--- a/browser/app/macbuild/Contents/_CodeSignature/CodeResources
+++ b/browser/app/macbuild/Contents/_CodeSignature/CodeResources
@@ -49,11 +49,23 @@
                 <real>10</real>
             </dict>
             <key>^MacOS/updates.xml$</key><dict>
                 <key>omit</key>
                 <true/>
                 <key>weight</key>
                 <real>10</real>
             </dict>
+            <key>^Updated.app/.*</key><dict>
+                <key>omit</key>
+                <true/>
+                <key>weight</key>
+                <real>10</real>
+            </dict>
+            <key>^updating/.*</key><dict>
+                <key>omit</key>
+                <true/>
+                <key>weight</key>
+                <real>10</real>
+            </dict>
         </dict>
     </dict>
 </plist>

--- a/toolkit/mozapps/update/tests/unit_aus_update/head_update.js
+++ b/toolkit/mozapps/update/tests/unit_aus_update/head_update.js
@@ -769,28 +769,43 @@ function getUpdatedDirPath() {
   return updatedDirPath;
 }
 
 /**
  * Helper function for getting the directory where files are added, removed,
  * and modified by the simple.mar update file.
  *
  * @return  nsIFile for the directory where files are added, removed, and
- * modified by the simple.mar update file.
+ *          modified by the simple.mar update file.
  */
 function getUpdateTestDir() {
   let updateTestDir = getApplyDirFile(null, true);
 
   if (IS_MACOSX) {
     updateTestDir = updateTestDir.parent.parent;
   }
   updateTestDir.append("update_test");
   return updateTestDir;
 }
 
+/**
+ * Helper function for getting the updating directory which is used by the
+ * updater to extract the update manifest and patch files.
+ *
+ * @return  nsIFile for the directory for the updating directory.
+ */
+function getUpdatingDir() {
+  let updatingDir = getApplyDirFile(null, true);
+
+  if (IS_MACOSX) {
+    updatingDir = updatingDir.parent.parent;
+  }
+  updatingDir.append("updating");
+  return updatingDir;
+}
 
 #ifdef XP_WIN
 XPCOMUtils.defineLazyGetter(this, "gInstallDirPathHash",
                             function test_gInstallDirPathHash() {
   // Figure out where we should check for a cached hash value
   if (!MOZ_APP_BASENAME)
     return null;
 
@@ -1091,16 +1106,19 @@ function runUpdate(aExpectedExitValue, a
                 readFileBytes(updateLog).replace(/\r\n/g, "\n"));
   }
   logTestInfo("testing updater binary process exitValue against expected " +
               "exit value");
   do_check_eq(process.exitValue, aExpectedExitValue);
   logTestInfo("testing update status against expected status");
   do_check_eq(status, aExpectedStatus);
 
+  logTestInfo("testing updating directory doesn't exist");
+  do_check_false(getUpdatingDir().exists());
+
   if (aCallback !== null) {
     if (typeof(aCallback) == typeof(Function)) {
       aCallback();
     } else {
       checkUpdateApplied();
     }
   }
 }
@@ -1608,16 +1626,19 @@ function runUpdateUsingService(aInitialS
     }
     logTestInfo("testing update status against expected status");
     do_check_eq(status, aExpectedStatus);
 
     if (aCheckSvcLog) {
       checkServiceLogs(svcOriginalLog);
     }
 
+    logTestInfo("testing updating directory doesn't exist");
+    do_check_false(getUpdatingDir().exists());
+
     checkUpdateFinished();
   }
 
   let timer = AUS_Cc["@mozilla.org/timer;1"].createInstance(AUS_Ci.nsITimer);
   timer.initWithCallback(timerCallback, 1000, timer.TYPE_REPEATING_SLACK);
 }
 
 /**

--- a/toolkit/mozapps/update/updater/updater.cpp
+++ b/toolkit/mozapps/update/updater/updater.cpp
@@ -1390,17 +1390,17 @@ int
 PatchFile::Prepare()
 {
   LOG(("PREPARE PATCH " LOG_S, mFile));
 
   // extract the patch to a temporary file
   mPatchIndex = sPatchIndex++;
 
   NS_tsnprintf(spath, sizeof(spath)/sizeof(spath[0]),
-               NS_T("%s/%d.patch"), gSourcePath, mPatchIndex);
+               NS_T("%s/updating/%d.patch"), gDestinationPath, mPatchIndex);
 
   NS_tremove(spath);
 
   FILE *fp = NS_tfopen(spath, NS_T("wb"));
   if (!fp)
     return WRITE_ERROR;
 
 #ifdef XP_WIN
@@ -2227,16 +2227,20 @@ UpdateThreadFunc(void *param)
 
     if (rv == OK && sStagedUpdate && !sIsOSUpdate) {
       rv = CopyInstallDirToDestDir();
     }
 
     if (rv == OK) {
       rv = DoUpdate();
       gArchiveReader.Close();
+      NS_tchar updatingDir[MAXPATHLEN];
+      NS_tsnprintf(updatingDir, sizeof(updatingDir)/sizeof(updatingDir[0]),
+                   NS_T("%s/updating"), gDestinationPath);
+      ensure_remove_recursive(updatingDir);
     }
   }
 
   bool reportRealResults = true;
   if (sReplaceRequest && rv && !getenv("MOZ_NO_REPLACE_FALLBACK")) {
     // When attempting to replace the application, we should fall back
     // to non-staged updates in case of a failure.  We do this by
     // setting the status to pending, exiting the updater, and
@@ -3645,29 +3649,31 @@ int AddPreCompleteActions(ActionList *li
 
   return OK;
 }
 
 int DoUpdate()
 {
   NS_tchar manifest[MAXPATHLEN];
   NS_tsnprintf(manifest, sizeof(manifest)/sizeof(manifest[0]),
-               NS_T("%s/update.manifest"), gSourcePath);
+               NS_T("%s/updating/update.manifest"), gDestinationPath);
+  ensure_parent_dir(manifest);
 
   // extract the manifest
   int rv = gArchiveReader.ExtractFile("updatev2.manifest", manifest);
   if (rv) {
     rv = gArchiveReader.ExtractFile("update.manifest", manifest);
     if (rv) {
       LOG(("DoUpdate: error extracting manifest file"));
       return rv;
     }
   }
 
   NS_tchar *rb = GetManifestContents(manifest);
+  NS_tremove(manifest);
   if (rb == nullptr) {
     LOG(("DoUpdate: error opening manifest file: " LOG_S, manifest));
     return READ_ERROR;
   }
 
 
   ActionList list;
   NS_tchar *line;