new file mode 100644
--- /dev/null
+++ b/mail/installer/windows/msi/installer.wxs
@@ -0,0 +1,107 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
+
+<!-- The version field only supports MSI version numbers, which cannot include
+     letters, and therefore cannot represent our version numbers. Set it to all
+     zeros to show it isn't valid, and add the real version to the Name. -->
+<Product Name="$(var.BrandFullName) $(var.Version) $(var.Architecture) $(var.AB_CD)"
+         Manufacturer="$(var.Vendor)" Language="0" Codepage="1252"
+         Version="0.0.0.0" Id="1294a4c5-9977-480f-9497-c0ea1e630130"
+         UpgradeCode="3118ab4c-b433-4fbb-b9fa-8f9ca4b5c103" >
+
+  <Package Id="*" InstallerVersion="200" Compressed="yes"
+           Platform="$(var.Architecture)" />
+
+  <!-- We need a CAB to avoid failing an ICE, even though we have no payload. -->
+  <Media Id="1" Cabinet="setup.cab" EmbedCab="yes" />
+
+  <!-- We need a component and feature, or msiexec will refuse to load us. -->
+  <Directory Id="TARGETDIR" Name="SourceDir">
+    <Directory Id="TempFolder">
+      <Component Id="EmptyComponent" Guid="55a76b76-7496-4b47-a7a6-c5fbdd5e51a4">
+        <CreateFolder />
+      </Component>
+    </Directory>
+  </Directory>
+
+  <!-- Setting the feature to level 0 marks it hidden, so it can't be installed.
+       That prevents getting this MSI registered as an installed product,
+       because it has no features of its own to install. -->
+  <Feature Id="EmptyFeature" Level="0">
+    <ComponentRef Id="EmptyComponent" />
+  </Feature>
+
+  <!-- Embed the installer we want to run directly into the MSI database. -->
+  <Binary Id="WrappedExe" SourceFile="$(var.ExeSourcePath)" />
+
+  <!-- User-configurable properties. One of these corresponds to each documented
+       command-line parameter. Properties cannot be present without a value,
+       so use a conspicuous and difficult to mistake string for the parameters
+       that have no real default values. -->
+  <Property Id="INSTALL_DIRECTORY_PATH" Value="__DEFAULT__" />
+  <Property Id="INSTALL_DIRECTORY_NAME" Value="__DEFAULT__" />
+  <Property Id="TASKBAR_SHORTCUT" Value="true" />
+  <Property Id="DESKTOP_SHORTCUT" Value="true" />
+  <Property Id="START_MENU_SHORTCUT" Value="true" />
+  <Property Id="INSTALL_MAINTENANCE_SERVICE" Value="true" />
+  <Property Id="REMOVE_DISTRIBUTION_DIR" Value="true" />
+  <Property Id="PREVENT_REBOOT_REQUIRED" Value="false" />
+  <Property Id="OPTIONAL_EXTENSIONS" Value="true" />
+  <Property Id="EXTRACT_DIR" Value="__DEFAULT__" />
+
+  <!-- Always include all of the boolean options on the command line, so we don't
+       have to conditionally decide when to include each one of them. For the
+       directory settings though, we can't put them on the command line with the
+       default values those properties have, so we need a separate action for
+       each possible configuration of those settings, and conditions to select
+       the right action to use based on which properties are configured.
+       WiX throws warning LGHT1076 complaining that these command strings are
