diff --git a/eng/pipelines/templates/jobs/ci.yml b/eng/pipelines/templates/jobs/ci.yml
index 1494c22c09..1656ff2e8e 100644
--- a/eng/pipelines/templates/jobs/ci.yml
+++ b/eng/pipelines/templates/jobs/ci.yml
@@ -65,10 +65,18 @@ jobs:
         additionalComponentDetectorArgs: '--DirectoryExclusionList **/target/vendor/**'
 
   steps:
-  - template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
-    parameters:
-      paths:
-      - "/*"
+  # Pull requests require the target branch ref, but fetchDepth: 1 doesn't fetch additional refs.
+  # SDL Baselining requires a github token, but sparse checkout doesn't set one.
+  # Use Sparse Checkout for pull requests and native, shallow checkout for everything else.
+  - ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
+    - template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
+      parameters:
+        paths:
+        - "/*"
+  - ${{ else }}:
+    - checkout: self
+      fetchDepth: 1
+      persistCredentials: true
 
   - ${{ if and(eq(variables['System.TeamProject'], 'internal'), ne(variables['Build.Reason'], '')) }}:
     - script: |
diff --git a/eng/pipelines/templates/stages/1es-redirect.yml b/eng/pipelines/templates/stages/1es-redirect.yml
index bbbde35ab9..16c05382dd 100644
--- a/eng/pipelines/templates/stages/1es-redirect.yml
+++ b/eng/pipelines/templates/stages/1es-redirect.yml
@@ -19,6 +19,8 @@ parameters:
   - name: oneESTemplateTag
     type: string
     default: release
+  - name: isMainPipeline
+    type: boolean
 
 extends:
   ${{ if and(parameters.Use1ESOfficial, eq(parameters.oneESTemplateTag, 'canary')) }}:
@@ -36,7 +38,15 @@ extends:
         - 1ES.PT.Tag-refs/tags/canary
     settings:
       skipBuildTagsForGitHubPullRequests: true
+       # only enable autoBaseline for the internal build of rust-core on main branch
+      ${{ if and(eq(parameters.isMainPipeline, 'true'), eq(variables['Build.SourceBranchName'], 'main'), eq(variables['System.TeamProject'], 'internal')) }}:
+        featureFlags:
+          autoBaseline: true
     sdl:
+      ${{ if and(eq(parameters.isMainPipeline, 'true'), eq(variables['Build.SourceBranchName'], 'main'), eq(variables['System.TeamProject'], 'internal')) }}:
+        autoBaseline:
+          isMainPipeline: true
+          enableForGitHub: true
       sourceAnalysisPool:
         name: azsdk-pool-mms-win-2022-general
         image: azsdk-pool-mms-win-2022-1espt
diff --git a/eng/pipelines/templates/stages/archetype-sdk-client.yml b/eng/pipelines/templates/stages/archetype-sdk-client.yml
index 826291e318..410f0a1d48 100644
--- a/eng/pipelines/templates/stages/archetype-sdk-client.yml
+++ b/eng/pipelines/templates/stages/archetype-sdk-client.yml
@@ -13,6 +13,9 @@ parameters:
 - name: GenerateApiReviewForManualOnly
   type: boolean
   default: false
+- name: IsMainPipeline
+  type: boolean
+  default: false
 - name: oneESTemplateTag
   type: string
   default: release
@@ -21,6 +24,7 @@ extends:
   template: /eng/pipelines/templates/stages/1es-redirect.yml
   parameters:
     oneESTemplateTag: ${{ parameters.oneESTemplateTag }}
+    isMainPipeline: ${{ parameters.IsMainPipeline }}
     stages:
     - stage: Build
       variables:
diff --git a/sdk/core/ci.yml b/sdk/core/ci.yml
index 213e3ee680..014e52e57e 100644
--- a/sdk/core/ci.yml
+++ b/sdk/core/ci.yml
@@ -13,6 +13,7 @@ trigger:
 extends:
   template: /eng/pipelines/templates/stages/archetype-sdk-client.yml
   parameters:
+    IsMainPipeline: true
     ServiceDirectory: core
     Artifacts:
     - name: azure_core