diff --git a/src/SourceBuild/Arcade/eng/common/templates/job/source-build-build-tarball.yml b/src/SourceBuild/Arcade/eng/common/templates/job/source-build-build-tarball.yml
index c8756326e..abb9035fd 100644
--- a/src/SourceBuild/Arcade/eng/common/templates/job/source-build-build-tarball.yml
+++ b/src/SourceBuild/Arcade/eng/common/templates/job/source-build-build-tarball.yml
@@ -152,19 +152,24 @@ jobs:
       set -x
       df -h
 
-      networkArgs=
+      customRunArgs=
       customBuildArgs=
       if [[ '$(_RunOnline)' == 'true' ]]; then
         customBuildArgs='--online'
       else
-        networkArgs='--network none'
+        customRunArgs='--network none'
+      fi
+
+      # See https://github.com/dotnet/source-build/issues/3712
+      if [[ '$(_OverrideDistroDisablingSha1)' == 'true' ]]; then
+        customRunArgs="$customRunArgs -e OPENSSL_ENABLE_SHA1_SIGNATURES=1"
       fi
 
       if [[ '$(_EnablePoison)' == 'true' ]]; then
         customBuildArgs="$customBuildArgs --poison"
       fi
 
-      docker run --rm -v $(tarballDir):/tarball -w /tarball ${networkArgs} $(_Container) ./build.sh --clean-while-building ${customBuildArgs} $(additionalBuildArgs)
+      docker run --rm -v $(tarballDir):/tarball -w /tarball ${customRunArgs} $(_Container) ./build.sh --clean-while-building ${customBuildArgs} $(additionalBuildArgs)
     displayName: Build Tarball
 
   - ${{ if ne(variables['System.TeamProject'], 'public') }}:
diff --git a/src/SourceBuild/Arcade/eng/common/templates/job/source-build-run-tarball-build.yml b/src/SourceBuild/Arcade/eng/common/templates/job/source-build-run-tarball-build.yml
index 5fe6c56ce..307cb7307 100644
--- a/src/SourceBuild/Arcade/eng/common/templates/job/source-build-run-tarball-build.yml
+++ b/src/SourceBuild/Arcade/eng/common/templates/job/source-build-run-tarball-build.yml
@@ -11,7 +11,7 @@ parameters:
   # -----------------------------------------------------------------------------------------------
   alpine317Container: mcr.microsoft.com/dotnet-buildtools/prereqs:alpine-3.17
   centOSStream8Container: mcr.microsoft.com/dotnet-buildtools/prereqs:centos-stream8
-  centOSStream9Container: mcr.microsoft.com/dotnet-buildtools/prereqs:centos-stream9-20220107135047-4cd394c
+  centOSStream9Container: mcr.microsoft.com/dotnet-buildtools/prereqs:centos-stream9
   debian11Arm64Container: mcr.microsoft.com/dotnet-buildtools/prereqs:debian-11-arm64v8
   fedora38Container: mcr.microsoft.com/dotnet-buildtools/prereqs:fedora-38
   ubuntu2004Container: mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-20.04
@@ -41,6 +41,7 @@ jobs:
         _Container: ${{ parameters.centOSStream8Container }}
         _EnablePoison: false
         _ExcludeOmniSharpTests: true
+        _OverrideDistroDisablingSha1: false
         _RunOnline: true
         _WithPreviousSDK: false
       CentOSStream8-Offline:
@@ -56,6 +57,7 @@ jobs:
           _Container: ${{ parameters.alpine317Container }}
           _EnablePoison: false
           _ExcludeOmniSharpTests: true
+          _OverrideDistroDisablingSha1: false
           _RunOnline: false
           _WithPreviousSDK: false
         CentOSStream8-WithPreviousSDK:
@@ -70,6 +72,7 @@ jobs:
           _Container: ${{ parameters.centOSStream9Container }}
           _EnablePoison: false
           _ExcludeOmniSharpTests: false
+          _OverrideDistroDisablingSha1: true
           _RunOnline: false
           _WithPreviousSDK: false
         Fedora38-Offline:
@@ -77,6 +80,7 @@ jobs:
           _Container: ${{ parameters.fedora38Container }}
           _EnablePoison: true
           _ExcludeOmniSharpTests: false
+          _OverrideDistroDisablingSha1: false
           _RunOnline: false
           _WithPreviousSDK: false
         Ubuntu2004-Offline:
@@ -84,6 +88,7 @@ jobs:
           _Container: ${{ parameters.ubuntu2004Container }}
           _EnablePoison: false
           _ExcludeOmniSharpTests: false
+          _OverrideDistroDisablingSha1: false
           _RunOnline: false
           _WithPreviousSDK: false
     name: Build_Tarball_x64
@@ -108,6 +113,7 @@ jobs:
           _Container: ${{ parameters.debian11Arm64Container }}
           _EnablePoison: false
           _ExcludeOmniSharpTests: false
+          _OverrideDistroDisablingSha1: false
           _RunOnline: false
           _WithPreviousSDK: false
       name: Build_Tarball_arm64
@@ -129,6 +135,7 @@ jobs:
           _Container: ${{ parameters.fedora38Container }}
           _EnablePoison: false
           _ExcludeOmniSharpTests: false
+          _OverrideDistroDisablingSha1: false
           _RunOnline: false
           _WithPreviousSDK: false
       name: Build_Tarball_x64_Using_Previous