diff --git a/NuGet.config b/NuGet.config
index 798a7d0e55e65..f64ae4985405f 100644
--- a/NuGet.config
+++ b/NuGet.config
@@ -10,6 +10,9 @@
     <!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
     <!--  Begin: Package sources from dotnet-emsdk -->
     <add key="darc-pub-dotnet-emsdk-925c59b" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-925c59b4/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-emsdk-925c59b-2" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-925c59b4-2/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-emsdk-925c59b-1" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-925c59b4-1/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-emsdk-ee3546a" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-ee3546a4/nuget/v3/index.json" />
     <!--  End: Package sources from dotnet-emsdk -->
     <!--  Begin: Package sources from dotnet-wcf -->
     <!--  End: Package sources from dotnet-wcf -->
diff --git a/eng/Publishing.props b/eng/Publishing.props
index 920e79cbbd2f7..8b796225f8274 100644
--- a/eng/Publishing.props
+++ b/eng/Publishing.props
@@ -1,6 +1,7 @@
 <Project>
-  <!-- TODO: Consolidate the Publishing.props files into here. -->
+
   <PropertyGroup>
-    <PublishingVersion>3</PublishingVersion>
+    <ProducesDotNetReleaseShippingAssets>true</ProducesDotNetReleaseShippingAssets>
   </PropertyGroup>
-</Project>
\ No newline at end of file
+
+</Project>
diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
index cfcc7ab255260..25a1ae7d7e28d 100644
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@@ -1,8 +1,8 @@
 <Dependencies>
   <ProductDependencies>
-    <Dependency Name="Microsoft.NETCore.Runtime.ICU.Transport" Version="6.0.0-rtm.23512.2">
+    <Dependency Name="Microsoft.NETCore.Runtime.ICU.Transport" Version="6.0.0-rtm.24114.3">
       <Uri>https://github.com/dotnet/icu</Uri>
-      <Sha>0a6b6dc4153f52a42dad0cf275e969c2bfaad1a2</Sha>
+      <Sha>b62077d90972117ad4663128962914864b19ad05</Sha>
     </Dependency>
     <Dependency Name="System.Net.MsQuic.Transport" Version="6.0.0-servicing.22205.1">
       <Uri>https://github.com/dotnet/msquic</Uri>
@@ -10,15 +10,15 @@
     </Dependency>
     <Dependency Name="Microsoft.NET.Workload.Emscripten.Manifest-6.0.100" Version="6.0.28">
       <Uri>https://github.com/dotnet/emsdk</Uri>
-      <Sha>925c59b436d60b9cd6b5df54c3f9be13a9512c95</Sha>
+      <Sha>ee3546a41338fd3c82167b62d7ff989934c6cb01</Sha>
     </Dependency>
     <Dependency Name="Microsoft.NET.Workload.Emscripten.Manifest-6.0.300" Version="6.0.28">
       <Uri>https://github.com/dotnet/emsdk</Uri>
-      <Sha>925c59b436d60b9cd6b5df54c3f9be13a9512c95</Sha>
+      <Sha>ee3546a41338fd3c82167b62d7ff989934c6cb01</Sha>
     </Dependency>
     <Dependency Name="Microsoft.NET.Workload.Emscripten.Manifest-6.0.400" Version="6.0.28">
       <Uri>https://github.com/dotnet/emsdk</Uri>
-      <Sha>925c59b436d60b9cd6b5df54c3f9be13a9512c95</Sha>
+      <Sha>ee3546a41338fd3c82167b62d7ff989934c6cb01</Sha>
     </Dependency>
     <Dependency Name="System.ServiceModel.Primitives" Version="4.9.0">
       <Uri>https://github.com/dotnet/wcf</Uri>
@@ -102,49 +102,49 @@
       <Uri>https://github.com/microsoft/vstest</Uri>
       <Sha>140434f7109d357d0158ade9e5164a4861513965</Sha>
     </Dependency>
-    <Dependency Name="System.ComponentModel.TypeConverter.TestData" Version="6.0.0-beta.23512.1">
+    <Dependency Name="System.ComponentModel.TypeConverter.TestData" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
-    <Dependency Name="System.Data.Common.TestData" Version="6.0.0-beta.23512.1">
+    <Dependency Name="System.Data.Common.TestData" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
-    <Dependency Name="System.Drawing.Common.TestData" Version="6.0.0-beta.23512.1">
+    <Dependency Name="System.Drawing.Common.TestData" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
-    <Dependency Name="System.IO.Compression.TestData" Version="6.0.0-beta.23512.1">
+    <Dependency Name="System.IO.Compression.TestData" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
-    <Dependency Name="System.IO.Packaging.TestData" Version="6.0.0-beta.23512.1">
+    <Dependency Name="System.IO.Packaging.TestData" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
-    <Dependency Name="System.Net.TestData" Version="6.0.0-beta.23512.1">
+    <Dependency Name="System.Net.TestData" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
-    <Dependency Name="System.Private.Runtime.UnicodeData" Version="6.0.0-beta.23512.1">
+    <Dependency Name="System.Private.Runtime.UnicodeData" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
-    <Dependency Name="System.Runtime.TimeZoneData" Version="6.0.0-beta.23512.1">
+    <Dependency Name="System.Runtime.TimeZoneData" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
-    <Dependency Name="System.Security.Cryptography.X509Certificates.TestData" Version="6.0.0-beta.23512.1">
+    <Dependency Name="System.Security.Cryptography.X509Certificates.TestData" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
-    <Dependency Name="System.Windows.Extensions.TestData" Version="6.0.0-beta.23512.1">
+    <Dependency Name="System.Windows.Extensions.TestData" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.DotNet.CilStrip.Sources" Version="6.0.0-beta.23512.1">
+    <Dependency Name="Microsoft.DotNet.CilStrip.Sources" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
     <Dependency Name="runtime.linux-arm64.Microsoft.NETCore.Runtime.Mono.LLVM.Sdk" Version="11.1.0-alpha.1.21416.1">
       <Uri>https://github.com/dotnet/llvm-project</Uri>
@@ -242,13 +242,13 @@
       <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-optimization</Uri>
       <Sha>d50065944d8b41d804448a7056351481d583ad3d</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.DotNet.HotReload.Utils.Generator.BuildTool" Version="6.0.0-alpha.0.23518.4">
+    <Dependency Name="Microsoft.DotNet.HotReload.Utils.Generator.BuildTool" Version="6.0.0-alpha.0.24115.1">
       <Uri>https://github.com/dotnet/hotreload-utils</Uri>
-      <Sha>453eb973df8f81461022c8a428c717ed87129055</Sha>
+      <Sha>0d7d008228ffdfeb200fdf8039419a7c019eff50</Sha>
     </Dependency>
-    <Dependency Name="System.Runtime.Numerics.TestData" Version="6.0.0-beta.23512.1">
+    <Dependency Name="System.Runtime.Numerics.TestData" Version="6.0.0-beta.24124.1">
       <Uri>https://github.com/dotnet/runtime-assets</Uri>
-      <Sha>982dfbc57db3a7ccd49e671ab1ca9779cc7070e5</Sha>
+      <Sha>883c47a740b678482efd9dfee6da38ac108fbca9</Sha>
     </Dependency>
     <Dependency Name="Microsoft.CodeAnalysis.NetAnalyzers" Version="6.0.0-rc1.21413.4">
       <Uri>https://github.com/dotnet/roslyn-analyzers</Uri>
diff --git a/eng/Versions.props b/eng/Versions.props
index 6c0439aee6e9c..31cd7e023c036 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -108,18 +108,18 @@
     <SystemValueTupleVersion>4.5.0</SystemValueTupleVersion>
     <runtimenativeSystemIOPortsVersion>6.0.0-rc.1.21415.6</runtimenativeSystemIOPortsVersion>
     <!-- Runtime-Assets dependencies -->
-    <SystemRuntimeNumericsTestDataVersion>6.0.0-beta.23512.1</SystemRuntimeNumericsTestDataVersion>
-    <SystemComponentModelTypeConverterTestDataVersion>6.0.0-beta.23512.1</SystemComponentModelTypeConverterTestDataVersion>
-    <SystemDataCommonTestDataVersion>6.0.0-beta.23512.1</SystemDataCommonTestDataVersion>
-    <SystemDrawingCommonTestDataVersion>6.0.0-beta.23512.1</SystemDrawingCommonTestDataVersion>
-    <SystemIOCompressionTestDataVersion>6.0.0-beta.23512.1</SystemIOCompressionTestDataVersion>
-    <SystemIOPackagingTestDataVersion>6.0.0-beta.23512.1</SystemIOPackagingTestDataVersion>
-    <SystemNetTestDataVersion>6.0.0-beta.23512.1</SystemNetTestDataVersion>
-    <SystemPrivateRuntimeUnicodeDataVersion>6.0.0-beta.23512.1</SystemPrivateRuntimeUnicodeDataVersion>
-    <SystemRuntimeTimeZoneDataVersion>6.0.0-beta.23512.1</SystemRuntimeTimeZoneDataVersion>
-    <SystemSecurityCryptographyX509CertificatesTestDataVersion>6.0.0-beta.23512.1</SystemSecurityCryptographyX509CertificatesTestDataVersion>
-    <SystemWindowsExtensionsTestDataVersion>6.0.0-beta.23512.1</SystemWindowsExtensionsTestDataVersion>
-    <MicrosoftDotNetCilStripSourcesVersion>6.0.0-beta.23512.1</MicrosoftDotNetCilStripSourcesVersion>
+    <SystemRuntimeNumericsTestDataVersion>6.0.0-beta.24124.1</SystemRuntimeNumericsTestDataVersion>
+    <SystemComponentModelTypeConverterTestDataVersion>6.0.0-beta.24124.1</SystemComponentModelTypeConverterTestDataVersion>
+    <SystemDataCommonTestDataVersion>6.0.0-beta.24124.1</SystemDataCommonTestDataVersion>
+    <SystemDrawingCommonTestDataVersion>6.0.0-beta.24124.1</SystemDrawingCommonTestDataVersion>
+    <SystemIOCompressionTestDataVersion>6.0.0-beta.24124.1</SystemIOCompressionTestDataVersion>
+    <SystemIOPackagingTestDataVersion>6.0.0-beta.24124.1</SystemIOPackagingTestDataVersion>
+    <SystemNetTestDataVersion>6.0.0-beta.24124.1</SystemNetTestDataVersion>
+    <SystemPrivateRuntimeUnicodeDataVersion>6.0.0-beta.24124.1</SystemPrivateRuntimeUnicodeDataVersion>
+    <SystemRuntimeTimeZoneDataVersion>6.0.0-beta.24124.1</SystemRuntimeTimeZoneDataVersion>
+    <SystemSecurityCryptographyX509CertificatesTestDataVersion>6.0.0-beta.24124.1</SystemSecurityCryptographyX509CertificatesTestDataVersion>
+    <SystemWindowsExtensionsTestDataVersion>6.0.0-beta.24124.1</SystemWindowsExtensionsTestDataVersion>
+    <MicrosoftDotNetCilStripSourcesVersion>6.0.0-beta.24124.1</MicrosoftDotNetCilStripSourcesVersion>
     <!-- dotnet-optimization dependencies -->
     <optimizationwindows_ntx64MIBCRuntimeVersion>1.0.0-prerelease.21416.5</optimizationwindows_ntx64MIBCRuntimeVersion>
     <optimizationwindows_ntx86MIBCRuntimeVersion>1.0.0-prerelease.21416.5</optimizationwindows_ntx86MIBCRuntimeVersion>
@@ -138,14 +138,14 @@
     <MicrosoftBuildVersion>16.10.0</MicrosoftBuildVersion>
     <MicrosoftBuildTasksCoreVersion>$(MicrosoftBuildVersion)</MicrosoftBuildTasksCoreVersion>
     <SystemDrawingCommonVersion>4.7.2</SystemDrawingCommonVersion>
-    <NugetProjectModelVersion>6.7.0</NugetProjectModelVersion>
+    <NugetProjectModelVersion>6.7.1</NugetProjectModelVersion>
     <NugetPackagingVersion>6.2.2</NugetPackagingVersion>
     <!-- Testing -->
     <MicrosoftNETCoreCoreDisToolsVersion>1.0.1-prerelease-00006</MicrosoftNETCoreCoreDisToolsVersion>
     <MicrosoftNETTestSdkVersion>17.4.0-preview-20220707-01</MicrosoftNETTestSdkVersion>
     <MicrosoftDotNetXHarnessTestRunnersXunitVersion>6.0.0-prerelease.23531.3</MicrosoftDotNetXHarnessTestRunnersXunitVersion>
     <MicrosoftDotNetXHarnessCLIVersion>6.0.0-prerelease.23531.3</MicrosoftDotNetXHarnessCLIVersion>
-    <MicrosoftDotNetHotReloadUtilsGeneratorBuildToolVersion>6.0.0-alpha.0.23518.4</MicrosoftDotNetHotReloadUtilsGeneratorBuildToolVersion>
+    <MicrosoftDotNetHotReloadUtilsGeneratorBuildToolVersion>6.0.0-alpha.0.24115.1</MicrosoftDotNetHotReloadUtilsGeneratorBuildToolVersion>
     <MicrosoftDotNetHotReloadUtilsGeneratorBuildToolVersion>6.0.0-alpha.0.23367.3</MicrosoftDotNetHotReloadUtilsGeneratorBuildToolVersion>
     <XUnitVersion>2.4.2-pre.9</XUnitVersion>
     <XUnitRunnerVisualStudioVersion>2.4.2</XUnitRunnerVisualStudioVersion>
@@ -163,7 +163,7 @@
     <MicrosoftNETILLinkTasksVersion>6.0.100-1.21459.1</MicrosoftNETILLinkTasksVersion>
     <MicrosoftNETILLinkAnalyzerPackageVersion>$(MicrosoftNETILLinkTasksVersion)</MicrosoftNETILLinkAnalyzerPackageVersion>
     <!-- ICU -->
-    <MicrosoftNETCoreRuntimeICUTransportVersion>6.0.0-rtm.23512.2</MicrosoftNETCoreRuntimeICUTransportVersion>
+    <MicrosoftNETCoreRuntimeICUTransportVersion>6.0.0-rtm.24114.3</MicrosoftNETCoreRuntimeICUTransportVersion>
     <!-- MsQuic -->
     <SystemNetMsQuicTransportVersion>6.0.0-servicing.22205.1</SystemNetMsQuicTransportVersion>
     <!-- Mono LLVM -->
diff --git a/src/coreclr/vm/win32threadpool.h b/src/coreclr/vm/win32threadpool.h
index 20aeccce7f4e5..77f245c7fd998 100644
--- a/src/coreclr/vm/win32threadpool.h
+++ b/src/coreclr/vm/win32threadpool.h
@@ -752,17 +752,23 @@ class ThreadpoolMgr
 
