diff --git a/.ci/compile.sh b/.ci/compile.sh
index f20432893..72a017f33 100755
--- a/.ci/compile.sh
+++ b/.ci/compile.sh
@@ -352,6 +352,62 @@ if [[ $MAKE_PACKAGE ]]; then
         exit 1
       fi
       echo "Installer content is clean"
+
+      # Fail the build if the installer is missing a Qt runtime the applications
+      # link against. The DLLs reach the package by globbing every *.dll out of
+      # the build output directories, so a module the client links statically
+      # (Qt6Multimedia.dll, Qt6QuickWidgets.dll) can be left out without anything
+      # else noticing, and the only symptom is a client that refuses to start
+      # after an update. required-qt-runtime.txt is written by the top level
+      # CMakeLists.txt from the same module list the targets are built against.
+      if [[ ! -f required-qt-runtime.txt ]]; then
+        echo "::error file=$0::required-qt-runtime.txt not found in the build dir, cannot verify the Qt runtime"
+        exit 1
+      fi
+      # 7-Zip writes CRLF on Windows, so the \r has to come off before any
+      # whole-line comparison below. Normalize separators to /, and strip the
+      # install-root prefixes an NSIS listing may carry, so the entries can be
+      # compared as exact relative paths. -xF keeps a '.' in a DLL name from
+      # being a wildcard; -i because that is how the installed tree behaves -
+      # the uninstaller clears both $INSTDIR\plugins and $INSTDIR\Plugins.
+      # The archive side and the manifest side have to agree on line endings.
+      # CMake writes required-qt-runtime.txt with the platform's line ending and
+      # 7-Zip writes CRLF on Windows, so a trailing \r survives on $entry and
+      # defeats the whole-line match - every entry then reads as missing even
+      # though the listing holds it verbatim.
+      # [$] rather than \$ so the literal dollar is a bracket expression and the
+      # linter does not read these as unexpanded shell variables (SC2016).
+      installer_paths="$("$seven_zip" l -slt "$package" | tr -d '\r' |
+        sed -n 's/^Path = //p' |
+        sed -e 's|\\|/|g' -e 's|^[$]INSTDIR/||' -e 's|^[$]OUTDIR/||' -e 's|^[$]PLUGINSDIR/||' -e 's|^\./||' -e 's|^/||')"
+      manifest="$(tr -d '\r' <required-qt-runtime.txt)"
+      missing=""
+      checked=0
+      while IFS= read -r entry; do
+        if [[ -z $entry || $entry == \#* ]]; then
+          continue
+        fi
+        checked=$((checked + 1))
+        if ! grep -qxiF "$entry" <<<"$installer_paths"; then
+          missing+=" $entry"
+        fi
+      done <<<"$manifest"
+      if [[ -n $missing ]]; then
+        echo "::error file=$0::Installer is missing required Qt runtime files:$missing"
+        # Print both sides of the comparison. A mismatch here has twice been
+        # caused by the shape of 7-Zip's output rather than by a missing file,
+        # and a bare "missing" line cannot tell those apart.
+        echo "required-qt-runtime.txt asked for $checked path(s); 7-Zip listed $(grep -c '' <<<"$installer_paths") path(s)"
+        # Indent with parameter expansion rather than sed 's/^/  /', which the
+        # linter reports as SC2001.
+        echo "--- required ---"
+        echo "${manifest//$'\n'/$'\n  '}"
+        echo "--- first 40 paths 7-Zip lists in the installer ---"
+        listed_head="$(head -40 <<<"$installer_paths")"
+        echo "${listed_head//$'\n'/$'\n  '}"
+        exit 1
+      fi
+      echo "Installer contains the full Qt runtime ($checked files)"
     fi
     echo "::endgroup::"
   fi
diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index bd528f245..17c42b07d 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -458,6 +458,17 @@ jobs:
           VCPKG_FEATURE_FLAGS: dependencygraph
         run: .ci/compile.sh --server --test --vcpkg
 
+      # CPack reports a failed makensis run as "Problem running NSIS command"
+      # plus a path to NSISOutput.log, and that log lives only on the runner, so
+      # the actual compile error is otherwise nowhere in the workflow output.
+      # Dump it, or a broken installer script is undiagnosable from CI alone.
+      # shell: bash matters here - the default pwsh resolves `find` to Windows'
+      # text-search find.exe, which errors instead of searching.
+      - name: "Dump NSIS compile log"
+        if: failure() && matrix.os == 'Windows'
+        shell: bash
+        run: find . -name NSISOutput.log -exec cat {} +
+
       # Delete used cache to emulate a ccache update. See https://github.com/actions/cache/issues/342
       - name: "[macOS] Delete remote compiler cache (ccache)"
         if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master' && steps.restore_ccache.outputs.cache-hit
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 293e25dd9..1ea17b664 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -326,6 +326,39 @@ elseif(WIN32)
   # Configure file with custom definitions for NSIS.
   configure_file("${COCKATRICE_CMAKE_PATH}/NSIS.definitions.nsh.in" "${PROJECT_BINARY_DIR}/NSIS.definitions.nsh")
 
+  # Every Qt module the client links against, as the DLL names a Windows install
+  # has to contain, plus the platform plugin without which the client cannot
+  # start. .ci/compile.sh reads this and fails the build when the packaged
+  # installer is missing one of them.
+  #
+  # Only the client is packaged on Windows, so this is the client's module list
+  # rather than the union across server, client and Oracle: demanding Oracle's or
+  # Servatrice's modules of the client installer checks nothing about the client.
+  #
+  # A statically linked Qt module ships no runtime DLL, so requiring one would
+  # fail the package check on a static build for no reason. cockatrice/CMakeLists.txt
+  # installs the runtime of every module listed here, and skips static ones the
+  # same way, so the two can never disagree.
+  #
+  # A DLL missing from the package only surfaces on a user's machine, after an
+  # update has already replaced their install, as "The code execution cannot
+  # proceed because Qt6Multimedia.dll was not found" or as a missing procedure
+  # entry point in a Qt6QuickWidgets.dll left over from the previous version.
+  # Assert it while the installer is still being built instead.
+  set(_required_qt_runtime "")
+  foreach(_qt_module IN LISTS COCKATRICE_QT_MODULES)
+    get_target_property(_qt_module_type ${_qt_module} TYPE)
+    if(_qt_module_type STREQUAL "SHARED_LIBRARY")
+      string(REGEX REPLACE "^Qt6::" "" _qt_component "${_qt_module}")
+      list(APPEND _required_qt_runtime "Qt6${_qt_component}.dll")
+    endif()
+  endforeach()
+  list(APPEND _required_qt_runtime "Plugins/platforms/qwindows.dll")
+  list(REMOVE_DUPLICATES _required_qt_runtime)
+  list(SORT _required_qt_runtime)
+  string(REPLACE ";" "\n" _required_qt_runtime "${_required_qt_runtime}")
+  file(WRITE "${PROJECT_BINARY_DIR}/required-qt-runtime.txt" "${_required_qt_runtime}\n")
+
   # include vcredist into the package; NSIS will take care of running it
   if(VCREDISTRUNTIME_FOUND)
     install(FILES "${VCREDISTRUNTIME_FILE}" DESTINATION ./)
diff --git a/cmake/NSIS.template.in b/cmake/NSIS.template.in
index c214a333e..597667e9d 100644
--- a/cmake/NSIS.template.in
+++ b/cmake/NSIS.template.in
@@ -15,6 +15,12 @@ Var ReinstallMode
 Var AllowForceClose
 Var GuardDir
 Var OldUninstallString
+Var StaleFindHandle
+Var StaleFindName
+Var IsUpgrade
+Var AbortReason
+Var WaitPid
+Var LauncherExited
 
 !include LogicLib.nsh
 !include FileFunc.nsh
@@ -88,6 +94,7 @@ ${IfNot} ${Errors}
       /PORTABLE : Install in portable mode$\n\
       /S : Silent install$\n\
       /R : Silent upgrade$\n\
+      /PID=%pid% : Process to wait for before replacing files (used by the in-app updater)$\n\
       /D=%directory% : Specify destination directory$\n"
     Quit
 ${EndIf}
@@ -115,6 +122,23 @@ ${Else}
     StrCpy $ReinstallMode 0
 ${EndIf}
 
+; /PID= carries the process id of the application that started this installer.
