diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5cd9cd53a..27b53d3ec 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,6 +26,11 @@ on:
         required: true
         type: "boolean"
         default: false
+      disable-pgo:
+        description: "Build without PGO (skips the profile generation stages)"
+        required: false
+        type: "boolean"
+        default: false
   workflow_call:
     inputs:
       create_release:
@@ -48,6 +53,11 @@ on:
         required: true
         type: "boolean"
         default: false
+      disable-pgo:
+        description: "Build without PGO (skips the profile generation stages)"
+        required: false
+        type: "boolean"
+        default: false
 
 jobs:
   buildid:
@@ -73,6 +83,7 @@ jobs:
           echo "create_release: ${{ inputs.create_release }}"
           echo "update_version: ${{ inputs.update_version }}"
           echo "use sccache: ${{ inputs.use-sccache }}"
+          echo "disable-pgo: ${{ inputs.disable-pgo }}"
           echo "update_branch: ${{ inputs.update_branch }}"
           echo "GITHUB_REPOSITORY: ${{ github.repository }}"
           echo "GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}"
@@ -102,14 +113,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download aws-cli
-        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: ${{ inputs.update_branch == 'release' }}
         run: |
           curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
           unzip awscliv2.zip
           sudo ./aws/install --update
 
       - name: Start self-hosted runner
-        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: ${{ inputs.update_branch == 'release' }}
         run: |
           echo "Starting self-hosted runner"
           echo "${{ secrets.SELF_HOSTED_RUNNER_START_SCRIPT }}" | base64 -d > start.sh
@@ -117,7 +128,7 @@ jobs:
           bash ./start.sh
 
       - name: Remove self-hosted runner script
-        if: always() && ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: always() && ${{ inputs.update_branch == 'release' }}
         run: |
           echo "Removing self-hosted runner script"
           rm start.sh || true
@@ -280,12 +291,14 @@ jobs:
   windows-step-1:
     name: Windows build step 1 (PGO build)
     uses: ./.github/workflows/windows-release-build.yml
+    if: ${{ !inputs.disable-pgo }}
     needs: [build-data, buildid]
     permissions:
       contents: write
     secrets: inherit
     with:
       use-sccache: ${{ inputs.use-sccache }}
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       generate-pgo: true
       profile-data-path-archive: zen-windows-profile-data-and-jarlog.zip
@@ -295,11 +308,13 @@ jobs:
   windows-step-2:
     name: Windows build step 2 (Generate profile data)
     uses: ./.github/workflows/windows-profile-build.yml
+    if: ${{ !inputs.disable-pgo }}
     permissions:
       contents: write
     secrets: inherit
     needs: [windows-step-1, build-data]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       profile-data-path-archive: zen.win64-pgo-stage-1.zip
       release-branch: ${{ inputs.update_branch }}
@@ -310,10 +325,14 @@ jobs:
     permissions:
       contents: write
     secrets: inherit
+    # windows-step-2 is skipped when PGO is disabled, so don't inherit its skip
+    if: ${{ !failure() && !cancelled() }}
     needs: [build-data, windows-step-2, start-self-host, buildid]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       generate-pgo: false
+      disable-pgo: ${{ inputs.disable-pgo }}
       release-branch: ${{ inputs.update_branch }}
       MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}
       use-sccache: ${{ inputs.use-sccache }}
@@ -326,20 +345,24 @@ jobs:
     secrets: inherit
     needs: [build-data, start-self-host, buildid]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       release-branch: ${{ inputs.update_branch }}
       MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}
       use-sccache: ${{ inputs.use-sccache }}
+      disable-pgo: ${{ inputs.disable-pgo }}
 
   mac-step-1:
     name: macOS build step 1 (PGO build)
     uses: ./.github/workflows/macos-release-build.yml
+    if: ${{ !inputs.disable-pgo }}
     needs: [build-data, buildid]
     permissions:
       contents: write
     secrets: inherit
     with:
       use-sccache: ${{ inputs.use-sccache }}
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       generate-pgo: true
       release-branch: ${{ inputs.update_branch }}
@@ -348,11 +371,13 @@ jobs:
   mac-step-2:
     name: macOS build step 2 (Generate profile data)
     uses: ./.github/workflows/macos-profile-build.yml
+    if: ${{ !inputs.disable-pgo }}
     permissions:
       contents: write
     secrets: inherit
     needs: [mac-step-1, build-data]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       release-branch: ${{ inputs.update_branch }}
 
