--- a/toolkit/mozapps/update/nsUpdateService.js
+++ b/toolkit/mozapps/update/nsUpdateService.js
@@ -427,25 +427,25 @@ XPCOMUtils.defineLazyGetter(this, "gCanS
     // No need to perform directory write checks, the maintenance service will
     // be able to write to all directories.
     LOG("gCanStageUpdates - able to stage updates because we'll use the service");
     return true;
   }
 #endif
 
   try {
-    var updateTestFile = getUpdateFile([FILE_PERMS_TEST]);
+    var updateTestFile = getInstallDirRoot();
+    updateTestFile.append(FILE_PERMS_TEST);
     LOG("gCanStageUpdates - testing write access " + updateTestFile.path);
     testWriteAccess(updateTestFile, true);
 #ifndef XP_MACOSX
     // On all platforms except Mac, we need to test the parent directory as well,
     // as we need to be able to move files in that directory during the replacing
     // step.
-    updateTestFile = getUpdateDirCreate([]);
-    updateTestFile = updateTestFile.parent;
+    updateTestFile = getInstallDirRoot().parent;
     updateTestFile.append(FILE_PERMS_TEST);
     LOG("gCanStageUpdates - testing write access " + updateTestFile.path);
     updateTestFile.createUnique(Ci.nsILocalFile.DIRECTORY_TYPE,
                                 FileUtils.PERMS_DIRECTORY);
     updateTestFile.remove(false);
 #endif
   }
   catch (e) {
@@ -548,16 +548,32 @@ function getUpdateDirCreate(pathArray) {
     return dir;
   } catch (e) {
   }
 #endif
   return FileUtils.getDir(KEY_APPDIR, pathArray, true);
 }
 
 /**
+ * Gets the root of the installation directory which is the application
+ * bundle directory on Mac OS X and the location of the application binary
+ * on all other platforms.
+ *
+ * @return nsIFile object for the directory
+ */
+function getInstallDirRoot() {
+  var dir = FileUtils.getDir(KEY_APPDIR, [], false);
+#ifdef XP_MACOSX
+  // On Mac, we store the Updated.app directory inside the bundle directory.
+  dir = dir.parent.parent;
+#endif
+  return dir;
+}
+
+/**
  * Gets the file at the specified hierarchy under the update root directory.
  * @param   pathArray
  *          An array of path components to locate beneath the directory
  *          specified by |key|. The last item in this array must be the
  *          leaf name of a file.
  * @return  nsIFile object for the file specified. The file is NOT created
  *          if it does not exist, however all required directories along
  *          the way are.