 #ifndef TARGET_UNIX
             if (CPUGroupInfo::CanEnableThreadUseAllCpuGroups())
-                processorNumber = CPUGroupInfo::CalculateCurrentProcessorNumber();
+            {
+                // The current processor number may not be within the total number of active processors determined at
+                // initialization time.
+                processorNumber = CPUGroupInfo::CalculateCurrentProcessorNumber() % CPUGroupInfo::GetNumActiveProcessors();
+            }
             else
+            {
                 // Turns out GetCurrentProcessorNumber can return a value greater than the number of processors reported by
                 // GetSystemInfo, if we're running in WOW64 on a machine with >32 processors.
-        	    processorNumber = GetCurrentProcessorNumber()%NumberOfProcessors;
+                processorNumber = GetCurrentProcessorNumber() % g_SystemInfo.dwNumberOfProcessors;
+            }
 #else // !TARGET_UNIX
             if (PAL_HasGetCurrentProcessorNumber())
             {
                 // On linux, GetCurrentProcessorNumber which uses sched_getcpu() can return a value greater than the number
                 // of processors reported by sysconf(_SC_NPROCESSORS_ONLN) when using OpenVZ kernel.
-                processorNumber = GetCurrentProcessorNumber()%NumberOfProcessors;
+                processorNumber = GetCurrentProcessorNumber() % PAL_GetTotalCpuCount();
             }
 #endif // !TARGET_UNIX
             return pRecycledListPerProcessor[processorNumber][memType];
diff --git a/src/installer/prepare-artifacts.proj b/src/installer/prepare-artifacts.proj
index a4476a5d1e9d1..2de1d3b43d3a2 100644
--- a/src/installer/prepare-artifacts.proj
+++ b/src/installer/prepare-artifacts.proj
@@ -23,6 +23,8 @@
   </PropertyGroup>
   <Import Project="../tools/Sign.props" Sdk="Microsoft.DotNet.Arcade.Sdk" />
 