@@ -362,10 +387,14 @@ jobs:
     permissions:
       contents: write
     secrets: inherit
+    # mac-step-2 is skipped when PGO is disabled, so don't inherit its skip
+    if: ${{ !failure() && !cancelled() }}
     needs: [build-data, mac-step-2, start-self-host, buildid]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       generate-pgo: false
+      disable-pgo: ${{ inputs.disable-pgo }}
       release-branch: ${{ inputs.update_branch }}
       MOZ_BUILD_DATE: ${{needs.buildid.outputs.buildids}}
       use-sccache: ${{ inputs.use-sccache }}
@@ -378,6 +407,7 @@ jobs:
     secrets: inherit
     needs: [build-data, mac-step-3]
     with:
+      force-candidate: ${{ !inputs.create_release }}
       build-version: ${{ needs.build-data.outputs.version }}
       release-branch: ${{ inputs.update_branch }}
 
@@ -470,14 +500,14 @@ jobs:
     if: always()
     steps:
       - name: Download aws-cli
-        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: ${{ inputs.update_branch == 'release' }}
         run: |
           curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
           unzip awscliv2.zip
           sudo ./aws/install --update
 
       - name: Stop self-hosted runner
-        if: ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: ${{ inputs.update_branch == 'release' }}
         run: |
           echo "Stopping self-hosted runner"
           echo "${{ secrets.SELF_HOSTED_RUNNER_STOP_SCRIPT }}" | base64 -d > stop.sh
@@ -485,13 +515,12 @@ jobs:
           bash ./stop.sh > /dev/null
 
       - name: Remove self-hosted runner script
-        if: always() && ${{ inputs.create_release && inputs.update_branch == 'release' }}
+        if: always() && ${{ inputs.update_branch == 'release' }}
         run: |
           echo "Removing self-hosted runner script"
           rm stop.sh || true
 
   release:
-    if: ${{ inputs.create_release || inputs.update_branch == 'twilight' }}
     permissions: write-all
     name: Release
     needs:
@@ -585,6 +614,7 @@ jobs:
 
       - name: Commit
         uses: stefanzweifel/git-auto-commit-action@v5
+        if: ${{ inputs.create_release || inputs.update_branch == 'twilight' }}
         with:
           commit_message: 🚀 Update update manifests
           commit_user_name: Zen Browser Robot
@@ -628,9 +658,22 @@ jobs:
         env:
           GITHUB_REPOSITORY: ${{ github.repository }}
 
+      - name: Upload signed MAR files to workflow artifacts
+        if: ${{ inputs.update_branch == 'release' && !inputs.create_release }}
+        uses: actions/upload-artifact@v4
+        with:
+          retention-days: 5
+          name: signed-mar-files
+          path: |
+            ./linux.mar/*
+            ./linux-aarch64.mar/*
+            ./.github/workflows/object/windows-x64-signed-x86_64/windows.mar
+            ./.github/workflows/object/windows-x64-signed-arm64/windows-arm64.mar
+            ./macos.mar/*
+
       - name: Release
         uses: softprops/action-gh-release@v2.2.2
-        if: ${{ inputs.update_branch == 'release' }}
+        if: ${{ inputs.update_branch == 'release' && inputs.create_release }}
         with:
           token: ${{ secrets.DEPLOY_KEY }}
           tag_name: ${{ needs.build-data.outputs.version }}
diff --git a/.github/workflows/linux-release-build.yml b/.github/workflows/linux-release-build.yml
index baaea9dbf..7415eee48 100644
--- a/.github/workflows/linux-release-build.yml
+++ b/.github/workflows/linux-release-build.yml
@@ -20,6 +20,19 @@ on:
         required: true
         type: boolean
         default: false
+      disable-pgo:
+        description: "Build without PGO at all"
+        required: false
+        type: boolean
+        default: false
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   build-linux:
@@ -122,7 +135,7 @@ jobs:
           cd ..
 
       - name: Build (PGO stage 1 - generate)
-        if: ${{ matrix.arch == 'x86_64' }}
+        if: ${{ matrix.arch == 'x86_64' && !inputs.disable-pgo }}
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
           ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
@@ -139,7 +152,7 @@ jobs:
           bash .github/workflows/src/release-build.sh
 
       - name: Generate PGO profile data
-        if: ${{ matrix.arch == 'x86_64' }}
+        if: ${{ matrix.arch == 'x86_64' && !inputs.disable-pgo }}
         run: |
           set -x
           export DISPLAY=:2
@@ -157,6 +170,7 @@ jobs:
         env:
           SURFER_COMPAT: ${{ matrix.arch }}
           ZEN_RELEASE_BRANCH: ${{ inputs.release-branch }}
+          ZEN_GA_DISABLE_PGO: ${{ inputs.disable-pgo && '1' || '' }}
           ZEN_SAFEBROWSING_API_KEY: ${{ secrets.ZEN_SAFEBROWSING_API_KEY }}
           ZEN_MOZILLA_API_KEY: ${{ secrets.ZEN_MOZILLA_API_KEY }}
           ZEN_GOOGLE_LOCATION_SERVICE_API_KEY: ${{ secrets.ZEN_GOOGLE_LOCATION_SERVICE_API_KEY }}
diff --git a/.github/workflows/macos-profile-build.yml b/.github/workflows/macos-profile-build.yml
index 43aa552b2..9dbbcaff4 100644
--- a/.github/workflows/macos-profile-build.yml
+++ b/.github/workflows/macos-profile-build.yml
@@ -14,6 +14,14 @@ on:
         description: "The branch to build"
         required: true
         type: string
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   macos-profile-build:
diff --git a/.github/workflows/macos-release-build.yml b/.github/workflows/macos-release-build.yml
index 0423c566e..6e45fd2fc 100644
--- a/.github/workflows/macos-release-build.yml
+++ b/.github/workflows/macos-release-build.yml
@@ -10,6 +10,11 @@ on:
         required: true
         type: boolean
         default: false
+      disable-pgo:
+        description: "Build without PGO at all"
+        required: false
+        type: boolean
+        default: false
       build-version:
         description: "The version to build"
         required: true
@@ -27,6 +32,14 @@ on:
         required: true
         type: boolean
         default: false
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   mac-build:
@@ -140,13 +153,13 @@ jobs:
 
