diff --git a/bazel_tools/os_info.bzl b/bazel_tools/os_info.bzl
index 33ca24b8f4..871e245dfb 100644
--- a/bazel_tools/os_info.bzl
+++ b/bazel_tools/os_info.bzl
@@ -18,10 +18,10 @@ is_intel = is_windows or is_darwin or is_linux_intel
 def _os_info_impl(repository_ctx):
     cpu = get_cpu_value(repository_ctx)
     known_cpu_values = [
-        "aarch64", # linux arm64
-        "darwin", # macOS amd64
-        "darwin_arm64", # macOS arm64
-        "k8", # linux amd64
+        "aarch64",  # linux arm64
+        "darwin",  # macOS amd64
+        "darwin_arm64",  # macOS arm64
+        "k8",  # linux amd64
         "x64_windows",
     ]
     if cpu not in known_cpu_values:
diff --git a/ci/build-unix.yml b/ci/build-unix.yml
index 8179f2b136..ed9b355741 100644
--- a/ci/build-unix.yml
+++ b/ci/build-unix.yml
@@ -3,7 +3,8 @@
 
 parameters:
   is_release: ''
-  name: ''
+  name_str: ''
+  name_exp: ''
   release_tag: ''
   scala_version: ''
   test_mode: ''
@@ -13,7 +14,7 @@ steps:
     displayName: 'Build/Install the Developer Environment'
     condition: and(succeeded(),
                    or(eq(${{parameters.is_release}}, 'false'),
-                      ne('${{parameters.name}}', 'm1')))
+                      ne(${{parameters.name_exp}}, 'm1')))
 
   - bash: |
       source dev-env/lib/ensure-nix
@@ -22,7 +23,7 @@ steps:
     condition: and(succeeded(),
                    eq(variables['System.PullRequest.IsFork'], 'False'),
                    or(eq(${{parameters.is_release}}, 'false'),
-                      ne('${{parameters.name}}', 'm1')))
+                      ne(${{parameters.name_exp}}, 'm1')))
     env:
       # to upload to the Nix cache
       GOOGLE_APPLICATION_CREDENTIALS_CONTENT: $(GOOGLE_APPLICATION_CREDENTIALS_CONTENT)
@@ -36,11 +37,11 @@ steps:
       GOOGLE_APPLICATION_CREDENTIALS_CONTENT: $(GOOGLE_APPLICATION_CREDENTIALS_CONTENT)
     condition: and(succeeded(),
                    or(eq(${{parameters.is_release}}, 'false'),
-                      ne('${{parameters.name}}', 'm1')))
+                      ne(${{parameters.name_exp}}, 'm1')))
 
   - bash: ./fmt.sh --test
     displayName: 'Platform-agnostic lints and checks'
-    condition: and(succeeded(), eq('${{parameters.name}}', 'Linux-intel'))
+    condition: and(succeeded(), eq(${{parameters.name_exp}}, 'linux-intel'))
 
   - bash: |
       set -euo pipefail
@@ -51,7 +52,7 @@ steps:
 
   - bash: |
       set -euo pipefail
-      p="_${{parameters.name}}"
+      p="_${{parameters.name_str}}"
       a="_$(Build.BuildNumber)_$(System.JobAttempt)"
       t="${{parameters.test_mode}}"
       ./build.sh $p $a $t
@@ -64,19 +65,19 @@ steps:
       IS_FORK: $(System.PullRequest.IsFork)
     condition: and(succeeded(),
                    or(eq(${{parameters.is_release}}, 'false'),
-                      ne('${{parameters.name}}', 'm1')))
+                      ne(${{parameters.name_exp}}, 'm1')))
 
   # Do not publish dar from m1
-  - ${{ if ne(parameters.name, 'm1') }}:
+  - ${{ if ne(parameters.name_exp, 'm1') }}:
     - template: publish-platform-independence-dar.yml
       parameters:
-        platform: ${{parameters.name}}
+        platform: ${{parameters.name_str}}
         is_release: ${{parameters.is_release}}
 