+  <Import Project="$(RepositoryEngineeringDir)Publishing.props" Condition="Exists('$(RepositoryEngineeringDir)Publishing.props')" />
+
   <UsingTask TaskName="GenerateChecksums" AssemblyFile="$(InstallerTasksAssemblyPath)" />
 
   <PropertyGroup>
@@ -56,6 +58,16 @@
     <ManifestBuildData Include="AzureDevOpsBranch=$(BUILD_SOURCEBRANCH)" />
   </ItemGroup>
 
+  <!-- 
+    Set metadata for assets that are not marked as NonShipping. 
+    This is used to determine if the asset should be shipped as part of .NET release.
+  -->
+  <ItemDefinitionGroup>
+    <ItemsToPush>
+      <ManifestArtifactData Condition="'$(ProducesDotNetReleaseShippingAssets)' == 'true'">DotNetReleaseShipping=true</ManifestArtifactData>
+    </ItemsToPush>
+  </ItemDefinitionGroup>
+
   <!--
     Take assets from the build jobs, prepare them for publishing (signing, arrangement) then upload
     them to the pipeline for Arcade and custom steps to publish.
diff --git a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.RSA.cs b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.RSA.cs
index f0ebcf94d95e5..69b0c03f65e2e 100644
--- a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.RSA.cs
+++ b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.RSA.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 
 using System;
+using System.Buffers;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
@@ -111,6 +112,22 @@ private static extern int RsaDecryptPkcs(
             out SafeCFDataHandle pEncryptedOut,
             out SafeCFErrorHandle pErrorOut);
 
+        private static int RsaDecryptRaw(
+            SafeSecKeyRefHandle publicKey,
+            ReadOnlySpan<byte> pbData,
+            int cbData,
+            out SafeCFDataHandle pEncryptedOut,
+            out SafeCFErrorHandle pErrorOut) =>
+            RsaDecryptRaw(publicKey, ref MemoryMarshal.GetReference(pbData), cbData, out pEncryptedOut, out pErrorOut);
+
+        [DllImport(Libraries.AppleCryptoNative, EntryPoint = "AppleCryptoNative_RsaDecryptRaw")]
+        private static extern int RsaDecryptRaw(
+            SafeSecKeyRefHandle publicKey,
+            ref byte pbData,
+            int cbData,
+            out SafeCFDataHandle pEncryptedOut,
+            out SafeCFErrorHandle pErrorOut);
+
         internal static void RsaGenerateKey(
             int keySizeInBits,
             out SafeSecKeyRefHandle pPublicKey,
@@ -200,17 +217,40 @@ internal static byte[] RsaDecrypt(
             byte[] data,
             RSAEncryptionPadding padding)
         {
+            if (padding == RSAEncryptionPadding.Pkcs1)
+            {
+                byte[] padded = ExecuteTransform(
+                    data,
+                    (ReadOnlySpan<byte> source, out SafeCFDataHandle decrypted, out SafeCFErrorHandle error) =>
+                        RsaDecryptRaw(privateKey, source, source.Length, out decrypted, out error));
+
+                byte[] depad = CryptoPool.Rent(padded.Length);
+                OperationStatus status = RsaPaddingProcessor.DepadPkcs1Encryption(padded, depad, out int written);
+                byte[]? ret = null;
+
+                if (status == OperationStatus.Done)
+                {
+                    ret = depad.AsSpan(0, written).ToArray();
+                }
+
+                // Clear the whole thing, especially on failure.
+                CryptoPool.Return(depad);
+                CryptographicOperations.ZeroMemory(padded);
+
+                if (ret is null)
+                {
+                    throw new CryptographicException(SR.Cryptography_InvalidPadding);
+                }
+
+                return ret;
+            }
+
+            Debug.Assert(padding.Mode == RSAEncryptionPaddingMode.Oaep);
+
             return ExecuteTransform(
                 data,
                 (ReadOnlySpan<byte> source, out SafeCFDataHandle decrypted, out SafeCFErrorHandle error) =>
                 {
-                    if (padding == RSAEncryptionPadding.Pkcs1)
-                    {
-                        return RsaDecryptPkcs(privateKey, source, source.Length, out decrypted, out error);
-                    }
-
-                    Debug.Assert(padding.Mode == RSAEncryptionPaddingMode.Oaep);
-
                     return RsaDecryptOaep(
                         privateKey,
                         source,
@@ -229,14 +269,63 @@ internal static bool TryRsaDecrypt(
             out int bytesWritten)
         {
             Debug.Assert(padding.Mode == RSAEncryptionPaddingMode.Pkcs1 || padding.Mode == RSAEncryptionPaddingMode.Oaep);
+
+            if (padding.Mode == RSAEncryptionPaddingMode.Pkcs1)
+            {
+                byte[] padded = CryptoPool.Rent(source.Length);
+                byte[] depad = CryptoPool.Rent(source.Length);
+
+                bool processed = TryExecuteTransform(
+                    source,
+                    padded,
+                    out int paddedLength,
+                    (ReadOnlySpan<byte> innerSource, out SafeCFDataHandle outputHandle, out SafeCFErrorHandle errorHandle) =>
+                        RsaDecryptRaw(privateKey, innerSource, innerSource.Length, out outputHandle, out errorHandle));
+
+                Debug.Assert(
+                    processed,
+                    "TryExecuteTransform should always return true for a large enough buffer.");
+
+                OperationStatus status = OperationStatus.InvalidData;
+                int depaddedLength = 0;
+
+                if (processed)
+                {
+                    status = RsaPaddingProcessor.DepadPkcs1Encryption(
+                        new ReadOnlySpan<byte>(padded, 0, paddedLength),
+                        depad,
+                        out depaddedLength);
+                }
+
+                CryptoPool.Return(padded);
+
+                if (status == OperationStatus.Done)
+                {
+                    if (depaddedLength <= destination.Length)
+                    {
+                        depad.AsSpan(0, depaddedLength).CopyTo(destination);
+                        CryptoPool.Return(depad);
+                        bytesWritten = depaddedLength;
+                        return true;
+                    }
+
+                    CryptoPool.Return(depad);
+                    bytesWritten = 0;
+                    return false;
+                }
+
+                CryptoPool.Return(depad);
+                Debug.Assert(status == OperationStatus.InvalidData);
+                throw new CryptographicException(SR.Cryptography_InvalidPadding);
+            }
+
             return TryExecuteTransform(
                 source,
                 destination,
                 out bytesWritten,
                 delegate (ReadOnlySpan<byte> innerSource, out SafeCFDataHandle outputHandle, out SafeCFErrorHandle errorHandle)
                 {
-                    return padding.Mode == RSAEncryptionPaddingMode.Pkcs1 ?
-                        RsaDecryptPkcs(privateKey, innerSource, innerSource.Length, out outputHandle, out errorHandle) :
+                    return
                         RsaDecryptOaep(privateKey, innerSource, innerSource.Length, PalAlgorithmFromAlgorithmName(padding.OaepHashAlgorithm), out outputHandle, out errorHandle);
                 });
         }
diff --git a/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs b/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs
index 9538db1414322..9d997165fde67 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs
@@ -1,6 +1,7 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
+using System.Buffers;
 using System.Buffers.Binary;
 using System.Collections.Concurrent;
 using System.Diagnostics;
@@ -147,6 +148,109 @@ internal static void PadPkcs1Encryption(
             source.CopyTo(mInEM);
         }
 
