diff --git a/keyring/isc.gpg b/keyring/isc.gpg
new file mode 100644
index 0000000..49bb2d7
Binary files /dev/null and b/keyring/isc.gpg differ
diff --git a/keyring/nlnetlabs.gpg b/keyring/nlnetlabs.gpg
new file mode 100644
index 0000000..223b63c
Binary files /dev/null and b/keyring/nlnetlabs.gpg differ
diff --git a/keyring/zlib.gpg b/keyring/zlib.gpg
new file mode 120000
index 0000000..7701394
--- /dev/null
+++ b/keyring/zlib.gpg
@@ -0,0 +1 @@
+../tor-browser-build/keyring/zlib.gpg
\ No newline at end of file
diff --git a/projects/ncdns-nsis/build b/projects/ncdns-nsis/build
new file mode 100644
index 0000000..296f8e8
--- /dev/null
+++ b/projects/ncdns-nsis/build
@@ -0,0 +1,53 @@
+#!/bin/bash
+[% c("var/set_default_env") -%]
+
+distdir=/var/tmp/dist/[% project %]
+mkdir -p "$distdir"
+
+# We need to install a recent version of python-pefile so that it works
+# in a x86_64 container:
+# https://github.com/TheTorProject/tor-messenger-build/pull/10
+tar xf $rootdir/[% c('input_files_by_name/python-pefile') %]
+cd $(echo [% c('input_files_by_name/python-pefile') %] | sed s/\.tar\.gz$//)
+python setup.py install --user
+cd ..
+
+tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/nsis') %]
+export PATH="/var/tmp/dist/nsis/bin:$PATH"
+
+cd "$distdir"
+
+tar -C . -xf $rootdir/[% project %]-[% c('version') %].tar.gz
+mv ./ncdns-nsis-*/* ./
+
+NSISFLAGS="-V2"
+OUTFN=build/bin/ncdns-[% c("version") %]-[% c("arch") %]-install.exe
+
+ARTIFACTS="$distdir/build/artifacts"
+NEUTRAL_ARTIFACTS="$distdir/artifacts"
+
+mkdir -p "${ARTIFACTS}"
+
+mkdir -p /var/tmp/dist/plain-binaries
+tar -C /var/tmp/dist/plain-binaries -xf $rootdir/[% c('input_files_by_name/plain-binaries') %]
+cp /var/tmp/dist/plain-binaries/*.exe /var/tmp/dist/plain-binaries/*.dll  ${ARTIFACTS}
+
+mkdir /var/tmp/dist/bind
+unzip -d /var/tmp/dist/bind $rootdir/[% c('input_files_by_name/bind') %]
+cp /var/tmp/dist/bind/*.exe /var/tmp/dist/bind/*.dll ${ARTIFACTS}
+
+cp $rootdir/[% c('input_files_by_name/dnssec-trigger') %] ${ARTIFACTS}
+
+[% IF c("var/windows-x86_64") %]
+  cp $rootdir/[% c('input_files_by_name/namecoin-core') %] ${ARTIFACTS}
+[% END %]
+
+cp $rootdir/[% c('input_files_by_name/consensusj-namecoin') %] ${ARTIFACTS}/bitcoinj-daemon.jar
+
+mkdir -p build/bin
+makensis ${NSISFLAGS} -DPOSIX_BUILD=1 -DNCDNS_PRODVER=[% c('var/ncdns_nsis_version') %] [% c('var/arch_nsis_args') %] "-DARTIFACTS=$ARTIFACTS" "-DNEUTRAL_ARTIFACTS=$NEUTRAL_ARTIFACTS" "-DDNSSEC_TRIGGER_FN=[% c('input_files_by_name/dnssec-trigger') %]" "-DNAMECOIN_FN=[% c('input_files_by_name/namecoin-core') %]" "-DOUTFN=${OUTFN}" ncdns.nsi
+
+# Working around NSIS braindamage
+mv "${OUTFN}" torbrowser-install-tmp.exe
+python $rootdir/pe_checksum_fix.py
+mv torbrowser-install-tmp2.exe [% dest_dir _ '/' _ c('filename') %]
diff --git a/projects/ncdns-nsis/config b/projects/ncdns-nsis/config
new file mode 100644
index 0000000..bb7ef1c
--- /dev/null
+++ b/projects/ncdns-nsis/config
@@ -0,0 +1,56 @@
+# vim: filetype=yaml sw=2
+version: '[% pc("ncdns", "version") %]'
+git_url: https://github.com/namecoin/ncdns-nsis.git
+git_hash: 'f3f7c7a7a13897044e4499cd89d61bf9c2b1d07e'
+filename: 'ncdns-[% c("version") %]-[% c("arch") %]-install-[% c("var/build_id") %].exe'
+
+var:
+  bind_version: '9.15.7'
+  consensusj_namecoin_version: '0.3.2.1'
+  dnssec_trigger_version: '0.17'
+  namecoin_core_version: '0.21.0.1'
+  # Used for PE metadata.
+  # Must be a 4-tuple without leading 'v' for NSIS to be happy.
