diff --git a/out/codeSign/macCodeSign.js b/out/codeSign/macCodeSign.js
index 3bde9755d703a70fc3a45c048c249559fef78d82..9db6a66ee59dbe28a167683b791d835766f279dd 100644
--- a/out/codeSign/macCodeSign.js
+++ b/out/codeSign/macCodeSign.js
@@ -155,16 +155,16 @@ async function createKeychain({ tmpDir, cscLink, cscKeyPassword, cscILink, cscI
     if (cscIKeyPassword != null) {
         cscPasswords.push(cscIKeyPassword);
     }
-    return await importCerts(keychainFile, certPaths, cscPasswords);
+    return await importCerts(keychainFile, certPaths, cscPasswords, keychainPassword);
 }
-async function importCerts(keychainFile, paths, keyPasswords) {
+async function importCerts(keychainFile, paths, keyPasswords, keychainPassword) {
     var _a;
     for (let i = 0; i < paths.length; i++) {
         const password = (_a = keyPasswords[i]) !== null && _a !== void 0 ? _a : "";
         await (0, builder_util_1.exec)("/usr/bin/security", ["import", paths[i], "-k", keychainFile, "-T", "/usr/bin/codesign", "-T", "/usr/bin/productbuild", "-P", password]);
         // https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p
         // https://github.com/electron-userland/electron-packager/issues/701#issuecomment-322315996
-        await (0, builder_util_1.exec)("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", password, keychainFile]);
+        await (0, builder_util_1.exec)("/usr/bin/security", ["set-key-partition-list", "-S", "apple-tool:,apple:", "-s", "-k", keychainPassword, keychainFile]);
     }
     return {
         keychainFile,
diff --git a/templates/nsis/installer.nsi b/templates/nsis/installer.nsi
index 2f5d5cf1240c5219217498f1f1a0530deab435a6..821e1d1c9b97dce3fd8e847132508384968072a0 100644
--- a/templates/nsis/installer.nsi
+++ b/templates/nsis/installer.nsi
@@ -28,0 +29 @@
+ManifestLongPathAware true
diff --git a/templates/nsis/include/allowOnlyOneInstallerInstance.nsh b/templates/nsis/include/allowOnlyOneInstallerInstance.nsh
index b32bafafac67d1e2ba6d867fb97865f67766a17e..77b621c83ccbd51392f292c989fbb249c76aa243 100644
--- a/templates/nsis/include/allowOnlyOneInstallerInstance.nsh
+++ b/templates/nsis/include/allowOnlyOneInstallerInstance.nsh
@@ -64,6 +64,6 @@
 !macro FIND_PROCESS _FILE _RETURN
   ${if} $IsPowerShellAvailable == 0
-    nsExec::Exec `"$PowerShellPath" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$$_.Path -and $$_.Path.StartsWith('$INSTDIR', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"`
+    nsExec::Exec `"$PowerShellPath" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$$_.Path -and [System.IO.Path]::GetFileName($$_.Path) -ieq '${_FILE}'}).Count -gt 0) { exit 0 } else { exit 1 }"`
     Pop ${_RETURN}
   ${else}
     !ifdef INSTALL_MODE_PER_ALL_USERS
@@ -93,5 +93,5 @@
   ${if} $IsPowerShellAvailable == 0
-    nsExec::Exec `"$PowerShellPath" -C "Get-CimInstance -ClassName Win32_Process | ? {$$_.Path -and $$_.Path.StartsWith('$INSTDIR', 'CurrentCultureIgnoreCase')} | % { Stop-Process -Id $$_.ProcessId $0 }"`
+    nsExec::Exec `"$PowerShellPath" -C "Get-CimInstance -ClassName Win32_Process | ? {$$_.Path -and [System.IO.Path]::GetFileName($$_.Path) -ieq '${_FILE}'} | % { Stop-Process -Id $$_.ProcessId $0 }"`
   ${else}
     !ifdef INSTALL_MODE_PER_ALL_USERS
       nsExec::Exec `taskkill /IM "${_FILE}" /FI "PID ne $pid"`
diff --git a/templates/nsis/portable.nsi b/templates/nsis/portable.nsi
index 8d2992afbe79af270a0d08c38203166d3afc03f1..bd8dc7fd2bc01a4ec9ade821bbd5d7bd37265caf 100644
--- a/templates/nsis/portable.nsi
+++ b/templates/nsis/portable.nsi
@@ -8,0 +9 @@
+ManifestLongPathAware true
diff --git a/templates/nsis/include/extractAppPackage.nsh b/templates/nsis/include/extractAppPackage.nsh
--- a/templates/nsis/include/extractAppPackage.nsh
+++ b/templates/nsis/include/extractAppPackage.nsh
@@ -92,47 +92,6 @@
 !macro extractUsing7za FILE
-  Push $OUTDIR
-  CreateDirectory "$PLUGINSDIR\7z-out"
-  ClearErrors
-  SetOutPath "$PLUGINSDIR\7z-out"
-  Nsis7z::Extract "${FILE}"
-  Pop $R0
-  SetOutPath $R0
-
-  # Retry counter
-  StrCpy $R1 0
-
-  LoopExtract7za:
-    IntOp $R1 $R1 + 1
-
-    # Attempt to copy files in atomic way
-    CopyFiles /SILENT "$PLUGINSDIR\7z-out\*" $OUTDIR
-    IfErrors 0 DoneExtract7za
-
-    DetailPrint `Can't modify "${PRODUCT_NAME}"'s files.`
-    ${if} $R1 < 5
-      # Try copying a few times before asking for a user action.