+        internal static OperationStatus DepadPkcs1Encryption(
+            ReadOnlySpan<byte> source,
+            Span<byte> destination,
+            out int bytesWritten)
+        {
+            int primitive = DepadPkcs1Encryption(source);
+            int primitiveSign = SignStretch(primitive);
+
+            // Primitive is a positive length, or ~length to indicate
+            // an error, so flip ~length to length if the high bit is set.
+            int len = Choose(primitiveSign, ~primitive, primitive);
+            int spaceRemain = destination.Length - len;
+            int spaceRemainSign = SignStretch(spaceRemain);
+
+            // len = clampHigh(len, destination.Length);
+            len = Choose(spaceRemainSign, destination.Length, len);
+
+            // ret = spaceRemain < 0 ? DestinationTooSmall : Done
+            int ret = Choose(
+                spaceRemainSign,
+                (int)OperationStatus.DestinationTooSmall,
+                (int)OperationStatus.Done);
+
+            // ret = primitive < 0 ? InvalidData : ret;
+            ret = Choose(primitiveSign, (int)OperationStatus.InvalidData, ret);
+
+            // Write some number of bytes, regardless of the final return.
+            source[^len..].CopyTo(destination);
+
+            // bytesWritten = ret == Done ? len : 0;
+            bytesWritten = Choose(CheckZero(ret), len, 0);
+            return (OperationStatus)ret;
+        }
+
+        private static int DepadPkcs1Encryption(ReadOnlySpan<byte> source)
+        {
+            Debug.Assert(source.Length > 11);
+            ReadOnlySpan<byte> afterPadding = source.Slice(10);
+            ReadOnlySpan<byte> noZeros = source.Slice(2, 8);
+
+            // Find the first zero in noZeros, or -1 for no zeros.
+            int zeroPos = BlindFindFirstZero(noZeros);
+
+            // If zeroPos is negative, valid is -1, otherwise 0.
+            int valid = SignStretch(zeroPos);
+
+            // If there are no zeros in afterPadding then zeroPos is negative,
+            // so negating the sign stretch is 0, which makes hasPos 0.
+            // If there -was- a zero, sign stretching is 0, so negating it makes hasPos -1.
+            zeroPos = BlindFindFirstZero(afterPadding);
+            int hasLen = ~SignStretch(zeroPos);
+            valid &= hasLen;
+
+            // Check that the first two bytes are { 00 02 }
+            valid &= CheckZero(source[0] | (source[1] ^ 0x02));
+
+            int lenIfGood = afterPadding.Length - zeroPos - 1;
+            // If there were no zeros, use the full after-min-padding segment.
+            int lenIfBad = ~Choose(hasLen, lenIfGood, source.Length - 11);
+
+            Debug.Assert(lenIfBad < 0);
+            return Choose(valid, lenIfGood, lenIfBad);
+        }
+
+        private static int BlindFindFirstZero(ReadOnlySpan<byte> source)
+        {
+            // Any vectorization of this routine needs to use non-early termination,
+            // and instructions that do not vary their completion time on the input.
+
+            int pos = -1;
+
+            for (int i = source.Length - 1; i >= 0; i--)
+            {
+                // pos = source[i] == 0 ? i : pos;
+                int local = CheckZero(source[i]);
+                pos = Choose(local, i, pos);
+            }
+
+            return pos;
+        }
+
+        private static int SignStretch(int value)
+        {
+            return value >> 31;
+        }
+
+        private static int Choose(int selector, int yes, int no)
+        {
+            Debug.Assert((selector | (selector - 1)) == -1);
+            return (selector & yes) | (~selector & no);
+        }
+
+        private static int CheckZero(int value)
+        {
+            // For zero, ~value and value-1 are both all bits set (negative).
+            // For positive values, ~value is negative and value-1 is positive.
+            // For negative values except MinValue, ~value is positive and value-1 is negative.
+            // For MinValue, ~value is positive and value-1 is also positive.
+            // All together, the only thing that has negative & negative is 0, so stretch the sign bit.
+            int mask = ~value & (value - 1);
+            return SignStretch(mask);
+        }
+
         internal void PadPkcs1Signature(
             ReadOnlySpan<byte> source,
             Span<byte> destination)
diff --git a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/EncryptDecrypt.cs b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/EncryptDecrypt.cs
index 55a044d62a695..9167efae0900f 100644
--- a/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/EncryptDecrypt.cs
+++ b/src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/RSA/EncryptDecrypt.cs
@@ -2,6 +2,8 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 
 using System.Collections.Generic;
+using System.Diagnostics;
+using System.Numerics;
 using Test.Cryptography;
 using Microsoft.DotNet.XUnitExtensions;
 using Xunit;
@@ -712,6 +714,119 @@ public void Decrypt_Pkcs1_ErrorsForInvalidPadding(byte[] data)
             }
         }
 
