diff --git a/eng/pipelines/templates/jobs/ci.yml b/eng/pipelines/templates/jobs/ci.yml
index 10ccfa3d8ffa..0030ecbbfdad 100644
--- a/eng/pipelines/templates/jobs/ci.yml
+++ b/eng/pipelines/templates/jobs/ci.yml
@@ -66,7 +66,9 @@ jobs:
   - job: 'Build'
     timeoutInMinutes: 90
     variables:
-    - template: ../variables/globals.yml
+      Codeql.Enabled: true
+      Codeql.BuildIdentifier: ${{ parameters.ServiceDirectory }}
+      Codeql.SkipTaskAutoInjection: false
 
     pool:
       name: azsdk-pool-mms-ubuntu-2004-general
@@ -96,9 +98,6 @@ jobs:
 
     timeoutInMinutes: ${{ parameters.TestTimeoutInMinutes }}
 
-    variables:
-    - template: ../variables/globals.yml
-
     dependsOn:
       - 'Build'
 
diff --git a/eng/pipelines/templates/stages/archetype-sdk-client.yml b/eng/pipelines/templates/stages/archetype-sdk-client.yml
index 9a199eb9388a..3b3e37f12231 100644
--- a/eng/pipelines/templates/stages/archetype-sdk-client.yml
+++ b/eng/pipelines/templates/stages/archetype-sdk-client.yml
@@ -73,6 +73,9 @@ parameters:
   type: boolean
   default: false
 
+variables:
+  - template: /eng/pipelines/templates/variables/globals.yml
+
 stages:
   - stage: Build
     jobs:
diff --git a/eng/pipelines/templates/stages/cosmos-sdk-client.yml b/eng/pipelines/templates/stages/cosmos-sdk-client.yml
index dd98e28475e7..7e284438a3a4 100644
--- a/eng/pipelines/templates/stages/cosmos-sdk-client.yml
+++ b/eng/pipelines/templates/stages/cosmos-sdk-client.yml
@@ -18,14 +18,14 @@ parameters:
   type: boolean
   default: false
 
-stages:
-  - template: /eng/pipelines/templates/stages/archetype-sdk-client.yml
-    parameters:
-      ServiceDirectory: ${{ parameters.ServiceDirectory }}
-      # Skip emulator tests in the CI run
-      TestMarkArgument: not cosmosEmulator
-      InjectedPackages: ${{parameters.InjectedPackages}}
-      Artifacts: ${{parameters.Artifacts}}
+extends:
+  template: /eng/pipelines/templates/stages/archetype-sdk-client.yml
+  parameters:
+    ServiceDirectory: ${{ parameters.ServiceDirectory }}
+    # Skip emulator tests in the CI run
+    TestMarkArgument: not cosmosEmulator
+    InjectedPackages: ${{parameters.InjectedPackages}}
+    Artifacts: ${{parameters.Artifacts}}
 
 #  - stage: Test_Emulator
 #    dependsOn: []
diff --git a/eng/pipelines/templates/variables/globals.yml b/eng/pipelines/templates/variables/globals.yml
index 1bfb7d7d6077..c2492b875123 100644
--- a/eng/pipelines/templates/variables/globals.yml
+++ b/eng/pipelines/templates/variables/globals.yml
@@ -5,3 +5,5 @@ variables:
   Package.EnableSBOMSigning: true
   # this will be disabled until issue#24299 is addressed.
   DisableDockerDetector: true
+  # Disable CodeQL injections except for where we specifically enable it
+  Codeql.SkipTaskAutoInjection: true