+; The in-app updater launches the installer and only then quits itself, so
+; without it the installer has to guess whether the launching process is still
+; alive by polling powershell.exe for an image name - a guess that can come back
+; "not running" or "could not determine" while the process is very much alive and
+; still has its Qt DLLs mapped. An older client does not pass /PID= and an older
+; installer ignores it, so both sides of the pair have to keep working.
+; Note that /D= must stay the last parameter on the command line, which is why
+; the client puts it last and this one anywhere.
+StrCpy $WaitPid ""
+StrCpy $LauncherExited 0
+ClearErrors
+${GetOptions} $9 "/PID=" $8
+${IfNot} ${Errors}
+    StrCpy $WaitPid $8
+${EndIf}
+
 ${If} $InstDir == ""
     ; User did not use /D to specify a directory,
     ; we need to set a default based on the install mode
@@ -134,17 +158,24 @@ ${EndIf}
 ; Now that $PortableMode reflects reality, commit InstDir into the correct slot
 Call SetModeDestinationFromInstdir
 
-; Make sure no application instance is still running (and holding file locks)
-; before the previous version is uninstalled. On a silent update (/R /S) the
-; running processes are asked to close gracefully and waited for; Cockatrice
-; itself is never force-killed (data loss, e.g. an unsaved deck) so the update
-; is aborted instead, while the console applications Oracle and Servatrice are
-; force-stopped by PID once the grace period is over. On interactive installs
+; Wait for the process that launched this installer to exit before anything is
+; replaced or deleted. It goes first because it is the one check here that needs
+; no powershell.exe: on a machine where the process lookup cannot run at all, the
+; launcher is still proven gone here instead of the whole upgrade being cancelled
+; by a check that was only ever a proxy for this one.
+;
+; Then make sure no *other* application instance is still running (and holding
+; file locks) before the previous version is uninstalled. On a silent update
+; (/R /S) the running processes are asked to close gracefully and waited for;
+; Cockatrice itself is never force-killed (data loss, e.g. an unsaved deck) so the
+; update is aborted instead, while the console applications Oracle and Servatrice
+; are force-stopped by PID once the grace period is over. On interactive installs
 ; the user is prompted to close them instead.
 ; Only needed this early for /R, where AutoUninstallIfNeeded runs below; for
 ; interactive installs the section re-checks after the directory page, when
 ; $INSTDIR is the directory the user actually picked.
 ${If} $ReinstallMode = 1
+    Call WaitForLauncherToExit
     Call EnsureAppsNotRunning
 ${EndIf}
 
@@ -331,8 +362,13 @@ Function WaitForAppToClose
     Call IsAppRunning
     ; Only a definite "running" is worth waiting for. "Not running" is done, and
     ; "could not determine" must not keep the installer waiting on an answer it
-    ; will never get - EnsureAppsNotRunning has warned about that case already.
-    ${If} $R0 != 1
+    ; will never get - but it cannot simply be waved through either, see
+    ; HandleUnknownAppState.
+    ${If} $R0 = 0
+        Return
+    ${EndIf}
+    ${If} $R0 = 2
+        Call HandleUnknownAppState
         Return
     ${EndIf}
 
@@ -351,7 +387,8 @@ Function WaitForAppToClose
             DetailPrint "$R1 closed."
             Return
         ${EndIf}
-        ${If} $R0 != 1
+        ${If} $R0 = 2
+            Call HandleUnknownAppState
             Return
         ${EndIf}
         System::Call 'kernel32::GetTickCount()i.s'
@@ -366,18 +403,9 @@ Function WaitForAppToClose
         ; update and preserves the user's data.
