diff --git a/cmake/templates/NSIS.template.in b/cmake/templates/NSIS.template.in
index 92059d3a3e..89c5d89a90 100644
--- a/cmake/templates/NSIS.template.in
+++ b/cmake/templates/NSIS.template.in
@@ -49,13 +49,6 @@
 
     !system "$%TEMP%\tempinstaller.exe" = 2
 
-    ; That will have written an uninstaller binary for us.  Now we sign it with your
-    ; favourite code signing tool, if it's a production build.
-
-    ${If} "@PRODUCTION_BUILD@" == "1"
-      !system "signcode <signing options> $%TEMP%\uninstaller.exe" = 0
-    ${EndIf}
-
     ; Good.  Now we can carry on writing the real installer.
 
     ;Name and file
@@ -1110,6 +1103,13 @@ Function .onInit
     Quit
   !endif
 
+  ; The Inner invocation has written an uninstaller binary for us.
+  ; We need to sign it if it's a production build.
+
+  ${If} "@PRODUCTION_BUILD@" == "1"
+    !system "signcode <signing options> $%TEMP%\uninstaller.exe" = 0
+  ${EndIf}
+
   StrCmp "@CPACK_NSIS_ENABLE_UNINSTALL_BEFORE_INSTALL@" "ON" 0 inst
 
   ReadRegStr $0 HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\@CPACK_PACKAGE_INSTALL_REGISTRY_KEY@" "UninstallString"