+        [Fact]
+        public void Decrypt_Pkcs1_BadPadding()
+        {
+            if ((PlatformDetection.IsWindows && !PlatformDetection.IsWindows10Version2004OrGreater))
+            {
+                return;
+            }
+
+            RSAParameters keyParams = TestData.RSA2048Params;
+            BigInteger e = new BigInteger(keyParams.Exponent, true, true);
+            BigInteger n = new BigInteger(keyParams.Modulus, true, true);
+            byte[] buf = new byte[keyParams.Modulus.Length];
+            byte[] c = new byte[buf.Length];
+
+            buf[1] = 2;
+            buf.AsSpan(2).Fill(1);
+
+            ref byte afterMinPadding = ref buf[10];
+            ref byte lastByte = ref buf[^1];
+            afterMinPadding = 0;
+
+            using (RSA rsa = RSAFactory.Create(keyParams))
+            {
+                RawEncrypt(buf, e, n, c);
+                // Assert.NoThrow, check that manual padding is coherent
+                Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1);
+
+                // All RSA encryption schemes start with 00, so pick any other number.
+                //
+                // If buf > modulus then encrypt should fail, so this
+                // is the largest legal-but-invalid value to test.
+                buf[0] = keyParams.Modulus[0];
+                RawEncrypt(buf, e, n, c);
+                Assert.ThrowsAny<CryptographicException>(() => Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1));
+
+                // Check again with a zero length payload
+                (afterMinPadding, lastByte) = (lastByte, afterMinPadding);
+                RawEncrypt(buf, e, n, c);
+                Assert.ThrowsAny<CryptographicException>(() => Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1));
+
+                // Back to valid padding
+                buf[0] = 0;
+                (afterMinPadding, lastByte) = (lastByte, afterMinPadding);
+                RawEncrypt(buf, e, n, c);
+                Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1);
+
+                // This is (sort of) legal for PKCS1 signatures, but not decryption.
+                buf[1] = 1;
+                RawEncrypt(buf, e, n, c);
+                Assert.ThrowsAny<CryptographicException>(() => Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1));
+
+                // No RSA PKCS1 padding scheme starts with 00 FF.
+                buf[1] = 255;
+                RawEncrypt(buf, e, n, c);
+                Assert.ThrowsAny<CryptographicException>(() => Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1));
+
+                // Check again with a zero length payload
+                (afterMinPadding, lastByte) = (lastByte, afterMinPadding);
+                RawEncrypt(buf, e, n, c);
+                Assert.ThrowsAny<CryptographicException>(() => Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1));
+
+                // Back to valid padding
+                buf[1] = 2;
+                (afterMinPadding, lastByte) = (lastByte, afterMinPadding);
+                RawEncrypt(buf, e, n, c);
+                Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1);
+
+                // Try a zero in every possible required padding position
+                for (int i = 2; i < 10; i++)
+                {
+                    buf[i] = 0;
+
+                    RawEncrypt(buf, e, n, c);
+                    Assert.ThrowsAny<CryptographicException>(() => Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1));
+
+                    // It used to be 1, now it's 2, still not zero.
+                    buf[i] = 2;
+                }
+
+                // Back to valid padding
+                RawEncrypt(buf, e, n, c);
+                Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1);
+
+                // Make it such that
+                // "there is no octet with hexadecimal value 0x00 to separate PS from M"
+                // (RFC 3447 sec 7.2.2, rule 3, third clause)
+                buf.AsSpan(10).Fill(3);
+                RawEncrypt(buf, e, n, c);
+                Assert.ThrowsAny<CryptographicException>(() => Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1));
+
+                // Every possible problem, for good measure.
+                buf[0] = 2;
+                buf[1] = 0;
+                buf[4] = 0;
+                RawEncrypt(buf, e, n, c);
+                Assert.ThrowsAny<CryptographicException>(() => Decrypt(rsa, c, RSAEncryptionPadding.Pkcs1));
+            }
+
+            static void RawEncrypt(ReadOnlySpan<byte> source, BigInteger e, BigInteger n, Span<byte> destination)
+            {
+                BigInteger m = new BigInteger(source, true, true);
+                BigInteger c = BigInteger.ModPow(m, e, n);
+                int shift = destination.Length - c.GetByteCount(true);
+                destination.Slice(0, shift).Clear();
+                bool wrote = c.TryWriteBytes(destination.Slice(shift), out int written, true, true);
+
+                if (!wrote || written + shift != destination.Length)
+                {
+                    throw new InvalidOperationException();
+                }
+            }
+        }
+
         public static IEnumerable<object[]> OaepPaddingModes
         {
             get
diff --git a/src/libraries/Microsoft.NETCore.Platforms/src/Microsoft.NETCore.Platforms.csproj b/src/libraries/Microsoft.NETCore.Platforms/src/Microsoft.NETCore.Platforms.csproj
index fc06a0deae9bb..eb2be04a4ca5e 100644
--- a/src/libraries/Microsoft.NETCore.Platforms/src/Microsoft.NETCore.Platforms.csproj
+++ b/src/libraries/Microsoft.NETCore.Platforms/src/Microsoft.NETCore.Platforms.csproj
@@ -18,7 +18,7 @@
 
     <!-- When building from source, ensure the RID we're building for is part of the RID graph -->
     <AdditionalRuntimeIdentifiers Condition="'$(DotNetBuildFromSource)' == 'true'">$(AdditionalRuntimeIdentifiers);$(OutputRID)</AdditionalRuntimeIdentifiers>
-    <ServicingVersion>12</ServicingVersion>
+    <ServicingVersion>13</ServicingVersion>
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
   </PropertyGroup>
 