         ${If} $AllowForceClose = 0
             DetailPrint "$R1 is still running after 60 s; aborting the update so that no data is lost."
-            ; The in-app updater runs this installer silent and detached and
-            ; never looks at its exit code, so a plain Abort would leave the user
-            ; with no update and no explanation. A /S install without /R on the
-            ; other hand is unattended - by a package manager, for instance -
-            ; and a message box there would block forever, so that case only
-            ; reports through the log and the exit code.
-            ${If} $ReinstallMode = 1
-                MessageBox MB_OK|MB_ICONEXCLAMATION \
-                    "$R1 did not close within 60 seconds, so the installation was aborted to avoid losing unsaved data.$\r$\n$\r$\nPlease close $R1 and run the installer again."
-            ${EndIf}
-            SetErrorLevel 1
-            Abort
+            StrCpy $AbortReason \
+                "$R1 did not close within 60 seconds, so the installation was aborted to avoid losing unsaved data.$\r$\n$\r$\nPlease close $R1 and run the installer again."
+            Call AbortInstall
         ${EndIf}
         ; Oracle and Servatrice are console applications: CloseMainWindow()
         ; returned false for them and waiting longer cannot help. They hold no
@@ -390,16 +418,14 @@ Function WaitForAppToClose
             DetailPrint "$R1 closed."
             Return
         ${EndIf}
-        ${If} $R0 != 1
+        ${If} $R0 = 2
+            Call HandleUnknownAppState
             Return
         ${EndIf}
         DetailPrint "$R1 is still running after 60 s; aborting the update."
-        ${If} $ReinstallMode = 1
-            MessageBox MB_OK|MB_ICONEXCLAMATION \
-                "$R1 could not be stopped, so the installation was aborted.$\r$\n$\r$\nPlease close $R1 and run the installer again."
-        ${EndIf}
-        SetErrorLevel 1
-        Abort
+        StrCpy $AbortReason \
+            "$R1 could not be stopped, so the installation was aborted.$\r$\n$\r$\nPlease close $R1 and run the installer again."
+        Call AbortInstall
     ${Else}
         ck_wait_prompt:
         MessageBox MB_RETRYCANCEL|MB_ICONEXCLAMATION|MB_DEFBUTTON1 \
@@ -409,7 +435,8 @@ Function WaitForAppToClose
         ${If} $R0 = 0
             Return
         ${EndIf}
-        ${If} $R0 != 1
+        ${If} $R0 = 2
+            Call HandleUnknownAppState
             Return
         ${EndIf}
         Goto ck_wait_prompt
@@ -418,12 +445,102 @@ Function WaitForAppToClose
     ${EndIf}
 FunctionEnd
 
+; A process lookup came back "could not determine": powershell.exe ran but the
+; answer was not usable, e.g. the process could not be inspected at all. That
+; state is fine to carry on from when the user is at the keyboard - they can
+; close the applications by hand and the stale-runtime check still stands
+; between a failed guard and a mismatched install.
+;
+; It is not fine on a silent upgrade. There the whole point of this guard is to
+; know that nothing holds locks on the files about to be replaced, and this is
+; exactly the state where that is unknown, with no one to click a dialog: the
+; old code returned and let the install carry on into the mixed Qt DLL set that
+; made the next start fail. Cancel the update instead; the next attempt runs
+; with the applications closed and succeeds.
+Function HandleUnknownAppState
+    ${If} $ReinstallMode = 1
+        StrCpy $AbortReason \
+            "The installation was cancelled because it could not determine whether Cockatrice is still running.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice and run the installer again."
+        Call AbortInstall
+    ${EndIf}
+    DetailPrint "Could not determine whether $R1 is running; close Cockatrice, Oracle and Servatrice manually if the installation reports a problem."
+    ${IfNot} ${Silent}
+        MessageBox MB_OK|MB_ICONEXCLAMATION \
+            "This installer could not determine whether $R1 is still running.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice manually before continuing."
