diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index f44e29a558736..0bc9582b14da3 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -262,14 +262,17 @@ jobs:
       # copy the rom to a specific location
       ROM_TARGET="${BIN_DIR}/sw/device/silicon_creator/rom"
       mkdir -p "${ROM_TARGET}"
-      AUTHENTICITY=(fake real)
-      for authenticity in "${AUTHENTICITY[@]}"; do
-        ROM=$(ci/scripts/target-location.sh "//sw/device/silicon_creator/rom:rom_with_${authenticity}_keys_fpga_cw310_scr_vmem")
-        cp $ROM "${ROM_TARGET}/$(basename "${ROM}")"
-        ROM_DIR=$(dirname $ROM)
-        cp "${ROM_DIR}/rom_with_${authenticity}_keys_fpga_cw310.elf" "${ROM_TARGET}/"
-        cp "${ROM_DIR}/rom_with_${authenticity}_keys_fpga_cw310.bin" "${ROM_TARGET}/"
-      done
+      # To make the correct query to get the ELF output file, we have to start
+      # from a node that is built for our usual target platform (the host) and
+      # follow the edges in the graph across the configuration transition (to
+      # riscv32). The deps 2 levels down from the opentitan_rom_binary include
+      # all the important files.
+      ROM_REAL_TARGETS="deps(//sw/device/silicon_creator/rom:rom_with_real_keys_from_src_fpga_cw310, 2)"
+      ROM_FAKE_TARGETS="deps(//sw/device/silicon_creator/rom:rom_with_fake_keys_fpga_cw310, 2)"
+      QUERY_CMD_ARGS=(outquery-all --noinclude_aspects --noimplicit_deps)
+      ROM_REAL_FILES=($(./bazelisk.sh "${QUERY_CMD_ARGS[@]}" "${ROM_REAL_TARGETS}" | sort | uniq))
+      ROM_FAKE_FILES=($(./bazelisk.sh "${QUERY_CMD_ARGS[@]}" "${ROM_FAKE_TARGETS}" | sort | uniq))
+      cp -Lvt "${ROM_TARGET}" "${ROM_FAKE_FILES[@]}" "${ROM_REAL_FILES[@]}"
   - template: ci/upload-artifacts-template.yml
     parameters:
       includePatterns: