diff --git a/browser/installer/windows/nsis/shared.nsh b/browser/installer/windows/nsis/shared.nsh
index 471e5ad88d83..abb430be8919 100755
--- a/browser/installer/windows/nsis/shared.nsh
+++ b/browser/installer/windows/nsis/shared.nsh
@@ -193,8 +193,12 @@ ${If} $TmpVal == "HKCU"
                     "DidRegisterDefaultBrowserAgent"
   ${If} $0 != 0
   ${OrIf} ${Errors}
-    Exec '"$INSTDIR\default-browser-agent.exe" update-task $AppUserModelID'
+    Exec '"$INSTDIR\default-browser-agent.exe" register-task $AppUserModelID'
   ${EndIf}
+${ElseIf} $TmpVal == "HKLM"
+  ; If we're the privileged PostUpdate, make sure that the unprivileged one
+  ; will have permission to create a task by clearing out the old one first.
+  Exec '"$INSTDIR\default-browser-agent.exe" unregister-task $AppUserModelID'
 ${EndIf}
 !endif
 
diff --git a/browser/installer/windows/nsis/uninstaller.nsi b/browser/installer/windows/nsis/uninstaller.nsi
index 74eb847f3fcb..b17b8eaa652a 100755
--- a/browser/installer/windows/nsis/uninstaller.nsi
+++ b/browser/installer/windows/nsis/uninstaller.nsi
@@ -464,7 +464,7 @@ Section "Uninstall"
 
   ; Uninstall the default browser agent scheduled task.
   ; This also removes the registry entries it creates.
-  ExecWait '"$INSTDIR\default-browser-agent.exe" unregister-task $AppUserModelID'
+  ExecWait '"$INSTDIR\default-browser-agent.exe" uninstall $AppUserModelID'
 
   ${un.RemovePrecompleteEntries} "false"
 
diff --git a/toolkit/mozapps/defaultagent/docs/index.rst b/toolkit/mozapps/defaultagent/docs/index.rst
index 9c35ba92d7cc..d0085a0c810e 100644
--- a/toolkit/mozapps/defaultagent/docs/index.rst
+++ b/toolkit/mozapps/defaultagent/docs/index.rst
@@ -10,7 +10,7 @@ For information about the specific data that the agent sends, see :doc:`the ping
 Scheduled Task
 ==============
 
-The agent runs as a `Windows scheduled task <https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler>`_. The scheduled task executes all of the agent's primary functions; all of its other functions relate to managing the task. The Windows installer is responsible for creating (and the uninstaller for removing) the agent's task entry, but the code for actually doing this resides in the agent itself, and the installers simply call it using dedicated command line parameters (``register-task`` and ``unregister-task``). The :doc:`PostUpdate </browser/installer/windows/installer/Helper>` code also calls the agent with ``update-task`` to update any properties of an existing task registration that need to be updated, or to create one during an application update if none exists.
+The agent runs as a `Windows scheduled task <https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler>`_. The scheduled task executes all of the agent's primary functions; all of its other functions relate to managing the task. The Windows installer is responsible for creating (and the uninstaller for removing) the agent's task entry, but the code for actually doing this resides in the agent itself, and the installers simply call it using dedicated command line parameters (``register-task`` and ``uninstall``). The :doc:`PostUpdate </browser/installer/windows/installer/Helper>` code also calls the agent to update any properties of an existing task registration that need to be updated, or to create one during an application update if none exists.
 
 The tasks are normal entries in the Windows Task Scheduler, managed using `its Win32 API <https://docs.microsoft.com/en-us/windows/win32/api/_taskschd/>`_. They're created in a tasks folder called "Mozilla" (or whatever the application's vendor name is), and there's one for each installation of Firefox (or other Mozilla application). The task is set to run automatically every 24 hours starting at the time it's registered (with the first run being 24 hours after that), or the nearest time after that the computer is awake. The task is configured with one action, which is to run the agent binary with the command line parameter ``do-task``, the command that invokes the actual agent functionality.
 
diff --git a/toolkit/mozapps/defaultagent/main.cpp b/toolkit/mozapps/defaultagent/main.cpp
index d8d6f9e7e55b..cd2920a54863 100644
--- a/toolkit/mozapps/defaultagent/main.cpp
+++ b/toolkit/mozapps/defaultagent/main.cpp
@@ -101,7 +101,10 @@ static void RemoveAllRegistryEntries() {
 //   token argument is required and should be the same one that was passed in
 //   when the task was registered.
 // unregister-task [unique-token]
-//   Removes the previously created task along with any registry entries that
+//   Removes the previously created task. The unique token argument is required
+//   and should be the same one that was passed in when the task was registered.
+// uninstall [unique-token]
+//   Removes the previously created task, and also removes all registry entries
 //   running the task may have created. The unique token argument is required
 //   and should be the same one that was passed in when the task was registered.
 // do-task
@@ -121,13 +124,16 @@ int wmain(int argc, wchar_t** argv) {
     ~ComUninitializer() { CoUninitialize(); }
   } kCUi;
 
-  // The remove-task command is allowed even if the policy disabling the task
-  // is set, mainly so that the uninstaller will work.
-  if (!wcscmp(argv[1], L"unregister-task")) {
+  // The uninstall and unregister commands are allowed even if the policy
+  // disabling the task is set, so that uninstalls and updates always work.
+  if (!wcscmp(argv[1], L"uninstall") || !wcscmp(argv[1], L"unregister-task")) {
     if (argc < 3 || !argv[2]) {
       return E_INVALIDARG;
     }
-    RemoveAllRegistryEntries();
+
+    if (!wcscmp(argv[1], L"uninstall")) {
+      RemoveAllRegistryEntries();
+    }
     return RemoveTask(argv[2]);
   }