+    ${EndIf}
+FunctionEnd
+
 Function EnsureAppsNotRunning
     ; guards the install directory
     StrCpy $GuardDir $INSTDIR
     Call GuardAppsNotRunning
 FunctionEnd
 
+; Aborts the installation, showing $AbortReason to the user.
+;
+; Every abort goes through here so the unattended case is handled the same way
+; everywhere: the in-app updater runs this installer silent and detached and
+; never looks at its exit code, so a plain Abort would leave the user with no
+; update and no explanation, while a /S install without /R is unattended - by a
+; package manager, for instance - and a message box there would block forever.
+; Only the first of those two gets a dialog; the second reports through the log
+; and the exit code.
+Function AbortInstall
+    ${IfNot} ${Silent}
+        MessageBox MB_OK|MB_ICONEXCLAMATION "$AbortReason"
+    ${EndIf}
+    SetErrorLevel 1
+    Abort
+FunctionEnd
+
+; Waits for the application that launched this installer to exit, using the /PID=
+; it passed. Sets $LauncherExited to 1 when that process is provably gone.
+;
+; This is the authority for the one question the rest of the installer can only
+; approximate: is the process that started us still holding its Qt DLLs mapped?
+; A mapped module cannot be deleted, so an answer of "not running" obtained by
+; enumerating process names is what allows the update to write a new payload on
+; top of files it could not remove. Waiting on a real handle has no such gap,
+; needs no powershell.exe, and is unaffected by a process whose path cannot be
+; read - the case the name based check has to treat as "not ours" so it never
+; closes a third party application.
+;
+; Sets $LauncherExited to 0 when no usable /PID= was given, which is the older
+; client that does not pass one; the caller then has no authority available and
+; falls back to the name based guard.
+Function WaitForLauncherToExit
+    StrCpy $LauncherExited 0
+    ${If} $WaitPid == ""
+        Return
+    ${EndIf}
+    ; PROCESS_SYNCHRONIZE is the only access this needs - enough to wait on the
+    ; handle, and the least likely to be refused for a reason that has nothing to
+    ; do with the upgrade.
+    ClearErrors
+    System::Call 'kernel32::OpenProcess(i 0x00100000, i 0, i $WaitPid) p.r0'
+    ${If} ${Errors}
+    ; The launcher is gone - OpenProcess cannot open a dead process - which is
+    ; exactly the state the wait was for.
+        DetailPrint "The application that started this installer has already exited."
+        StrCpy $LauncherExited 1
+        Return
+    ${EndIf}
+    DetailPrint "Waiting for the application that started this installer to exit ..."
+    ; Same 60 s grace period the name based check uses, so a client that is slow
+    ; to flush its card database does not get less room than it used to.
+    ; WAIT_OBJECT_0 is 0; WAIT_TIMEOUT is 258 and a failed wait reports 0xFFFFFFFF.
+    System::Call 'kernel32::WaitForSingleObject(p r0, i 60000) i.r1'
+    System::Call 'kernel32::CloseHandle(p r0)'
+    ${If} $R1 != 0
+        DetailPrint "The application that started this installer did not exit within 60 s."
+        StrCpy $AbortReason \
+            "The application that started this update has not exited yet, so the installation was cancelled rather than replace files it is still using.$\r$\n$\r$\nPlease close Cockatrice and run the installer again."
+        Call AbortInstall
+    ${EndIf}
+    DetailPrint "The application that started this installer has exited."
+    StrCpy $LauncherExited 1
+FunctionEnd
+
 Function EnsureOldInstallNotRunning
     ; Guards the directory of a *previous* installation, as recorded in the
     ; registry. Needed by componentsPagePre, which runs the old uninstaller
@@ -447,13 +564,32 @@ Function GuardAppsNotRunning
     Call IsProcessLookupAvailable
     ${If} $R0 = 0
         ; Without PowerShell we cannot tell whether a running instance is
-        ; holding locks on the files we are about to replace. Warn once and
-        ; continue: refusing to install would leave the user with an installer
-        ; that can never complete, which is worse than the locked-file failure
-        ; this check exists to prevent. MessageBox is shown even in a silent
-        ; install - the user has to be told to close the applications by hand.
