diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index abfd68fda..eb2acb8c9 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -20,6 +20,8 @@ variables:
   - name: PostBuildSign
     value: true
 - ${{ if and(ne(variables['System.TeamProject'], 'public'), notin(variables['Build.Reason'], 'PullRequest')) }}:
+  - name: Codeql.Enabled
+    value: true
   - group: DotNet-DotNetCli-Storage
   - group: DotNet-Installer-SDLValidation-Params
   - name: _PublishUsingPipelines
diff --git a/src/finalizer/finalizer.cpp b/src/finalizer/finalizer.cpp
index c8f5eca6b..d68418b9b 100644
--- a/src/finalizer/finalizer.cpp
+++ b/src/finalizer/finalizer.cpp
@@ -447,7 +447,17 @@ extern "C" HRESULT DetectSdk(LPWSTR sczSdkFeatureBandVersion, LPWSTR sczArchitec
     LogStringLine(REPORT_STANDARD, "Scanning %ls", sczInstalledSdkVersionsKeyName);
 
     hr = RegOpen(HKEY_LOCAL_MACHINE, sczInstalledSdkVersionsKeyName, KEY_READ, &hkInstalledSdkVersionsKey);
-    ExitOnFailure(hr, "Failed to read installed versions key.");
+
+    // When the last SDK is removed the registry key should no longer exist so we can just exit
+    if (E_FILENOTFOUND == hr)
+    {
+        LogStringLine(REPORT_STANDARD, "Registry key not found: %ls.", sczInstalledSdkVersionsKeyName);
+        hr = S_OK;
+        *pbInstalled = FALSE;
+        goto LExit;
+    }
+
+    ExitOnFailure(hr, "Failed to open registry key: %ls.", sczInstalledSdkVersionsKeyName);
 
     for (DWORD dwSdkVersionsValueIndex = 0;; ++dwSdkVersionsValueIndex)
     {
@@ -509,9 +519,10 @@ int wmain(int argc, wchar_t* argv[])
     hr = ::DetectSdk(sczFeatureBandVersion, argv[3], &bSdkFeatureBandInstalled);
     ExitOnFailure(hr, "Failed to detect installed SDKs.");
 
-    if (!bSdkFeatureBandInstalled)
+    // If the feature band is still present, do not remove workloads.
+    if (bSdkFeatureBandInstalled)
     {
-        LogStringLine(REPORT_STANDARD, "SDK with feature band %ls could not be found.", sczFeatureBandVersion);
+        LogStringLine(REPORT_STANDARD, "Detected SDK with feature band %ls.", sczFeatureBandVersion);
         goto LExit;
     }
 
diff --git a/src/redist/targets/GenerateBundledVersions.targets b/src/redist/targets/GenerateBundledVersions.targets
index 48b9e9c43..50f1ae43c 100644
--- a/src/redist/targets/GenerateBundledVersions.targets
+++ b/src/redist/targets/GenerateBundledVersions.targets
@@ -61,7 +61,7 @@
 
   <PropertyGroup>
       <VersionFeature21>30</VersionFeature21>
-      <VersionFeature31>$([MSBuild]::Add($(VersionFeature), 31))</VersionFeature31>
+      <VersionFeature31>32</VersionFeature31>
       <VersionFeature50>17</VersionFeature50>
       <VersionFeature60>$([MSBuild]::Add($(VersionFeature), 11))</VersionFeature60>
   </PropertyGroup>
diff --git a/src/redist/targets/packaging/windows/clisdk/bundle.wxs b/src/redist/targets/packaging/windows/clisdk/bundle.wxs
index 346e66d75..bac843303 100644
--- a/src/redist/targets/packaging/windows/clisdk/bundle.wxs
+++ b/src/redist/targets/packaging/windows/clisdk/bundle.wxs
@@ -151,7 +151,31 @@
     <Variable Name="WINFORMSANDWPFVERSION" Type="string" Value="$(var.WinFormsAndWpfVersion)" bal:Overridable="no" />
     <Variable Name="DOTNETHOMESIMILARITYCHECKOVERRIDE" Type="string" Value="" bal:Overridable="yes" />
       
-      <Chain DisableSystemRestore="yes" ParallelCache="yes">
+    <Chain DisableSystemRestore="yes" ParallelCache="yes">
+      
+      <!-- 
+        The finalizer is not an actual installation package. We "detect" the EXE
+        based on the action the bundle is performing to ensure that it runs the uninstall
+        command only when the bundle is being removed. The package is always installable because the bundle
+        will remove the package (execute its UninstallCommand) if it is not installable when then bundle is 
+        being installed.
+
+        The finalizer is first in the chain to ensure it executes last during an uninstall. When the 
+        SDK is upgraded, the old SDK will be removed before the finalizer executes. This ensures that the
+        finalizer detects the new SDK and does nothing because the feature band matches.
+
+        For an install+uninstall scenario, because the SDK MSI is removed prior to the finalizer, it will
+        detect that there are no matching feature bands and then clean up workloads associated with
+        the feature band.
+      -->
+      <ExePackage SourceFile="$(var.FinalizerExeSourcePath)"
+                  Cache="always"
+                  DetectCondition="WixBundleAction >= 3"
+                  Id="Finalizer"
+                  InstallCondition="WixBundleAction >= 4"
+                  UninstallCommand="&quot;[WixBundleLog_Finalizer]&quot; $(var.NugetVersion) $(var.Platform)"
+                  Vital="no" />
+
       <MsiPackage SourceFile="$(var.SharedFXMsiSourcePath)">
         <MsiProperty Name="DOTNETHOME" Value="[DOTNETHOME]" />
       </MsiPackage>
@@ -208,20 +232,7 @@
         <PackageGroupRef Id="PG_AspNetCoreSharedFramework_arm64"/>
       <?endif?>
 
-      <!-- 
-        The finalizer is not an actual installation package. We "detect" the EXE
-        based on the action the bundle is performing to ensure that it runs the uninstall
-        command only when the bundle is being removed. The package is always installable because the bundle
-        will remove (execute the uninstall command) the package if it is not installable when then bundle is 
-        being installed.
-      -->
-      <ExePackage SourceFile="$(var.FinalizerExeSourcePath)"
-                  Cache="always"
-                  DetectCondition="WixBundleAction >= 3"
-                  Id="Finalizer"
-                  InstallCondition="WixBundleAction >= 4"
-                  UninstallCommand="&quot;[WixBundleLog_Finalizer]&quot; $(var.NugetVersion) $(var.Platform)"
-                  Vital="no" />
+      
     </Chain>
   </Bundle>
 
diff --git a/test/EndToEnd/TelemetryOptOutDefaultTests.cs b/test/EndToEnd/TelemetryOptOutDefaultTests.cs
index 1a08d49b0..b0346c6e5 100644
--- a/test/EndToEnd/TelemetryOptOutDefaultTests.cs
+++ b/test/EndToEnd/TelemetryOptOutDefaultTests.cs
@@ -10,7 +10,7 @@ namespace EndToEnd.Tests
         [Fact]
         public void TelemetryOptOutDefaultAttribute()
         {
-            var dotnetdir = Path.Combine(Path.GetDirectoryName(RepoDirectoriesProvider.DotnetUnderTest), "sdk", "7.0.100");
+            var dotnetdir = Path.Combine(Path.GetDirectoryName(RepoDirectoriesProvider.DotnetUnderTest), "sdk", "7.0.101");
             var result = AssemblyInfo.Get(Path.Combine(dotnetdir, "dotnet.dll"), "AssemblyMetadataAttribute");
             result.Should().Contain("TelemetryOptOutDefault:False");
         }