+       too long, but they actually work just fine, the warning is spurious. -->
+  <CustomAction Id="RunInstallNoDir" Return="check" Execute="deferred"
+                HideTarget="no" Impersonate="no" BinaryKey="WrappedExe"
+                ExeCommand="/S /TaskbarShortcut=[TASKBAR_SHORTCUT] /DesktopShortcut=[DESKTOP_SHORTCUT] /StartMenuShortcut=[START_MENU_SHORTCUT] /MaintenanceService=[INSTALL_MAINTENANCE_SERVICE] /RemoveDistributionDir=[REMOTE_DISTRIBUTION_DIR] /PreventRebootRequired=[PREVENT_REBOOT_REQUIRED] /OptionalExtensions=[OPTIONAL_EXTENSIONS] /LaunchedFromMSI" />
+  <CustomAction Id="RunInstallDirPath" Return="check" Execute="deferred"
+                HideTarget="no" Impersonate="no" BinaryKey="WrappedExe"
+                ExeCommand="/S /InstallDirectoryPath=[INSTALL_DIRECTORY_PATH] /TaskbarShortcut=[TASKBAR_SHORTCUT] /DesktopShortcut=[DESKTOP_SHORTCUT] /StartMenuShortcut=[START_MENU_SHORTCUT] /MaintenanceService=[INSTALL_MAINTENANCE_SERVICE] /RemoveDistributionDir=[REMOTE_DISTRIBUTION_DIR] /PreventRebootRequired=[PREVENT_REBOOT_REQUIRED] /OptionalExtensions=[OPTIONAL_EXTENSIONS] /LaunchedFromMSI" />
+  <CustomAction Id="RunInstallDirName" Return="check" Execute="deferred"
+                HideTarget="no" Impersonate="no" BinaryKey="WrappedExe"
+                ExeCommand="/S /InstallDirectoryName=[INSTALL_DIRECTORY_NAME] /TaskbarShortcut=[TASKBAR_SHORTCUT] /DesktopShortcut=[DESKTOP_SHORTCUT] /StartMenuShortcut=[START_MENU_SHORTCUT] /MaintenanceService=[INSTALL_MAINTENANCE_SERVICE] /RemoveDistributionDir=[REMOTE_DISTRIBUTION_DIR] /PreventRebootRequired=[PREVENT_REBOOT_REQUIRED] /OptionalExtensions=[OPTIONAL_EXTENSIONS] /LaunchedFromMSI" />
+  <CustomAction Id="RunExtractOnly" Return="check" Execute="deferred"
+                HideTarget="no" Impersonate="no" BinaryKey="WrappedExe"
+                ExeCommand="/ExtractDir=[EXTRACT_DIR]" />
+
+  <!-- When we run the custom actions is kind of arbitrary; this sequencing gets
+       us the least confusing message showing in the MSI progress dialog while
+       the installer runs. Our actions don't need to be sequenced relative
+	   to one another because only one will ever run. -->
+  <InstallExecuteSequence>
+    <Custom Action="RunInstallNoDir" After="ProcessComponents">
+    <![CDATA[
+      (INSTALL_DIRECTORY_PATH = "__DEFAULT__") AND
+      (INSTALL_DIRECTORY_NAME = "__DEFAULT__") AND
+      (EXTRACT_DIR = "__DEFAULT__")
+    ]]>
+    </Custom>
+    <Custom Action="RunInstallDirPath" After="ProcessComponents">
+    <![CDATA[
+      (INSTALL_DIRECTORY_PATH <> "__DEFAULT__") AND
+      (INSTALL_DIRECTORY_NAME = "__DEFAULT__") AND
+      (EXTRACT_DIR = "__DEFAULT__")
+    ]]>
+    </Custom>
+    <Custom Action="RunInstallDirName" After="ProcessComponents">
+    <![CDATA[
+      (INSTALL_DIRECTORY_NAME <> "__DEFAULT__") AND
+      (EXTRACT_DIR = "__DEFAULT__")
+    ]]>
+    </Custom>
+    <Custom Action="RunExtractOnly" After="ProcessComponents">
+    <![CDATA[
+      EXTRACT_DIR <> "__DEFAULT__"
+    ]]>
+    </Custom>
+  </InstallExecuteSequence>
+</Product>
+
+</Wix>

