diff --git a/build/package/Installer.MSI.targets b/build/package/Installer.MSI.targets
index 649947574..3c8f0f2f8 100644
--- a/build/package/Installer.MSI.targets
+++ b/build/package/Installer.MSI.targets
@@ -14,6 +14,7 @@
       <CombinedFrameworkSdkHostBundleEngineName>$(InstallerOutputDirectory)/$(ArtifactNameWithVersionCombinedHostHostFxrFrameworkSdk)-engine.exe</CombinedFrameworkSdkHostBundleEngineName>
 
       <SdkGenerateMsiPowershellScript>$(RepoRoot)/packaging/windows/clisdk/generatemsi.ps1</SdkGenerateMsiPowershellScript>
+      <SdkStableFileIdForApphostTransform>$(RepoRoot)/packaging/windows/clisdk/stablefileidforapphosttransform.xslt</SdkStableFileIdForApphostTransform>
       <SdkGenerateBundlePowershellScript>$(RepoRoot)/packaging/windows/clisdk/generatebundle.ps1</SdkGenerateBundlePowershellScript>
       <SdkGenerateNupkgPowershellScript>$(RepoRoot)/packaging/windows/clisdk/generatenupkg.ps1</SdkGenerateNupkgPowershellScript>
 
@@ -110,7 +111,9 @@
                       '$(SimpleVersion)'
                       '$(NugetVersion)'
                       '$(SdkInstallerUpgradeCode)'
-                      '$(Architecture)'" />
+                      '$(Architecture)'
+                      '$(SdkStableFileIdForApphostTransform)'
+                      " />
     </Target>
 
     <Target Name="GenerateMSBuildExtensionsMsi"
diff --git a/packaging/windows/clisdk/StableFileIdForApphostTransform.xslt b/packaging/windows/clisdk/StableFileIdForApphostTransform.xslt
new file mode 100644
index 000000000..dcded1aca
--- /dev/null
+++ b/packaging/windows/clisdk/StableFileIdForApphostTransform.xslt
@@ -0,0 +1,26 @@
+<xsl:stylesheet version="1.0"
+            xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+            xmlns:msxsl="urn:schemas-microsoft-com:xslt"
+            exclude-result-prefixes="msxsl"
+            xmlns:wix="http://schemas.microsoft.com/wix/2006/wi"
+            xmlns:my="my:my">
+
+    <xsl:output method="xml" indent="yes" />
+
+    <xsl:strip-space elements="*"/>
+
+    <xsl:template match="@*|node()">
+        <xsl:copy>
+            <xsl:apply-templates select="@*|node()"/>
+        </xsl:copy>
+    </xsl:template>
+
+    <xsl:template match='wix:Wix/wix:Fragment/wix:ComponentGroup/wix:Component/wix:File[contains(@Source, "AppHostTemplate\apphost.exe")]'>
+        <xsl:copy>
+            <xsl:apply-templates select="@*"/>
+            <xsl:attribute name="Id">
+                <xsl:text>apphosttemplateapphostexe</xsl:text>
+            </xsl:attribute>
+        </xsl:copy>
+    </xsl:template>
+</xsl:stylesheet>
diff --git a/packaging/windows/clisdk/generatemsi.ps1 b/packaging/windows/clisdk/generatemsi.ps1
index fc9da871d..69c17d078 100644
--- a/packaging/windows/clisdk/generatemsi.ps1
+++ b/packaging/windows/clisdk/generatemsi.ps1
@@ -10,7 +10,8 @@ param(
     [Parameter(Mandatory=$true)][string]$DotnetCLIDisplayVersion,
     [Parameter(Mandatory=$true)][string]$DotnetCLINugetVersion,
     [Parameter(Mandatory=$true)][string]$UpgradeCode,
-    [Parameter(Mandatory=$true)][string]$Architecture
+    [Parameter(Mandatory=$true)][string]$Architecture,
+    [Parameter(Mandatory=$true)][string]$StableFileIdForApphostTransform
 )
 
 . "$PSScriptRoot\..\..\..\scripts\common\_common.ps1"
@@ -26,7 +27,19 @@ function RunHeat
 
     Write-Output Running heat..
 
-    .\heat.exe dir `"$inputDir`" -template fragment -sreg -gg -var var.DotnetSrc -cg InstallFiles -srd -dr DOTNETHOME -out $InstallFileswsx | Out-Host
+    # -t $StableFileIdForApphostTransform to avoid sign check baseline apphost.exe name changes every build. Sign check uses File Id in MSI as whitelist name.
+    # Template apphost.exe get a new "File Id" in msi different every time (since File Id is generated according to file
+    # path, and file path has version number)
+    # use XSLT tranform to match the file path contains "AppHostTemplate\apphost.exe" and give it the same ID all the time.
+
+    .\heat.exe dir `"$inputDir`" -template fragment  `
+        -sreg -gg  `
+        -var var.DotnetSrc  `
+        -cg InstallFiles  `
+        -srd  `
+        -dr DOTNETHOME  `
+        -t $StableFileIdForApphostTransform  `
+        -out $InstallFileswsx | Out-Host
 
     if($LastExitCode -ne 0)
     {