diff --git a/common/config/azure-pipelines/npm-post-publish.yaml b/common/config/azure-pipelines/npm-post-publish.yaml
index 483168fa09..a95355bc7d 100644
--- a/common/config/azure-pipelines/npm-post-publish.yaml
+++ b/common/config/azure-pipelines/npm-post-publish.yaml
@@ -116,6 +116,24 @@ extends:
                   Arguments: 'bump-decoupled-local-dependencies'
                   DisplayName: 'Bump decoupled local dependencies'
 
+              # If Rush itself was updated by bump-decoupled-local-dependencies, we need to bootstrap
+              # the new version and update the checked-in lockfile before running `rush update`.
+              # Otherwise install-run-rush.js would fail lockfile validation when trying to install
+              # the new version of Rush (the checked-in lockfile still references the old version).
+              - template: /common/config/azure-pipelines/templates/install-run-rush.yaml@self
+                parameters:
+                  Arguments: '--help'
+                  DisplayName: 'Install new Rush version (skip lockfile validation)'
+                  DisableInstallRunRushLockfile: true
+                  Condition: "eq(variables['RushWasUpdated'], 'true')"
+
+              - bash: >
+                  cp
+                  "common/temp/install-run/@microsoft+rush@$(NewRushVersion)/package-lock.json"
+                  common/config/validation/rush-package-lock.json
+                displayName: 'Update rush-package-lock.json (new Rush version)'
+                condition: eq(variables['RushWasUpdated'], 'true')
+
               - template: /common/config/azure-pipelines/templates/install-run-rush.yaml@self
                 parameters:
                   Arguments: 'update'
@@ -126,9 +144,6 @@ extends:
                   Arguments: 'update-autoinstaller --name plugins'
                   DisplayName: 'Rush Update Autoinstaller (plugins)'
 
-              - bash: cp common/temp/install-run/@microsoft+rush@*/package-lock.json common/config/validation/rush-package-lock.json
-                displayName: 'Update rush-package-lock.json'
-
               - bash: |
                   set -e
 
@@ -188,6 +203,8 @@ extends:
                 parameters:
                   Arguments: 'install'
                   DisplayName: 'Rush Install (rushstack-websites)'
+                  # rushstack-websites doesn't have an `install-run-rush` lockfile checked in
+                  DisableInstallRunRushLockfile: true
 
               - template: /common/config/azure-pipelines/templates/install-run-rush.yaml@self
                 parameters:
@@ -196,6 +213,8 @@ extends:
                     --to-except api.rushstack.io
                     --verbose
                   DisplayName: 'Rush Build to-except api.rushstack.io (rushstack-websites)'
+                  # rushstack-websites doesn't have an `install-run-rush` lockfile checked in
+                  DisableInstallRunRushLockfile: true
 
               # Download the api artifact from the triggering publish pipeline.
               # AzDO automatically resolves which pipeline resource triggered this run.
diff --git a/common/config/azure-pipelines/templates/install-run-rush.yaml b/common/config/azure-pipelines/templates/install-run-rush.yaml
index 07e064cd08..2a44f1c471 100644
--- a/common/config/azure-pipelines/templates/install-run-rush.yaml
+++ b/common/config/azure-pipelines/templates/install-run-rush.yaml
@@ -14,6 +14,9 @@ parameters:
   - name: RepoPath
     type: string
     default: '$(Build.SourcesDirectory)'
+  - name: DisableInstallRunRushLockfile
+    type: boolean
+    default: false
 
 steps:
   - script: 'node common/scripts/install-run-rush.js ${{ parameters.Arguments }}'
@@ -22,6 +25,7 @@ steps:
     ${{ if ne(parameters.Condition, '') }}:
       condition: ${{ parameters.Condition }}
     env:
-      INSTALL_RUN_RUSH_LOCKFILE_PATH: ${{ parameters.RepoPath }}/common/config/validation/rush-package-lock.json
+      ${{ if not(parameters.DisableInstallRunRushLockfile) }}:
+        INSTALL_RUN_RUSH_LOCKFILE_PATH: ${{ parameters.RepoPath }}/common/config/validation/rush-package-lock.json
       ${{ if ne(parameters.NpmAuthToken, '') }}:
         NPM_AUTH_TOKEN: ${{ parameters.NpmAuthToken }}
diff --git a/repo-scripts/repo-toolbox/src/cli/actions/BumpDecoupledLocalDependencies.ts b/repo-scripts/repo-toolbox/src/cli/actions/BumpDecoupledLocalDependencies.ts
index ef70cefc53..dd0b2ac40b 100644
--- a/repo-scripts/repo-toolbox/src/cli/actions/BumpDecoupledLocalDependencies.ts
+++ b/repo-scripts/repo-toolbox/src/cli/actions/BumpDecoupledLocalDependencies.ts
@@ -180,8 +180,19 @@ export class BumpDecoupledLocalDependencies extends CommandLineAction {
     // Update the Rush version in rush.json
     const latestRushVersion: string = await _getLatestPublishedVersionAsync(terminal, '@microsoft/rush');
     const rushJson: IRushConfigurationJson = await JsonFile.loadAsync(rushJsonFile);
-    rushJson.rushVersion = latestRushVersion;
-    await JsonFile.saveAsync(rushJson, rushJsonFile, { updateExistingFile: true });
-    terminal.writeLine(`Updated ${rushJsonFile}`);
+    const existingRushVersion: string = rushJson.rushVersion;
+    const rushWasUpdated: boolean = existingRushVersion !== latestRushVersion;
+    if (rushWasUpdated) {
+      rushJson.rushVersion = latestRushVersion;
+      await JsonFile.saveAsync(rushJson, rushJsonFile, { updateExistingFile: true });
+      terminal.writeLine(
+        `Updated ${rushJsonFile}: Rush version ${existingRushVersion} -> ${latestRushVersion}`
+      );
+    }
+
+    // Emit Azure Pipelines variables so subsequent pipeline steps can handle the Rush version change.
+    // These are no-ops when run outside of Azure Pipelines.
+    terminal.writeLine(`##vso[task.setvariable variable=NewRushVersion]${latestRushVersion}`);
+    terminal.writeLine(`##vso[task.setvariable variable=RushWasUpdated]${rushWasUpdated}`);
   }
 }