+        ; holding locks on the files we are about to replace.
         DetailPrint "Could not start powershell.exe; skipping the running instance check. Close Cockatrice, Oracle and Servatrice manually if the installation reports a problem."
-        MessageBox MB_OK|MB_ICONEXCLAMATION "This installer could not check whether Cockatrice is still running, because powershell.exe could not be started.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice manually before continuing."
+        ; On a silent upgrade that used to be a warning and nothing more, which
+        ; left the very process that launched the installer free to go on
+        ; replacing files it still had mapped - the one outcome this guard exists
+        ; to prevent - and then writing the new payload on top of them. Cancel
+        ; instead. An interactive install can still continue: the user is at the
+        ; keyboard, and refusing outright would leave them with an installer that
+        ; can never complete.
+        ;
+        ; Unless the launcher has already been waited on directly: WaitForLauncherToExit
+        ; needs no powershell.exe, so when it has run, Cockatrice is known to be
+        ; gone and the lookup failing to run costs nothing but the Oracle and
+        ; Servatrice checks. An older client that passes no /PID= leaves no such
+        ; authority, and there the upgrade is cancelled as before.
+        ${If} $LauncherExited != 1
+        ${AndIf} $ReinstallMode = 1
+            StrCpy $AbortReason \
+                "The installation was cancelled because it could not check whether Cockatrice is still running, because powershell.exe could not be started.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice and run the installer again."
+            Call AbortInstall
+        ${EndIf}
+        ; The user has to be told to close the applications by hand, but a /S
+        ; install without /R is unattended and would block on this forever.
+        ${IfNot} ${Silent}
+            MessageBox MB_OK|MB_ICONEXCLAMATION "This installer could not check whether Cockatrice is still running, because powershell.exe could not be started.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice manually before continuing."
+        ${EndIf}
         Return
     ${EndIf}
     StrCpy $R1 "cockatrice.exe"
@@ -494,27 +630,65 @@ Function IsExistingCockatriceInstall
     ; executables and uninstall.exe but silently skipped the DLLs its running
     ; instance had locked - which is exactly the broken install the purge is
     ; meant to heal, and without these markers none of the files above would be
-    ; there to prove that it is one.
-    ${If} ${FileExists} "$INSTDIR\Qt6Core.dll"
-        StrCpy $R0 1
-    ${EndIf}
+    ; there to prove that it is one. Every Qt module Cockatrice links is part of
+    ; the payload, so match them all: probing only Qt6Core.dll would miss a
+    ; directory where that one file happened to be deletable and the others
+    ; were not.
+    StrCpy $R3 "Qt6*.dll"
+    Call CheckStaleRuntimeMask
     ${If} ${FileExists} "$INSTDIR\qt.conf"
         StrCpy $R0 1
     ${EndIf}
 FunctionEnd
 
 ; Sets $R0 to 1 if a runtime file of a previous version is still present after
-; the purge. NSIS silently skips whatever it cannot delete, so one surviving DLL
-; is enough to prove that something still holds a lock on the install
-; directory. The purge works on wildcards, which the file existence checks do
-; not, so this looks for files that are certainly part of the payload.
+; the purge. NSIS silently skips whatever it cannot delete, so one surviving file
+; is enough to prove that something still holds a lock on the install directory.
+;
+; The masks below have to cover the purge above one for one. A check that only
+; probed named files could not see a locked Qt6Multimedia.dll or a Plugins
+; directory the purge was unable to remove, so the exact files that broke the
+; install were also the ones this check was blind to.
