk-build.yml
@@ -5,6 +5,10 @@ parameters:
 - name: TkSourceTag
   displayName: 'Tk Source Tag'
   type: string
+- name: IncludeTix
+  displayName: 'Include Tix (pre-3.13)'
+  type: boolean
+  default: false
 - name: TixSourceTag
   displayName: 'Tix Source Tag'
   type: string
@@ -35,7 +39,8 @@ resources:
 
 
 variables:
-- group: CPythonSign
+- ${{ if ne(parameters.SigningCertificate, 'Unsigned') }}:
+  - group: CPythonSign
 - name: IntDir
   value: '$(Build.BinariesDirectory)\obj'
 - name: ExternalsDir
@@ -78,9 +83,10 @@ jobs:
         git clone $(SourcesRepo) -b $(TkSourceTag) --depth 1 "$(ExternalsDir)\$(TkSourceTag)"
       displayName: 'Check out Tk sources'
 
-    - powershell: |
-        git clone $(SourcesRepo) -b $(TixSourceTag) --depth 1 "$(ExternalsDir)\$(TixSourceTag)"
-      displayName: 'Check out Tix sources'
+    - ${{ if eq(parameters.IncludeTix, 'true') }}:
+      - powershell: |
+          git clone $(SourcesRepo) -b $(TixSourceTag) --depth 1 "$(ExternalsDir)\$(TixSourceTag)"
+        displayName: 'Check out Tix sources'
 
     # This msbuild.rsp file will be used by the build to forcibly override these variables
     - powershell: |
@@ -95,21 +101,25 @@ jobs:
     - powershell: |
         & "$(msbuild)" cpython\PCbuild\tcl.vcxproj "@msbuild.rsp" /p:Platform=Win32 /p:tcltkDir="$(OutDir)\win32"
         & "$(msbuild)" cpython\PCbuild\tk.vcxproj  "@msbuild.rsp" /p:Platform=Win32 /p:tcltkDir="$(OutDir)\win32"
-        & "$(msbuild)" cpython\PCbuild\tix.vcxproj "@msbuild.rsp" /p:Platform=Win32 /p:tcltkDir="$(OutDir)\win32"
       displayName: 'Build for win32'
 
     - powershell: |
         & "$(msbuild)" cpython\PCbuild\tcl.vcxproj "@msbuild.rsp" /p:Platform=x64 /p:tcltkDir="$(OutDir)\amd64"
         & "$(msbuild)" cpython\PCbuild\tk.vcxproj  "@msbuild.rsp" /p:Platform=x64 /p:tcltkDir="$(OutDir)\amd64"
-        & "$(msbuild)" cpython\PCbuild\tix.vcxproj "@msbuild.rsp" /p:Platform=x64 /p:tcltkDir="$(OutDir)\amd64"
       displayName: 'Build for amd64'
 
     - powershell: |
         & "$(msbuild)" cpython\PCbuild\tcl.vcxproj "@msbuild.rsp" /p:Platform=ARM64 /p:tcltkDir="$(OutDir)\arm64"
         & "$(msbuild)" cpython\PCbuild\tk.vcxproj  "@msbuild.rsp" /p:Platform=ARM64 /p:tcltkDir="$(OutDir)\arm64"
-        & "$(msbuild)" cpython\PCbuild\tix.vcxproj "@msbuild.rsp" /p:Platform=ARM64 /p:tcltkDir="$(OutDir)\arm64"
       displayName: 'Build for arm64'
 
+    - ${{ if eq(parameters.IncludeTix, 'true') }}:
+      - powershell: |
+          & "$(msbuild)" cpython\PCbuild\tix.vcxproj "@msbuild.rsp" /p:Platform=Win32 /p:tcltkDir="$(OutDir)\win32"
+          & "$(msbuild)" cpython\PCbuild\tix.vcxproj "@msbuild.rsp" /p:Platform=x64 /p:tcltkDir="$(OutDir)\amd64"
+          & "$(msbuild)" cpython\PCbuild\tix.vcxproj "@msbuild.rsp" /p:Platform=ARM64 /p:tcltkDir="$(OutDir)\arm64"
+        displayName: 'Build Tix'
+
     - ${{ if ne(parameters.SigningCertificate, 'Unsigned') }}:
       - template: sign-files.yml
         parameters: