diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index bd528f245..17c42b07d 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -458,6 +458,17 @@ jobs:
           VCPKG_FEATURE_FLAGS: dependencygraph
         run: .ci/compile.sh --server --test --vcpkg
 
+      # CPack reports a failed makensis run as "Problem running NSIS command"
+      # plus a path to NSISOutput.log, and that log lives only on the runner, so
+      # the actual compile error is otherwise nowhere in the workflow output.
+      # Dump it, or a broken installer script is undiagnosable from CI alone.
+      # shell: bash matters here - the default pwsh resolves `find` to Windows'
+      # text-search find.exe, which errors instead of searching.
+      - name: "Dump NSIS compile log"
+        if: failure() && matrix.os == 'Windows'
+        shell: bash
+        run: find . -name NSISOutput.log -exec cat {} +
+
       # Delete used cache to emulate a ccache update. See https://github.com/actions/cache/issues/342
       - name: "[macOS] Delete remote compiler cache (ccache)"
         if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master' && steps.restore_ccache.outputs.cache-hit
diff --git a/cmake/NSIS.template.in b/cmake/NSIS.template.in
index 24856729f..bee52d8b2 100644
--- a/cmake/NSIS.template.in
+++ b/cmake/NSIS.template.in
@@ -15,7 +15,6 @@ Var ReinstallMode
 Var AllowForceClose
 Var GuardDir
 Var OldUninstallString
-Var StaleFindHandle
 Var StaleFindName
 Var IsUpgrade
 Var AbortReason
@@ -95,7 +94,7 @@ ${IfNot} ${Errors}
       /S : Silent install$\n\
       /R : Silent upgrade$\n\
       /PID=%pid% : Process to wait for before replacing files (used by the in-app updater)$\n\
-      /D=%directory% : Specify destination directory$\n\"
+      /D=%directory% : Specify destination directory$\n"
     Quit
 ${EndIf}
 
@@ -519,9 +518,9 @@ Function WaitForLauncherToExit
     ; do with the upgrade.
     ClearErrors
     System::Call 'kernel32::OpenProcess(i 0x00100000, i 0, i $WaitPid) p.r0'
-    ${If} $Errors
-        ; The launcher is gone - OpenProcess cannot open a dead process - which is
-        ; exactly the state the wait was for.
+    ${If} ${Errors}
+    ; The launcher is gone - OpenProcess cannot open a dead process - which is
+    ; exactly the state the wait was for.
         DetailPrint "The application that started this installer has already exited."
         StrCpy $LauncherExited 1
         Return
@@ -686,10 +685,16 @@ Function CheckStaleRuntimeMask
     ${If} $R0 = 1
         Return
     ${EndIf}
-    FindFirst $StaleFindHandle $StaleFindName "$INSTDIR\$R3"
-    ${If} $StaleFindHandle != ""
+    ; FindFirst takes the pattern and the name variable only, and leaves the
+    ; search handle in $0 - there is no handle argument and no handle variable
+    ; to keep, which is why FindNext does not take one either. $R3 and $R0 are
+    ; untouched by it, so only $0 is consumed here.
+    ; One match is enough: $R0 is a yes/no flag, not a list, so there is no
+    ; FindNext and nothing to iterate.
+    FindFirst "$INSTDIR\$R3" $StaleFindName
+    ${If} $0 != ""
         StrCpy $R0 1
-        FindClose $StaleFindHandle
+        FindClose $0
     ${EndIf}
 FunctionEnd