diff --git a/.github/workflows/msstore-publish.yml b/.github/workflows/msstore-publish.yml
index c16ddd872d..fe3892e4dc 100644
--- a/.github/workflows/msstore-publish.yml
+++ b/.github/workflows/msstore-publish.yml
@@ -82,20 +82,27 @@ jobs:
       #        MSSTORE_PRODUCT_ID    – Partner Center app overview → Store Product ID
       #        MSSTORE_CLIENT_ID     – app registration client ID
       #        MSSTORE_CLIENT_SECRET – client secret for that app registration
-      # microsoft/store-submission is a thin wrapper over the stable Store
-      # submission API v1; it declares node16 and the runner transparently
-      # executes it on a current Node with a deprecation warning.
+      # The MSStore CLI talks to the same Store submission API; it replaces the
+      # deprecated microsoft/store-submission action, which is being archived.
+      - name: Set up MSStore CLI
+        if: env.HAS_MSSTORE_CREDS == 'true'
+        uses: microsoft/microsoft-store-apppublisher@cc9910a8d59f2eb55cbb83df0a3800cf3b5300e0 # v1.4
+        with:
+          version: v0.4.1
+
       - name: Configure Store credentials
         if: env.HAS_MSSTORE_CREDS == 'true'
-        uses: microsoft/store-submission@v1
-        with:
-          command: configure
-          type: win32
-          seller-id: ${{ secrets.MSSTORE_SELLER_ID }}
-          product-id: ${{ secrets.MSSTORE_PRODUCT_ID }}
-          tenant-id: ${{ secrets.MSSTORE_TENANT_ID }}
-          client-id: ${{ secrets.MSSTORE_CLIENT_ID }}
-          client-secret: ${{ secrets.MSSTORE_CLIENT_SECRET }}
+        env:
+          MSSTORE_SELLER_ID: ${{ secrets.MSSTORE_SELLER_ID }}
+          MSSTORE_TENANT_ID: ${{ secrets.MSSTORE_TENANT_ID }}
+          MSSTORE_CLIENT_ID: ${{ secrets.MSSTORE_CLIENT_ID }}
+          MSSTORE_CLIENT_SECRET: ${{ secrets.MSSTORE_CLIENT_SECRET }}
+        run: >-
+          msstore reconfigure
+          --tenantId "$MSSTORE_TENANT_ID"
+          --sellerId "$MSSTORE_SELLER_ID"
+          --clientId "$MSSTORE_CLIENT_ID"
+          --clientSecret "$MSSTORE_CLIENT_SECRET"
 
       # Full replace of the draft submission's package set (PUT semantics):
       # the listing always points at exactly the current production MSI.
@@ -103,10 +110,9 @@ jobs:
       # install via msiexec flags; genericDocUrl/errorDetails are EXE-only.
       - name: Update draft submission with new MSI
         if: env.HAS_MSSTORE_CREDS == 'true'
-        uses: microsoft/store-submission@v1
-        with:
-          command: update
-          product-update: >-
+        env:
+          MSSTORE_PRODUCT_ID: ${{ secrets.MSSTORE_PRODUCT_ID }}
+          PRODUCT_UPDATE: >-
             {"packages":[{
             "packageUrl":"${{ steps.msi.outputs.url }}",
             "languages":["en-us"],
@@ -115,12 +121,13 @@ jobs:
             "installerParameters":"/quiet /norestart",
             "packageType":"msi"
             }]}
+        run: msstore submission update "$MSSTORE_PRODUCT_ID" "$PRODUCT_UPDATE"
 
       # Fire-and-forget: this starts Store certification, which takes 1–3
       # business days. Track progress in Partner Center; a rejection there
       # does not surface here.
       - name: Publish submission
         if: env.HAS_MSSTORE_CREDS == 'true'
-        uses: microsoft/store-submission@v1
-        with:
-          command: publish
+        env:
+          MSSTORE_PRODUCT_ID: ${{ secrets.MSSTORE_PRODUCT_ID }}
+        run: msstore submission publish "$MSSTORE_PRODUCT_ID"