+  ncdns_nsis_version: '0.1.2.0'
+  container:
+    use_container: 1
+  deps:
+    - python
+    - python-future
+    - unzip
+
+targets:
+  windows-x86_64:
+    var:
+      arch_nsis_args: '-DNCDNS_64BIT=1'
+      bind_arch: 'x64'
+  windows-i686:
+    var:
+      arch_nsis_args: '-DNO_NAMECOIN_CORE'
+      bind_arch: 'x86'
+
+input_files:
+  - project: container-image
+  - project: plain-binaries
+    name: plain-binaries
+  - name: bind
+    URL: 'https://ftp.isc.org/isc/bind/[% c("var/bind_version") %]/BIND[% c("var/bind_version") %].[% c("var/bind_arch") %].zip'
+    file_gpg_id: 1
+    gpg_keyring: isc.gpg
+  - name: dnssec-trigger
+    URL: 'https://www.nlnetlabs.nl/downloads/dnssec-trigger/dnssec_trigger_setup_[% c("var/dnssec_trigger_version") %].exe'
+    file_gpg_id: 1
+    gpg_keyring: nlnetlabs.gpg
+  - name: namecoin-core
+    URL: 'https://www.namecoin.org/files/namecoin-core/namecoin-core-[% c("var/namecoin_core_version") %]/namecoin-nc[% c("var/namecoin_core_version") %]-win64-setup-unsigned.exe'
+    sha256sum: f82c070daa086c2243d641bb07a31d6dc272e191a7792860974d0cd1f0b97873
+    enable: '[% c("var/windows-x86_64") %]'
+  - name: consensusj-namecoin
+    URL: 'https://www.namecoin.org/files/ConsensusJ-Namecoin/[% c("var/consensusj_namecoin_version") %]/namecoinj-daemon-0.3.2-SNAPSHOT.jar'
+    sha256sum: 6b35d5a31eb74b4870c8a6c37dd53563aa63b64810fdedb5192f2a77396e190f
+  - project: nsis
+    name: nsis
+  - filename: pe_checksum_fix.py
+  - name: python-pefile
+    URL: https://files.pythonhosted.org/packages/7e/9b/f99171190f04cd23768547dd34533b4016bd582842f53cd9fe9585a74c74/pefile-2017.11.5.tar.gz
+    sha256sum: 675c35ee0e1677db9e80d2f48d8a7ff2cf38e6207e8cd5e2a2c6d126db025854
diff --git a/projects/nsis b/projects/nsis
new file mode 120000
index 0000000..f29c93d
--- /dev/null
+++ b/projects/nsis
@@ -0,0 +1 @@
+../tor-browser-build/projects/nsis
\ No newline at end of file
diff --git a/projects/release/build b/projects/release/build
index 79a3fbb..4476e12 100644
--- a/projects/release/build
+++ b/projects/release/build
@@ -18,9 +18,12 @@ mkdir -p "$destdir"
 [% END -%]
 [% IF c("var/ncdns-windows-i686") -%]
   mv [% c('input_files_by_name/windows-i686') %] "$destdir"/
+  # NSIS disabled for i686 due to unavailability of BIND binaries.
+  #mv [% c('input_files_by_name/windows-i686-nsis') %] "$destdir"/
 [% END -%]
 [% IF c("var/ncdns-windows-x86_64") -%]
   mv [% c('input_files_by_name/windows-x86_64') %] "$destdir"/
+  mv [% c('input_files_by_name/windows-x86_64-nsis') %] "$destdir"/
 [% END -%]
 [% IF c("var/ncdns-osx-x86_64") -%]
   mv [% c('input_files_by_name/osx-x86_64') %] "$destdir"/
diff --git a/projects/release/config b/projects/release/config
index 2d542e0..09457d4 100644
--- a/projects/release/config
+++ b/projects/release/config
@@ -176,6 +176,22 @@ input_files:
      - '[% c("var/build_target") %]'
      - ncdns-windows-x86_64
 
+ # i686 is disabled for NSIS because BIND no longer distributes binaries.  Once
+ # we replace BIND, maybe we can re-enable this.
+ #- name: windows-i686-nsis
+ #  project: ncdns-nsis
+ #  enable: '[% c("var/ncdns-windows-i686") %]'
+ #  target:
+ #    - '[% c("var/build_target") %]'
+ #    - ncdns-windows-i686
+
+ - name: windows-x86_64-nsis
+   project: ncdns-nsis
+   enable: '[% c("var/ncdns-windows-x86_64") %]'
+   target:
+     - '[% c("var/build_target") %]'
+     - ncdns-windows-x86_64
+
  - name: osx-x86_64
    project: plain-binaries
    enable: '[% c("var/ncdns-osx-x86_64") %]'
diff --git a/projects/zlib b/projects/zlib
new file mode 120000
index 0000000..81dd396
--- /dev/null
+++ b/projects/zlib
@@ -0,0 +1 @@
+../tor-browser-build/projects/zlib
\ No newline at end of file
diff --git a/tools/setup-submodule-symlinks.sh b/tools/setup-submodule-symlinks.sh
index 911a2cf..45e1f11 100755
--- a/tools/setup-submodule-symlinks.sh
+++ b/tools/setup-submodule-symlinks.sh
@@ -20,3 +20,5 @@ else
   git submodule update --init
   make -C tor-browser-build submodule-update
 fi
+
+cp tor-browser-build/projects/tor-browser/pe_checksum_fix.py projects/ncdns-nsis/