diff --git a/cmake/templates/NSIS.template.in b/cmake/templates/NSIS.template.in
index e315d9df55..3d67f70ea5 100644
--- a/cmake/templates/NSIS.template.in
+++ b/cmake/templates/NSIS.template.in
@@ -44,18 +44,18 @@
 
     !system "$\"${NSISDIR}\makensis$\" /DINNER project.nsi" = 0
 
+    ; Require administrator access
+    RequestExecutionLevel admin
+
     ; So now run that installer we just created as %TEMP%\tempinstaller.exe.  Since it
     ; calls quit the return value isn't zero.
 
     !system "$%TEMP%\tempinstaller.exe" = 2
 
-    ;Require administrator access
-    RequestExecutionLevel admin
-
     ; The Inner invocation has written an uninstaller binary for us.
     ; We need to sign it if it's a production or PR build.
     !if @PRODUCTION_BUILD@ == 1
-      !execute '"@SIGNTOOL_EXECUTABLE@" sign /f %HF_PFX_FILE% /p %HF_PFX_PASSPHRASE% /tr http://tsa.starfieldtech.com /td SHA256 $%TEMP%\uninstaller.exe' = 0
+      !system '"@SIGNTOOL_EXECUTABLE@" sign /f %HF_PFX_FILE% /p %HF_PFX_PASSPHRASE% /tr http://tsa.starfieldtech.com /td SHA256 $%TEMP%\uninstaller.exe' = 0
     !endif
 
     ; Good.  Now we can carry on writing the real installer.