diff --git a/.azure-pipelines/publish.yml b/.azure-pipelines/publish.yml
index c12c79c..035d621 100644
--- a/.azure-pipelines/publish.yml
+++ b/.azure-pipelines/publish.yml
@@ -34,6 +34,10 @@ extends:
             path: $(Build.ArtifactStagingDirectory)/esrp-build
             artifact: esrp-build
         steps:
+        - checkout: self
+          persistCredentials: false
+          displayName: "Checkout code"
+
         - bash: |
             if [[ ! "$CURRENT_BRANCH" =~ ^v[0-9]+\..* ]]; then
               echo "Can only publish from a release tag (v*)."