diff --git a/src/libraries/Microsoft.NETCore.Platforms/src/runtime.compatibility.json b/src/libraries/Microsoft.NETCore.Platforms/src/runtime.compatibility.json
index 809c62872a898..a1397baaf8fde 100644
--- a/src/libraries/Microsoft.NETCore.Platforms/src/runtime.compatibility.json
+++ b/src/libraries/Microsoft.NETCore.Platforms/src/runtime.compatibility.json
@@ -1570,6 +1570,461 @@
     "any",
     "base"
   ],
+  "alpine.3.19": [
+    "alpine.3.19",
+    "alpine.3.18",
+    "alpine.3.17",
+    "alpine.3.16",
+    "alpine.3.15",
+    "alpine.3.14",
+    "alpine.3.13",
+    "alpine.3.12",
+    "alpine.3.11",
+    "alpine.3.10",
+    "alpine.3.9",
+    "alpine.3.8",
+    "alpine.3.7",
+    "alpine.3.6",
+    "alpine",
+    "linux-musl",
+    "linux",
+    "unix",
+    "any",
+    "base"
+  ],
+  "alpine.3.19-arm": [
+    "alpine.3.19-arm",
+    "alpine.3.19",
+    "alpine.3.18-arm",
+    "alpine.3.18",
+    "alpine.3.17-arm",
+    "alpine.3.17",
+    "alpine.3.16-arm",
+    "alpine.3.16",
+    "alpine.3.15-arm",
+    "alpine.3.15",
+    "alpine.3.14-arm",
+    "alpine.3.14",
+    "alpine.3.13-arm",
+    "alpine.3.13",
+    "alpine.3.12-arm",
+    "alpine.3.12",
+    "alpine.3.11-arm",
+    "alpine.3.11",
+    "alpine.3.10-arm",
+    "alpine.3.10",
+    "alpine.3.9-arm",
+    "alpine.3.9",
+    "alpine.3.8-arm",
+    "alpine.3.8",
+    "alpine.3.7-arm",
+    "alpine.3.7",
+    "alpine.3.6-arm",
+    "alpine.3.6",
+    "alpine-arm",
+    "alpine",
+    "linux-musl-arm",
+    "linux-musl",
+    "linux-arm",
+    "linux",
+    "unix-arm",
+    "unix",
+    "any",
+    "base"
+  ],
+  "alpine.3.19-arm64": [
+    "alpine.3.19-arm64",
+    "alpine.3.19",
+    "alpine.3.18-arm64",
+    "alpine.3.18",
+    "alpine.3.17-arm64",
+    "alpine.3.17",
+    "alpine.3.16-arm64",
+    "alpine.3.16",
+    "alpine.3.15-arm64",
+    "alpine.3.15",
+    "alpine.3.14-arm64",
+    "alpine.3.14",
+    "alpine.3.13-arm64",
+    "alpine.3.13",
+    "alpine.3.12-arm64",
+    "alpine.3.12",
+    "alpine.3.11-arm64",
+    "alpine.3.11",
+    "alpine.3.10-arm64",
+    "alpine.3.10",
+    "alpine.3.9-arm64",
+    "alpine.3.9",
+    "alpine.3.8-arm64",
+    "alpine.3.8",
+    "alpine.3.7-arm64",
+    "alpine.3.7",
+    "alpine.3.6-arm64",
+    "alpine.3.6",
+    "alpine-arm64",
+    "alpine",
+    "linux-musl-arm64",
+    "linux-musl",
+    "linux-arm64",
+    "linux",
+    "unix-arm64",
+    "unix",
+    "any",
+    "base"
+  ],
+  "alpine.3.19-s390x": [
+    "alpine.3.19-s390x",
+    "alpine.3.19",
+    "alpine.3.18-s390x",
+    "alpine.3.18",
+    "alpine.3.17-s390x",
+    "alpine.3.17",
+    "alpine.3.16-s390x",
+    "alpine.3.16",
+    "alpine.3.15-s390x",
+    "alpine.3.15",
+    "alpine.3.14-s390x",
+    "alpine.3.14",
+    "alpine.3.13-s390x",
+    "alpine.3.13",
+    "alpine.3.12-s390x",
+    "alpine.3.12",
+    "alpine.3.11-s390x",
+    "alpine.3.11",
+    "alpine.3.10-s390x",
+    "alpine.3.10",
+    "alpine.3.9-s390x",
+    "alpine.3.9",
+    "alpine.3.8-s390x",
+    "alpine.3.8",
+    "alpine.3.7-s390x",
+    "alpine.3.7",
+    "alpine.3.6-s390x",
+    "alpine.3.6",
+    "alpine-s390x",
+    "alpine",
+    "linux-musl-s390x",
+    "linux-musl",
+    "linux-s390x",
+    "linux",
+    "unix-s390x",
+    "unix",
+    "any",
+    "base"
+  ],
+  "alpine.3.19-x64": [
+    "alpine.3.19-x64",
+    "alpine.3.19",
+    "alpine.3.18-x64",
+    "alpine.3.18",
+    "alpine.3.17-x64",
+    "alpine.3.17",
+    "alpine.3.16-x64",
+    "alpine.3.16",
+    "alpine.3.15-x64",
+    "alpine.3.15",
+    "alpine.3.14-x64",
+    "alpine.3.14",
+    "alpine.3.13-x64",
+    "alpine.3.13",
+    "alpine.3.12-x64",
+    "alpine.3.12",
+    "alpine.3.11-x64",
+    "alpine.3.11",
+    "alpine.3.10-x64",
+    "alpine.3.10",
+    "alpine.3.9-x64",
+    "alpine.3.9",
+    "alpine.3.8-x64",
+    "alpine.3.8",
+    "alpine.3.7-x64",
+    "alpine.3.7",
+    "alpine.3.6-x64",
+    "alpine.3.6",
+    "alpine-x64",
+    "alpine",
+    "linux-musl-x64",
+    "linux-musl",
+    "linux-x64",
+    "linux",
+    "unix-x64",
+    "unix",
+    "any",
+    "base"
+  ],
+  "alpine.3.19-x86": [
+    "alpine.3.19-x86",
+    "alpine.3.19",
+    "alpine.3.18-x86",
+    "alpine.3.18",
+    "alpine.3.17-x86",
+    "alpine.3.17",
+    "alpine.3.16-x86",
+    "alpine.3.16",
+    "alpine.3.15-x86",
+    "alpine.3.15",
+    "alpine.3.14-x86",
+    "alpine.3.14",
+    "alpine.3.13-x86",
+    "alpine.3.13",
+    "alpine.3.12-x86",
+    "alpine.3.12",
+    "alpine.3.11-x86",
+    "alpine.3.11",
+    "alpine.3.10-x86",
+    "alpine.3.10",
+    "alpine.3.9-x86",
+    "alpine.3.9",
+    "alpine.3.8-x86",
+    "alpine.3.8",
+    "alpine.3.7-x86",
+    "alpine.3.7",
+    "alpine.3.6-x86",
+    "alpine.3.6",
+    "alpine-x86",
+    "alpine",
+    "linux-musl-x86",
+    "linux-musl",
+    "linux-x86",
+    "linux",
+    "unix-x86",
+    "unix",
+    "any",
+    "base"
+  ],
+  "alpine.3.20": [
+    "alpine.3.20",
+    "alpine.3.19",
+    "alpine.3.18",
+    "alpine.3.17",
+    "alpine.3.16",
+    "alpine.3.15",
+    "alpine.3.14",
+    "alpine.3.13",
+    "alpine.3.12",
+    "alpine.3.11",
+    "alpine.3.10",
+    "alpine.3.9",
+    "alpine.3.8",
+    "alpine.3.7",
+    "alpine.3.6",
+    "alpine",
+    "linux-musl",
+    "linux",
+    "unix",
+    "any",
+    "base"
+  ],
+  "alpine.3.20-arm": [
+    "alpine.3.20-arm",
+    "alpine.3.20",
+    "alpine.3.19-arm",
+    "alpine.3.19",
+    "alpine.3.18-arm",
+    "alpine.3.18",
+    "alpine.3.17-arm",
+    "alpine.3.17",
+    "alpine.3.16-arm",
+    "alpine.3.16",
+    "alpine.3.15-arm",
+    "alpine.3.15",
+    "alpine.3.14-arm",
+    "alpine.3.14",
+    "alpine.3.13-arm",
+    "alpine.3.13",
+    "alpine.3.12-arm",
+    "alpine.3.12",
+    "alpine.3.11-arm",
+    "alpine.3.11",
+    "alpine.3.10-arm",
+    "alpine.3.10",
+    "alpine.3.9-arm",
+    "alpine.3.9",
+    "alpine.3.8-arm",
+    "alpine.3.8",
+    "alpine.3.7-arm",
+    "alpine.3.7",
+    "alpine.3.6-arm",
+    "alpine.3.6",
+    "alpine-arm",
+    "alpine",
+    "linux-musl-arm",
+    "linux-musl",
+    "linux-arm",
+    "linux",
+    "unix-arm",
+    "unix",
+    "any",
+    "base"
+  ],
+  "alpine.3.20-arm64": [
+    "alpine.3.20-arm64",
+    "alpine.3.20",
+    "alpine.3.19-arm64",
+    "alpine.3.19",
+    "alpine.3.18-arm64",
+    "alpine.3.18",
+    "alpine.3.17-arm64",
+    "alpine.3.17",
+    "alpine.3.16-arm64",
+    "alpine.3.16",
+    "alpine.3.15-arm64",
+    "alpine.3.15",
+    "alpine.3.14-arm64",
+    "alpine.3.14",
+    "alpine.3.13-arm64",
+    "alpine.3.13",
+    "alpine.3.12-arm64",
+    "alpine.3.12",
+    "alpine.3.11-arm64",
+    "alpine.3.11",
+    "alpine.3.10-arm64",
+    "alpine.3.10",
+    "alpine.3.9-arm64",
+    "alpine.3.9",
+    "alpine.3.8-arm64",
+    "alpine.3.8",
+    "alpine.3.7-arm64",
+    "alpine.3.7",
+    "alpine.3.6-arm64",
+    "alpine.3.6",
+    "alpine-arm64",
+    "alpine",
+    "linux-musl-arm64",
+    "linux-musl",
+    "linux-arm64",
+    "linux",
+    "unix-arm64",
+    "unix",
+    "any",
+    "base"
+  ],
+  "alpine.3.20-s390x": [
+    "alpine.3.20-s390x",
+    "alpine.3.20",
+    "alpine.3.19-s390x",
+    "alpine.3.19",
+    "alpine.3.18-s390x",
+    "alpine.3.18",
+    "alpine.3.17-s390x",
+    "alpine.3.17",
+    "alpine.3.16-s390x",
+    "alpine.3.16",
+    "alpine.3.15-s390x",
+    "alpine.3.15",
+    "alpine.3.14-s390x",
+    "alpine.3.14",
+    "alpine.3.13-s390x",
+    "alpine.3.13",
+    "alpine.3.12-s390x",
+    "alpine.3.12",
+    "alpine.3.11-s390x",
+    "alpine.3.11",
+    "alpine.3.10-s390x",
+    "alpine.3.10",
+    "alpine.3.9-s390x",
+    "alpine.3.9",
+    "alpine.3.8-s390x",
+    "alpine.3.8",
+    "alpine.3.7-s390x",
+    "alpine.3.7",
+    "alpine.3.6-s390x",
+    "alpine.3.6",
+    "alpine-s390x",
+    "alpine",
+    "linux-musl-s390x",
+    "linux-musl",
+    "linux-s390x",
+    "linux",
+    "unix-s390x",
+    "unix",
+    "any",
+    "base"
+  ],
+  "alpine.3.20-x64": [
+    "alpine.3.20-x64",
+    "alpine.3.20",
+    "alpine.3.19-x64",
+    "alpine.3.19",
+    "alpine.3.18-x64",
+    "alpine.3.18",
+    "alpine.3.17-x64",
+    "alpine.3.17",
+    "alpine.3.16-x64",
+    "alpine.3.16",
+    "alpine.3.15-x64",
+    "alpine.3.15",
+    "alpine.3.14-x64",
+    "alpine.3.14",
+    "alpine.3.13-x64",
+    "alpine.3.13",
+    "alpine.3.12-x64",
+    "alpine.3.12",
+    "alpine.3.11-x64",
+    "alpine.3.11",
+    "alpine.3.10-x64",
+    "alpine.3.10",
+    "alpine.3.9-x64",
+    "alpine.3.9",
+    "alpine.3.8-x64",
+    "alpine.3.8",
+    "alpine.3.7-x64",
+    "alpine.3.7",
+    "alpine.3.6-x64",
+    "alpine.3.6",
+    "alpine-x64",
+    "alpine",
+    "linux-musl-x64",
+    "linux-musl",
+    "linux-x64",
+    "linux",
+    "unix-x64",
+    "unix",
+    "any",
+    "base"
+  ],
+  "alpine.3.20-x86": [
+    "alpine.3.20-x86",
+    "alpine.3.20",
+    "alpine.3.19-x86",
+    "alpine.3.19",
+    "alpine.3.18-x86",
+    "alpine.3.18",
+    "alpine.3.17-x86",
+    "alpine.3.17",
+    "alpine.3.16-x86",
+    "alpine.3.16",
+    "alpine.3.15-x86",
+    "alpine.3.15",
+    "alpine.3.14-x86",
+    "alpine.3.14",
+    "alpine.3.13-x86",
+    "alpine.3.13",
+    "alpine.3.12-x86",
+    "alpine.3.12",
+    "alpine.3.11-x86",
+    "alpine.3.11",
+    "alpine.3.10-x86",
+    "alpine.3.10",
+    "alpine.3.9-x86",
+    "alpine.3.9",
+    "alpine.3.8-x86",
+    "alpine.3.8",
+    "alpine.3.7-x86",
+    "alpine.3.7",
+    "alpine.3.6-x86",
+    "alpine.3.6",
+    "alpine-x86",
+    "alpine",
+    "linux-musl-x86",
+    "linux-musl",
+    "linux-x86",
+    "linux",
+    "unix-x86",
+    "unix",
+    "any",
+    "base"
+  ],
   "alpine.3.6": [
     "alpine.3.6",
     "alpine",
@@ -10802,4 +11257,4 @@
     "any",
     "base"
   ]
-}
\ No newline at end of file
+}
diff --git a/src/libraries/Microsoft.NETCore.Platforms/src/runtime.json b/src/libraries/Microsoft.NETCore.Platforms/src/runtime.json
index ac8a62325fbfd..32ba949a6f806 100644
--- a/src/libraries/Microsoft.NETCore.Platforms/src/runtime.json
+++ b/src/libraries/Microsoft.NETCore.Platforms/src/runtime.json
@@ -350,6 +350,76 @@
         "alpine.3.17-x86"
       ]
     },
+    "alpine.3.19": {
+      "#import": [
+        "alpine.3.18"
+      ]
+    },
+    "alpine.3.19-arm": {
+      "#import": [
+        "alpine.3.19",
+        "alpine.3.18-arm"
+      ]
+    },
+    "alpine.3.19-arm64": {
+      "#import": [
+        "alpine.3.19",
+        "alpine.3.18-arm64"
+      ]
+    },
+    "alpine.3.19-s390x": {
+      "#import": [
+        "alpine.3.19",
+        "alpine.3.18-s390x"
+      ]
+    },
+    "alpine.3.19-x64": {
+      "#import": [
+        "alpine.3.19",
+        "alpine.3.18-x64"
+      ]
+    },
+    "alpine.3.19-x86": {
+      "#import": [
+        "alpine.3.19",
+        "alpine.3.18-x86"
+      ]
+    },
+    "alpine.3.20": {
+      "#import": [
+        "alpine.3.19"
+      ]
+    },
+    "alpine.3.20-arm": {
+      "#import": [
+        "alpine.3.20",
+        "alpine.3.19-arm"
+      ]
+    },
+    "alpine.3.20-arm64": {
+      "#import": [
+        "alpine.3.20",
+        "alpine.3.19-arm64"
+      ]
+    },
+    "alpine.3.20-s390x": {
+      "#import": [
+        "alpine.3.20",
+        "alpine.3.19-s390x"
+      ]
+    },
+    "alpine.3.20-x64": {
+      "#import": [
+        "alpine.3.20",
+        "alpine.3.19-x64"
+      ]
+    },
+    "alpine.3.20-x86": {
+      "#import": [
+        "alpine.3.20",
+        "alpine.3.19-x86"
+      ]
+    },
     "alpine.3.6": {
       "#import": [
         "alpine"
@@ -4331,4 +4401,4 @@
       ]
     }
   }
-}
\ No newline at end of file
+}
diff --git a/src/libraries/Microsoft.NETCore.Platforms/src/runtimeGroups.props b/src/libraries/Microsoft.NETCore.Platforms/src/runtimeGroups.props
index 71f41149bc93b..06ca771082ec3 100644
--- a/src/libraries/Microsoft.NETCore.Platforms/src/runtimeGroups.props
+++ b/src/libraries/Microsoft.NETCore.Platforms/src/runtimeGroups.props
@@ -16,7 +16,7 @@
     <RuntimeGroup Include="alpine">
       <Parent>linux-musl</Parent>
       <Architectures>x64;x86;arm;arm64;s390x</Architectures>
-      <Versions>3.6;3.7;3.8;3.9;3.10;3.11;3.12;3.13;3.14;3.15;3.16;3.17;3.18</Versions>
+      <Versions>3.6;3.7;3.8;3.9;3.10;3.11;3.12;3.13;3.14;3.15;3.16;3.17;3.18;3.19;3.20</Versions>
     </RuntimeGroup>
 
