diff --git a/.ado/integrate-rn.yaml b/.ado/integrate-rn.yaml
index cfb5985c3f9..b305f650348 100644
--- a/.ado/integrate-rn.yaml
+++ b/.ado/integrate-rn.yaml
@@ -24,8 +24,6 @@ jobs:
     steps:
       - template: templates/checkout-full.yml
 
-      - template: templates/configure-git.yml
-
       - template: templates/prepare-js-env.yml
 
       - script: git checkout -b integrate-${{ parameters.reactNativeVersion }} origin/main
diff --git a/.ado/jobs/cli-init.yml b/.ado/jobs/cli-init.yml
index e09ec27b417..18059042883 100644
--- a/.ado/jobs/cli-init.yml
+++ b/.ado/jobs/cli-init.yml
@@ -333,8 +333,8 @@ jobs:
 
             steps:
               - template: ../templates/checkout-full.yml
-
-              - template: ../templates/configure-git.yml
+                parameters:
+                  persistCredentials: false # We don't need git creds in this job
 
               - template: ../templates/prepare-js-env.yml
 
diff --git a/.ado/jobs/setup.yml b/.ado/jobs/setup.yml
index 7524265853c..09760516e5b 100644
--- a/.ado/jobs/setup.yml
+++ b/.ado/jobs/setup.yml
@@ -14,6 +14,8 @@ jobs:
 
     steps:
       - template: ../templates/checkout-full.yml
+        parameters:
+          persistCredentials: true # Git creds needed for beachball
 
       - powershell: gci env:/BUILD_*
         displayName: Show build information
diff --git a/.ado/publish.yml b/.ado/publish.yml
index d0a62da7fe8..d8e931f9a4b 100644
--- a/.ado/publish.yml
+++ b/.ado/publish.yml
@@ -56,7 +56,7 @@ jobs:
 
       - template: templates/checkout-full.yml
         parameters:
-          persistCredentials: false # We're going to use rnbot's credentials to publish
+          persistCredentials: false # We're going to use rnbot's git creds to publish
 
       - powershell: gci env:/BUILD_*
         displayName: Show build information  
diff --git a/.ado/templates/checkout-full.yml b/.ado/templates/checkout-full.yml
index e183f7a02ba..034eeb056b0 100644
--- a/.ado/templates/checkout-full.yml
+++ b/.ado/templates/checkout-full.yml
@@ -4,7 +4,7 @@
 parameters:
   - name: persistCredentials
     type: boolean
-    default: true
+    default: false # Make callers explicitly request credentials if they need them
 
 steps:
   - checkout: self