 Function HasStaleRuntimeFiles
     StrCpy $R0 0
-    ${If} ${FileExists} "$INSTDIR\Qt6Core.dll"
+    StrCpy $R3 "Qt*.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "libcrypto*.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "libssl*.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "zlib*.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "icu*.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "libeay32.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "ssleay32.dll"
+    Call CheckStaleRuntimeMask
+    ${If} $R0 = 1
+        Return
+    ${EndIf}
+    ${If} ${FileExists} "$INSTDIR\libmysql.dll"
+        StrCpy $R0 1
+        Return
+    ${EndIf}
+    ; IfFileExists takes wildcards, so a Plugins directory the purge could not
+    ; remove counts as a leftover too.
+    ${If} ${FileExists} "$INSTDIR\Plugins\*.*"
         StrCpy $R0 1
     ${EndIf}
-    ${If} ${FileExists} "$INSTDIR\Qt6Network.dll"
+FunctionEnd
+
+; usage: set $R3 to a file mask, call this. Sets $R0 to 1 when $INSTDIR holds a
+; matching file. Returns early once something was found, so $R0 stays 1.
+Function CheckStaleRuntimeMask
+    ${If} $R0 = 1
+        Return
+    ${EndIf}
+    FindFirst $StaleFindHandle $StaleFindName "$INSTDIR\$R3"
+    ${If} $StaleFindHandle != ""
         StrCpy $R0 1
+        FindClose $StaleFindHandle
     ${EndIf}
 FunctionEnd
 
@@ -839,6 +1013,12 @@ ${EndIf}
 ; Remove any runtime DLLs left over from older versions, so a mismatched
 ; Qt/OpenSSL set cannot survive next to the new executables.
 Call IsExistingCockatriceInstall
+; Remembered because the stale-runtime check below must only ever fire for a
+; directory this installer recognised as a Cockatrice install. Scanning for
+; leftovers in an unrelated directory (a first-time install into a folder that
+; happens to hold some Qt5 DLLs, say) would otherwise turn those files into an
+; abort reason even though the payload is about to overwrite nothing of theirs.
+StrCpy $IsUpgrade $R0
 ${If} $PortableMode = 0
 ${AndIf} $R0 = 1
 	RMDir /r "$INSTDIR\Plugins"
@@ -857,12 +1037,28 @@ ${EndIf}
 ; performed at all - is still on disk, and the new executables are about to be
 ; written next to it. That mix is exactly what makes the next start fail with
 ; "The procedure entry point X could not be located in the dynamic link library
-; ...Qt6Network.dll", so say so instead of leaving it to the user to find out.
-Call HasStaleRuntimeFiles
+; ...Qt6QuickWidgets.dll" or "The code execution cannot proceed because
+; Qt6Multimedia.dll was not found", so stop here instead of compounding it.
+; Nothing of the new payload has been written at this point, so the next run -
+; with the applications closed - gets a clean install.
+${If} $IsUpgrade = 1
+    Call HasStaleRuntimeFiles
+${Else}
+    StrCpy $R0 0
+${EndIf}
 ${If} $R0 = 1
-    DetailPrint "Files of a previous version are still present; the installation may be incomplete."
-    MessageBox MB_OK|MB_ICONEXCLAMATION \
-        "The installation could not remove all files of a previous version of Cockatrice, most likely because it is still running or was started as administrator.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice and run the installer again."
+    DetailPrint "Files of a previous version could not be removed; aborting the installation."
+    ; The in-app updater runs this installer silent and detached and never looks
+    ; at its exit code, so the user has to be told what happened. A /S install
+    ; without /R is unattended - a package manager, for instance - and a message
+    ; box there would block forever, so that case only reports through the log
+    ; and the exit code.
+    ${IfNot} ${Silent}
+        MessageBox MB_OK|MB_ICONEXCLAMATION \
+            "The installation could not remove all files of a previous version of Cockatrice, most likely because it is still running or was started as administrator, and was cancelled rather than leave a mismatched install behind.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice and run the installer again."