     <RuntimeGroup Include="android">
diff --git a/src/libraries/Microsoft.Windows.Compatibility/src/Microsoft.Windows.Compatibility.csproj b/src/libraries/Microsoft.Windows.Compatibility/src/Microsoft.Windows.Compatibility.csproj
index 0e13d0d42f37e..a86115b820874 100644
--- a/src/libraries/Microsoft.Windows.Compatibility/src/Microsoft.Windows.Compatibility.csproj
+++ b/src/libraries/Microsoft.Windows.Compatibility/src/Microsoft.Windows.Compatibility.csproj
@@ -5,7 +5,7 @@
     <!-- Reference the outputs for the dependency nodes calculation. -->
     <NoTargetsDoNotReferenceOutputAssemblies>false</NoTargetsDoNotReferenceOutputAssemblies>
     <IsPackable>true</IsPackable>
-    <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
+    <GeneratePackageOnBuild>false</GeneratePackageOnBuild>
     <ServicingVersion>8</ServicingVersion>
     <!-- This is a meta package and doesn't contain any libs. -->
     <NoWarn>$(NoWarn);NU5128</NoWarn>
diff --git a/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/entrypoints.c b/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/entrypoints.c
index db75e90b3a436..2a1b138e4b51f 100644
--- a/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/entrypoints.c
+++ b/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/entrypoints.c
@@ -63,6 +63,7 @@ static const Entry s_cryptoAppleNative[] =
     DllImportEntry(AppleCryptoNative_RsaGenerateKey)
     DllImportEntry(AppleCryptoNative_RsaDecryptOaep)
     DllImportEntry(AppleCryptoNative_RsaDecryptPkcs)
+    DllImportEntry(AppleCryptoNative_RsaDecryptRaw)
     DllImportEntry(AppleCryptoNative_RsaEncryptOaep)
     DllImportEntry(AppleCryptoNative_RsaEncryptPkcs)
     DllImportEntry(AppleCryptoNative_RsaSignaturePrimitive)
diff --git a/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_rsa.c b/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_rsa.c
index a9aece35fb0f5..1746828d5b0d7 100644
--- a/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_rsa.c
+++ b/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_rsa.c
@@ -134,6 +134,13 @@ int32_t AppleCryptoNative_RsaDecryptOaep(SecKeyRef privateKey,
         privateKey, pbData, cbData, pDecryptedOut, pErrorOut, mgfAlgorithm, SecKeyCreateDecryptedData);
 }
 