   - task: PublishBuildArtifacts@1
     condition: and(succeededOrFailed(),
                    or(eq(${{parameters.is_release}}, 'false'),
-                      ne('${{parameters.name}}', 'm1')))
+                      ne(${{parameters.name_exp}}, 'm1')))
     continueOnError: true
     inputs:
       pathtoPublish: '$(Build.StagingDirectory)/logs'
@@ -85,11 +86,11 @@ steps:
   - task: PublishBuildArtifacts@1
     condition: and(failed(),
                    or(eq(${{parameters.is_release}}, 'false'),
-                      ne('${{parameters.name}}', 'm1')))
+                      ne(${{parameters.name_exp}}, 'm1')))
     displayName: 'Publish the bazel test logs'
     inputs:
       pathtoPublish: 'bazel-testlogs/'
-      artifactName: 'Test logs ${{parameters.name}}'
+      artifactName: 'Test logs ${{parameters.name_str}}'
 
   - bash: |
       set -euo pipefail
@@ -106,33 +107,28 @@ steps:
     name: publish_npm_mvn
     condition: and(succeeded(),
                    eq(${{parameters.is_release}}, 'true'),
-                   eq('${{parameters.scala_version}}', ''),
-                   eq('${{parameters.name}}', 'linux-intel'),
-                   in(variables['Build.SourceBranchName'], 'main', 'main-2.x'),
-                   in('${{parameters.name}}', 'linux-intel', 'linux-scala-2.12'))
+                   eq(${{parameters.name_exp}}, 'linux-intel'))
   - template: bash-lib.yml
     parameters:
       var_name: bash-lib
       condition: and(succeeded(),
                      or(eq(${{parameters.is_release}}, 'false'),
-                        ne('${{parameters.name}}', 'm1')))
+                        ne(${{parameters.name_exp}}, 'm1')))
   - bash: |
       set -euo pipefail
       eval "$(./dev-env/bin/dade-assist)"
       mkdir -p $(Build.StagingDirectory)/release
-      ./ci/copy-unix-release-artifacts.sh ${{parameters.release_tag}} ${{parameters.name}} $(Build.StagingDirectory)/release
+      ./ci/copy-unix-release-artifacts.sh ${{parameters.release_tag}} ${{parameters.name_str}} $(Build.StagingDirectory)/release
     env:
       DAML_SDK_RELEASE_VERSION: ${{parameters.release_tag}}
     name: publish
     condition: and(succeeded(),
-                   ne('${{parameters.name}}', 'm1'),
-                   eq(${{parameters.is_release}}, 'true'),
-                   in(variables['Build.SourceBranchName'], 'main', 'main-2.x'))
+                   ne(${{parameters.name_exp}}, 'm1'),
+                   eq(${{parameters.is_release}}, 'true'))
   - task: PublishPipelineArtifact@0
     inputs:
       targetPath: $(Build.StagingDirectory)/release
-      artifactName: ${{parameters.name}}-release
+      artifactName: ${{parameters.name_str}}-release
     condition: and(succeeded(),
-                   ne('${{parameters.name}}', 'm1'),
-                   eq(${{parameters.is_release}}, 'true'),
-                   in(variables['Build.SourceBranchName'], 'main', 'main-2.x'))
+                   ne(${{parameters.name_exp}}, 'm1'),
+                   eq(${{parameters.is_release}}, 'true'))
diff --git a/ci/build.yml b/ci/build.yml
index 7995b899d7..0fabc359bc 100644
--- a/ci/build.yml
+++ b/ci/build.yml
@@ -63,8 +63,17 @@ jobs:
     - template: clean-up.yml
     - template: build-unix.yml
       parameters:
+        # The syntax required to inline a variable changes based on context
+        # (`$(var)` in strings, `variables.var` in expressions). Template
+        # parameters are inlined before evaluation. This is a bit like lazy
+        # function arguments, but at the syntax level.
+        #
+        # The result is that we need to know what context the parameter will be
+        # used in, which is why `release_tag` and `is_release` use different
+        # syntaxes, and why we need to passe `name` twice.
         release_tag: $(release_tag)
-        name: $(name)
+        name_str: $(name)
+        name_exp: variables.name
         is_release: variables.is_release
         test_mode: ${{parameters.test_mode}}
     - template: upload-bazel-metrics.yml
diff --git a/ci/macOS.yml b/ci/macOS.yml
index 1d7d7fd91e..e5978a2030 100644
--- a/ci/macOS.yml
+++ b/ci/macOS.yml
@@ -44,7 +44,9 @@ jobs:
     - template: build-unix.yml
       parameters:
         release_tag: $(release_tag)
-        name: ${{parameters.name}}
+        name_str: ${{parameters.name}}
+        # Yes, these quotes are needed. Yes, I know.
+        name_exp: "'${{parameters.name}}'"
         is_release: variables.is_release
         test_mode: ${{parameters.test_mode}}
     # Do not upload metrics for m1