--- a/mozharness/repackage/base.py
+++ b/mozharness/repackage/base.py
@@ -1,8 +1,8 @@
 # Paths are relative to mozilla-central
 config = {
     "package-name": "thunderbird",
     "installer-tag": "comm/mail/installer/windows/app.tag",
     "sfx-stub": "comm/other-licenses/7zstub/thunderbird/7zSD.sfx",
     "stub-installer-tag": "",
-    "wsx-stub": "",
+    "wsx-stub": "comm/mail/installer/windows/msi/installer.wxs",
 }

--- a/taskcluster/ci/beetmover-repackage/kind.yml
+++ b/taskcluster/ci/beetmover-repackage/kind.yml
@@ -18,16 +18,17 @@ kind-dependencies:
     - build
     - build-signing
     - repackage
     - repackage-signing
     - nightly-l10n
     - nightly-l10n-signing
     - repackage-l10n
     - repackage-signing-l10n
+    - repackage-signing-msi
     - mar-signing
     - mar-signing-l10n
 
 primary-dependency:
     - repackage
     - repackage-l10n
 
 only-for-build-platforms:

--- a/taskcluster/ci/config.yml
+++ b/taskcluster/ci/config.yml
@@ -14,16 +14,18 @@ treeherder:
         'TW64': 'Toolchain builds for Windows 64-bits'
         'Deb7': 'Packages for Debian 7'
         'Deb7-32': 'Packages for Debian 7 32-bits'
         'Deb9': 'Packages for Debian 9'
         'Fetch-URL': 'Fetch and store content'
         'L10n': 'Localised Repacks'
         'L10n-Rpk': 'Localized Repackaged Repacks'
         'ms': 'Complete MAR signing'
+        'MSI': 'Repack installers into MSIs'
+        'MSIs': 'Signing of Repacked installers of MSIs'
         'rs': 'Repackage signing'
         'BMR-L10n': 'Beetmover repackages for locales'
         'c-Up': 'Balrog submission of complete updates'
         'cs': 'Checksum signing'
         'BMcs': 'Beetmover checksums,'
         'Rel': 'Release promotion'
         'css': 'Checksum signing for source'
         'BMcss': 'Beetmover checksums for source'

--- a/taskcluster/ci/release-bouncer-aliases/kind.yml
+++ b/taskcluster/ci/release-bouncer-aliases/kind.yml
@@ -37,15 +37,17 @@ job-defaults:
 
 jobs:
     thunderbird:
         bouncer-products-per-alias:
             by-project:
                 comm-beta:
                     thunderbird-beta-latest-ssl: installer-ssl
                     thunderbird-beta-latest: installer
+                    thunderbird-beta-msi-latest-ssl: msi
                 comm-esr60:
                     thunderbird-latest-ssl: installer-ssl
                     thunderbird-latest: installer
+                    thunderbird-msi-latest-ssl: msi
                 default: {}
         shipping-product: thunderbird
         treeherder:
             platform: thunderbird-release/opt

--- a/taskcluster/ci/release-bouncer-sub/kind.yml
+++ b/taskcluster/ci/release-bouncer-sub/kind.yml
@@ -32,13 +32,13 @@ job-defaults:
         kind: test
         tier: 1
 
 jobs:
     thunderbird:
         bouncer-platforms: ['linux', 'linux64', 'osx', 'win', 'win64']
         bouncer-products:
             by-project:
-                default: ['complete-mar', 'installer', 'installer-ssl', 'partial-mar']
+                default: ['complete-mar', 'installer', 'installer-ssl', 'partial-mar', 'msi']
                 comm-esr60: ['complete-mar', 'complete-mar-bz2', 'installer', 'installer-ssl', 'partial-mar']
         shipping-product: thunderbird
         treeherder:
             platform: thunderbird-release/opt

new file mode 100644
--- /dev/null
+++ b/taskcluster/ci/repackage-msi/kind.yml
@@ -0,0 +1,36 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+loader: taskgraph.loader.single_dep:loader
+
+transforms:
+    - taskgraph.transforms.name_sanity:transforms
+    - taskgraph.transforms.repackage:transforms
+    - taskgraph.transforms.use_toolchains:transforms
+    - taskgraph.transforms.job:transforms
+    - taskgraph.transforms.task:transforms
+
+kind-dependencies:
+    - repackage-signing
+    - repackage-signing-l10n
+    - fetch
+
+only-for-build-platforms:
+   - win32-nightly/opt
+   - win64-nightly/opt
+
+job-template:
+    mozharness:
+        config:
+            by-build-platform:
+                win32\b.*:
+                    - repackage/base.py
+                    - repackage/win32_signed.py
+                win64\b.*:
+                    - repackage/base.py
+                    - repackage/win64_signed.py
+    package-formats: [msi]
+    fetches:
+        fetch:
+            - wix-3.1.1

new file mode 100644
--- /dev/null
+++ b/taskcluster/ci/repackage-signing-msi/kind.yml
@@ -0,0 +1,19 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+loader: taskgraph.loader.single_dep:loader
+
+transforms:
+   - taskgraph.transforms.name_sanity:transforms
+   - taskgraph.transforms.repackage_signing:transforms
+   - taskgraph.transforms.task:transforms
+
+kind-dependencies:
+   - repackage-msi
+
+only-for-build-platforms:
+   - win32-nightly/opt
+   - win32/opt
+   - win64-nightly/opt
+   - win64/opt