+    ${EndIf}
+    SetErrorLevel 1
+    Abort
 ${EndIf}
 
 @CPACK_NSIS_EXTRA_PREINSTALL_COMMANDS@
diff --git a/cockatrice/CMakeLists.txt b/cockatrice/CMakeLists.txt
index 9b31310e6..df603eb71 100644
--- a/cockatrice/CMakeLists.txt
+++ b/cockatrice/CMakeLists.txt
@@ -683,6 +683,24 @@ if(WIN32)
     PATTERN ".lupdate*" EXCLUDE
   )
 
+  # fixup_bundle further down copies only the DLLs it can find in Cockatrice.exe's
+  # import table, and the glob above only sees DLLs that were already copied next
+  # to the executable. Qt6::Concurrent is linked but never imported - QtConcurrent::run
+  # and QFutureWatcher are header-only in Qt 6 - so neither step ships
+  # Qt6Concurrent.dll, even though required-qt-runtime.txt lists it and the
+  # Windows package check then fails on a package that is fine to run.
+  # Qt6::ShaderTools is skipped for the same reason.
+  #
+  # Install the runtime of every linked module explicitly. An unused DLL costs a
+  # few hundred kilobytes; a missing one is what stops the client starting after
+  # an update, and it stays invisible until then.
+  foreach(_qt_module IN LISTS COCKATRICE_QT_MODULES)
+    get_target_property(_qt_module_type ${_qt_module} TYPE)
+    if(_qt_module_type STREQUAL "SHARED_LIBRARY")
+      install(FILES "$<TARGET_FILE:${_qt_module}>" DESTINATION ./)
+    endif()
+  endforeach()
+
   install(
     DIRECTORY "${CMAKE_BINARY_DIR}/cockatrice/"
     DESTINATION ./
@@ -729,11 +747,15 @@ if(WIN32)
     PATTERN "tls/qschannelbackend.dll"
   )
 
+  # The Windows install has no Resources directory: the .qm files go to
+  # ${COCKATRICE_WIN32_QM_INSTALL_DIR} and main.cpp looks for them at
+  # applicationDirPath() + "/translations". The macOS bundle above keeps
+  # Resources/translations, which is correct for it.
   install(
     CODE "
         file(WRITE \"\${CMAKE_INSTALL_PREFIX}/${qtconf_dest_dir}/qt.conf\" \"[Paths]
 Plugins = Plugins
-Translations = Resources/translations
+Translations = translations
 Data = Resources\")
     "
     COMPONENT Runtime
diff --git a/cockatrice/src/interface/widgets/dialogs/dlg_update.cpp b/cockatrice/src/interface/widgets/dialogs/dlg_update.cpp
index c84a46528..bac270580 100644
--- a/cockatrice/src/interface/widgets/dialogs/dlg_update.cpp
+++ b/cockatrice/src/interface/widgets/dialogs/dlg_update.cpp
@@ -265,8 +265,16 @@ void DlgUpdate::downloadSuccessful(const QUrl &filepath)
     // NSIS needs the /D= argument to be an UNQUOTED string, even if it contains spaces. Qt likes to quote arguments if
     // they contain spaces, so we use the windows exclusive QProcess::setNativeArguments in the only case where this is
     // relevant, which preserves the argument unquoted.
+    //
+    // /PID= tells the installer which process to wait for before it replaces anything. We launch the installer first
+    // and only quit afterwards, so it starts while this process is still alive and still has every Qt runtime DLL
+    // mapped, and a mapped DLL cannot be deleted. Without the handle the installer can only poll for an image name and
+    // guess, and a wrong guess is what leaves the update writing new executables next to runtime files of the previous
+    // version, which fails on the next start with "The procedure entry point ... could not be located in the dynamic
+    // link library
+    // ...Qt6QuickWidgets.dll". /D= has to stay the last parameter, which is why it is last here too.
 #ifdef Q_OS_WIN
-    process.setNativeArguments(QString("/R /D=%1").arg(appDir));
+    process.setNativeArguments(QString("/R /PID=%1 /D=%2").arg(QCoreApplication::applicationPid()).arg(appDir));
 #else
     // Linux/macOS: normal argument passing (not relevant since they update differently.)
     process.setArguments({"/R", QString("/D=%1").arg(appDir)});