diff --git a/.github/workflows/build-agent.yml b/.github/workflows/build-agent.yml
index ce54ac3c..7da91c2f 100644
--- a/.github/workflows/build-agent.yml
+++ b/.github/workflows/build-agent.yml
@@ -73,7 +73,8 @@ jobs:
         run: |
           $counterBlob = "buildcounter-v$env:LINE_MAJOR.txt"
           $counterUrl = "https://autopilotmonitor.blob.core.windows.net/agent/$counterBlob"
-          $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}"
+          # Tolerate both secret formats ("sp=cw&..." and "?sp=cw&...") -- the URL below adds the '?'.
+          $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
           $override = "${{ inputs.build_number }}"
 
           function Get-Counter {
@@ -263,7 +264,7 @@ jobs:
         shell: pwsh
         run: |
           $containerUrl = "https://autopilotmonitor.blob.core.windows.net/agent"
-          $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}"
+          $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
 
           function Send-Blob {
             param([string]$Local, [string]$BlobName, [string]$ContentType)
@@ -299,7 +300,7 @@ jobs:
 
           # Update AdminConfiguration LatestAgentV2* -- ONLY on stable cutover. The hash-oracle
           # must never point at a build that is not actually in the stable namespace.
-          $tableSasToken = "${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}"
+          $tableSasToken = "${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}".TrimStart('?')
           if ('${{ inputs.publish_as_stable }}' -ne 'true') {
             Write-Host "SKIPPED: AdminConfiguration update (versioned-only run -- stable namespace unchanged)"
           } elseif ([string]::IsNullOrEmpty($tableSasToken) -or $tableSasToken -eq "XXX") {