diff --git a/images/fedora-intune/build.conf b/images/fedora-intune/build.conf
index 967992b..a3bd73a 100644
--- a/images/fedora-intune/build.conf
+++ b/images/fedora-intune/build.conf
@@ -4,7 +4,7 @@ BUILD_MODE=upstream
 
 UPSTREAM_REPO="https://gitlab.com/fedora/ostree/ci-test.git"
 
-# Stable only; Defender comes from Microsoft's RHEL 10 repo, not rawhide.
+# Stable only; Microsoft's Defender repo (fedora/44) has no rawhide build.
 declare -A UPSTREAM_REFS=(
   [44]=f44
 )
diff --git a/images/fedora-intune/defender.yaml b/images/fedora-intune/defender.yaml
index 801d529..435b6a5 100644
--- a/images/fedora-intune/defender.yaml
+++ b/images/fedora-intune/defender.yaml
@@ -1,5 +1,5 @@
-# Microsoft Defender for Endpoint on Linux (mdatp), RHEL 10 build, from the
-# microsoft-rhel10 repo (repos/microsoft.repo).
+# Microsoft Defender for Endpoint on Linux (mdatp), Fedora 44 build, from the
+# microsoft-fedora44 repo (repos/microsoft.repo).
 #
 # mdatp's %post does the real install: units, SELinux module, and per-machine
 # state under /var/opt/microsoft/mdatp (machine GUID, definitions database,
@@ -11,7 +11,7 @@
 # from the Defender portal on the device.
 
 repo-packages:
-  - repo: microsoft-rhel10
+  - repo: microsoft-fedora44
     packages:
       - mdatp
 
diff --git a/images/fedora-intune/manifest.yaml b/images/fedora-intune/manifest.yaml
index 84107b0..5d7e413 100644
--- a/images/fedora-intune/manifest.yaml
+++ b/images/fedora-intune/manifest.yaml
@@ -27,7 +27,7 @@ opt-usrlocal: root
 
 repos:
   - himmelblau
-  - microsoft-rhel10
+  - microsoft-fedora44
   - microsoft-edge
 
 include:
diff --git a/images/fedora-intune/repos/microsoft.repo b/images/fedora-intune/repos/microsoft.repo
index 3c6438f..723f7ea 100644
--- a/images/fedora-intune/repos/microsoft.repo
+++ b/images/fedora-intune/repos/microsoft.repo
@@ -1,9 +1,13 @@
 # packages.microsoft.com, limited with includepkgs to the packages the image
-# uses, so nothing else from the RHEL repo can replace a Fedora package.
+# uses, so nothing else from the Microsoft repo can replace a Fedora package.
+#
+# Fedora 44 build of Defender (mdatp): Fedora is a supported Defender
+# distribution, servers and desktops. Pinned to 44 rather than $releasever so a
+# new Fedora release doesn't fail the build before Microsoft publishes its repo.
 
-[microsoft-rhel10]
-name=Microsoft Production (RHEL 10)
-baseurl=https://packages.microsoft.com/rhel/10/prod/
+[microsoft-fedora44]
+name=Microsoft Production (Fedora 44)
+baseurl=https://packages.microsoft.com/fedora/44/prod/
 enabled=1
 gpgcheck=1
 repo_gpgcheck=1