-      Goto RetryExtract7za
-    ${else}
-      MessageBox MB_RETRYCANCEL|MB_ICONEXCLAMATION "$(appCannotBeClosed)" /SD IDRETRY IDCANCEL AbortExtract7za
-    ${endIf}
-
-    # As an absolutely last resort after a few automatic attempts and user
-    # intervention - we will just overwrite everything with `Nsis7z::Extract`
-    # even though it is not atomic and will ignore errors.
-
-    # Clear the temporary folder first to make sure we don't use twice as
-    # much disk space.
-    RMDir /r "$PLUGINSDIR\7z-out"
-
-    Nsis7z::Extract "${FILE}"
-    Goto DoneExtract7za
-
-  AbortExtract7za:
-    Quit
-
-  RetryExtract7za:
-    Sleep 1000
-    Goto LoopExtract7za
-
-  DoneExtract7za:
+  # The Desktop package favors install speed over atomic replacement: avoid
+  # writing the entire app to $PLUGINSDIR and copying every file a second time.
+  SetOutPath "$INSTDIR"
+  Nsis7z::Extract "${FILE}"
 !macroend
diff --git a/templates/nsis/include/installUtil.nsh b/templates/nsis/include/installUtil.nsh
--- a/templates/nsis/include/installUtil.nsh
+++ b/templates/nsis/include/installUtil.nsh
@@ -128,6 +128,11 @@ Function handleUninstallResult
   ${if} $R0 != 0
-    MessageBox MB_OK|MB_ICONEXCLAMATION "$(uninstallFailed): $R0"
-    DetailPrint `Uninstall was not successful. Uninstaller error code: $R0.`
-    SetErrorLevel 2
-    Quit
+    ${if} $R0 == 2
+      DetailPrint `Old uninstaller returned code 2; continuing with non-atomic in-place replacement.`
+      StrCpy $R0 0
+    ${else}
+      MessageBox MB_OK|MB_ICONEXCLAMATION "$(uninstallFailed): $R0"
+      DetailPrint `Uninstall was not successful. Uninstaller error code: $R0.`
+      SetErrorLevel 2
+      Quit
+    ${endif}
   ${endif}
@@ -233,4 +238,8 @@ Function uninstallOldVersion
     CheckResult:
       ${if} $R0 == 0
         Return
       ${endIf}
+      ${if} $R0 == 2
+        # Code 2 is handled by the non-atomic in-place replacement path.
+        Return
+      ${endIf}
diff --git a/out/util/appFileCopier.js b/out/util/appFileCopier.js
--- a/out/util/appFileCopier.js
+++ b/out/util/appFileCopier.js
@@ -234,7 +234,9 @@ async function collectNodeModulesWithLogging(platformPackager) {
     const packager = platformPackager.info;
     const { tempDirManager, appDir, projectDir } = packager;
     const searchDirectories = Array.from(new Set([appDir, projectDir, await packager.getWorkspaceRoot()])).filter((it) => (0, builder_util_1.isEmptyOrSpaces)(it) === false);
-    const pmApproaches = [await packager.getPackageManager(), node_module_collector_1.PM.TRAVERSAL];
+    const pmApproaches = process.env.DSH_ELECTRON_BUILDER_TRAVERSAL_ONLY === "1"
+        ? [node_module_collector_1.PM.TRAVERSAL]
+        : [await packager.getPackageManager(), node_module_collector_1.PM.TRAVERSAL];
     // Validate against the as-declared (pre-extraMetadata) production dependencies so a configured
     // `extraMetadata.dependencies` entry that isn't installed cannot reject a correct collection.
     const deps = await resolveFirstMatchingCollection({