+int32_t AppleCryptoNative_RsaDecryptRaw(
+    SecKeyRef privateKey, uint8_t* pbData, int32_t cbData, CFDataRef* pDecryptedOut, CFErrorRef* pErrorOut)
+{
+    return RsaPrimitive(
+        privateKey, pbData, cbData, pDecryptedOut, pErrorOut, kSecKeyAlgorithmRSAEncryptionRaw, SecKeyCreateDecryptedData);
+}
+
 int32_t AppleCryptoNative_RsaDecryptPkcs(
     SecKeyRef privateKey, uint8_t* pbData, int32_t cbData, CFDataRef* pDecryptedOut, CFErrorRef* pErrorOut)
 {
diff --git a/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_rsa.h b/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_rsa.h
index 253fdae78e4b3..34a350f80f9bc 100644
--- a/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_rsa.h
+++ b/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_rsa.h
@@ -31,6 +31,14 @@ PALEXPORT int32_t AppleCryptoNative_RsaDecryptOaep(SecKeyRef privateKey,
                                                    CFDataRef* pDecryptedOut,
                                                    CFErrorRef* pErrorOut);
 
+/*
+Decrypt the contents of pbData using the provided privateKey without validating or removing padding.
+
+Follows pal_seckey return conventions.
+*/
+PALEXPORT int32_t AppleCryptoNative_RsaDecryptRaw(
+    SecKeyRef privateKey, uint8_t* pbData, int32_t cbData, CFDataRef* pDecryptedOut, CFErrorRef* pErrorOut);
+
 /*
 Decrypt the contents of pbData using the provided privateKey under PKCS#1 padding.
 
diff --git a/src/libraries/System.Security.AccessControl/ref/System.Security.AccessControl.net461.cs b/src/libraries/System.Security.AccessControl/ref/System.Security.AccessControl.net461.cs
index 9fa292c50bbb7..ff36e7ac84125 100644
--- a/src/libraries/System.Security.AccessControl/ref/System.Security.AccessControl.net461.cs
+++ b/src/libraries/System.Security.AccessControl/ref/System.Security.AccessControl.net461.cs
@@ -50,3 +50,5 @@
 [assembly: TypeForwardedTo(typeof(System.Security.AccessControl.ResourceType))]
 [assembly: TypeForwardedTo(typeof(System.Security.AccessControl.SecurityInfos))]
 [assembly: TypeForwardedTo(typeof(System.Security.AccessControl.SystemAcl))]
+[assembly: TypeForwardedTo(typeof(System.Security.Policy.Evidence))]
+[assembly: TypeForwardedTo(typeof(System.Security.Policy.EvidenceBase))]
diff --git a/src/libraries/System.Security.AccessControl/src/System.Security.AccessControl.csproj b/src/libraries/System.Security.AccessControl/src/System.Security.AccessControl.csproj
index 90ad8ce8968f2..6a6304598900b 100644
--- a/src/libraries/System.Security.AccessControl/src/System.Security.AccessControl.csproj
+++ b/src/libraries/System.Security.AccessControl/src/System.Security.AccessControl.csproj
@@ -4,8 +4,8 @@
     <TargetFrameworks>$(NetCoreAppCurrent)-windows;$(NetCoreAppCurrent);netstandard2.0-windows;netstandard2.0;net461-windows</TargetFrameworks>
     <IsPackable>true</IsPackable>
     <!-- If you enable GeneratePackageOnBuild for this package and bump ServicingVersion, make sure to also bump ServicingVersion in Microsoft.Windows.Compatibility.csproj once for the next release. -->
-    <GeneratePackageOnBuild>false</GeneratePackageOnBuild>
-    <ServicingVersion>0</ServicingVersion>
+    <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
+    <ServicingVersion>1</ServicingVersion>
     <PackageDescription>Provides base classes that enable managing access and audit control lists on securable objects.
 
 Commonly Used Types:
diff --git a/src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj b/src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj
index 951f229ed4e62..3bb3f45e43cd3 100644
--- a/src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj
+++ b/src/libraries/System.Security.Cryptography.Pkcs/src/System.Security.Cryptography.Pkcs.csproj
@@ -8,7 +8,7 @@
     <IsPackable>true</IsPackable>
     <!-- If you enable GeneratePackageOnBuild for this package and bump ServicingVersion, make sure to also bump ServicingVersion in Microsoft.Windows.Compatibility.csproj once for the next release. -->
     <GeneratePackageOnBuild>false</GeneratePackageOnBuild>
-    <ServicingVersion>3</ServicingVersion>
+    <ServicingVersion>4</ServicingVersion>
     <PackageDescription>Provides support for PKCS and CMS algorithms.
 
 Commonly Used Types:
diff --git a/src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx b/src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx
index a5624952731d8..f16b13441fbf2 100644
--- a/src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx
+++ b/src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx
@@ -193,6 +193,9 @@
   <data name="Cryptography_InvalidOID" xml:space="preserve">
     <value>Object identifier (OID) is unknown.</value>
   </data>
+  <data name="Cryptography_InvalidPadding" xml:space="preserve">
+    <value>Padding is invalid and cannot be removed.</value>
+  </data>
   <data name="Cryptography_InvalidPaddingMode" xml:space="preserve">
     <value>Specified padding mode is not valid for this algorithm.</value>
   </data>