       - name: Download artifact (if use profdata)
         uses: actions/download-artifact@v4
-        if: ${{ !inputs.generate-pgo }}
+        if: ${{ !inputs.generate-pgo && !inputs.disable-pgo }}
         with:
           path: ~/artifact
           name: macos-profdata-${{ matrix.arch }}
 
       - name: Show artifact info
-        if: ${{ !inputs.generate-pgo }}
+        if: ${{ !inputs.generate-pgo && !inputs.disable-pgo }}
         run: |
           ls ~/artifact
           ls ~/artifact/en-US.log
@@ -166,6 +179,9 @@ jobs:
           if test ${{ inputs.generate-pgo }} = true; then
             export ZEN_GA_GENERATE_PROFILE=1
           fi
+          if test ${{ inputs.disable-pgo }} = true; then
+            export ZEN_GA_DISABLE_PGO=1
+          fi
           if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
             export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
           fi
diff --git a/.github/workflows/macos-universal-release-build.yml b/.github/workflows/macos-universal-release-build.yml
index 101d39738..ecadde63f 100644
--- a/.github/workflows/macos-universal-release-build.yml
+++ b/.github/workflows/macos-universal-release-build.yml
@@ -11,6 +11,14 @@ on:
         description: "The branch to build"
         required: true
         type: string
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   mac-build:
diff --git a/.github/workflows/windows-profile-build.yml b/.github/workflows/windows-profile-build.yml
index 694672647..888a237b8 100644
--- a/.github/workflows/windows-profile-build.yml
+++ b/.github/workflows/windows-profile-build.yml
@@ -18,6 +18,14 @@ on:
         description: "The branch to build"
         required: true
         type: string
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   windows-profile-build:
diff --git a/.github/workflows/windows-release-build.yml b/.github/workflows/windows-release-build.yml
index e27d50589..9741ca354 100644
--- a/.github/workflows/windows-release-build.yml
+++ b/.github/workflows/windows-release-build.yml
@@ -10,6 +10,11 @@ on:
         required: true
         type: boolean
         default: false
+      disable-pgo:
+        description: "Build without PGO at all"
+        required: false
+        type: boolean
+        default: false
       build-version:
         description: "The version to build"
         required: true
@@ -30,6 +35,13 @@ on:
         required: true
         type: boolean
         default: false
+      force-candidate:
+        description: "Force building against the Firefox release candidate"
+        required: false
+        type: boolean
+        default: false
+env:
+  SURFER_FORCE_CANDIDATE: ${{ inputs.force-candidate && '1' || '' }}
 
 jobs:
   windows-build:
@@ -215,13 +227,13 @@ jobs:
 
       - name: Download artifact (if use profdata)
         uses: actions/download-artifact@v4
-        if: ${{ !inputs.generate-pgo && matrix.arch == 'x86_64' }}
+        if: ${{ !inputs.generate-pgo && !inputs.disable-pgo && matrix.arch == 'x86_64' }}
         with:
           path: ~/artifact
           name: windows-profdata-${{ matrix.arch == 'aarch64' && 'arm64' || matrix.arch }}
 
       - name: Show artifact info
-        if: ${{ !inputs.generate-pgo && matrix.arch == 'x86_64' }}
+        if: ${{ !inputs.generate-pgo && !inputs.disable-pgo && matrix.arch == 'x86_64' }}
         run: |
           ls ~/artifact
           ls ~/artifact/en-US.log
@@ -246,6 +258,9 @@ jobs:
           if test ${{ inputs.generate-pgo }} = true; then
             export ZEN_GA_GENERATE_PROFILE=1
           fi
+          if test ${{ inputs.disable-pgo }} = true; then
+            export ZEN_GA_DISABLE_PGO=1
+          fi
           if [[ -n ${{ inputs.MOZ_BUILD_DATE }} ]];then
             export MOZ_BUILD_DATE=${{ inputs.MOZ_BUILD_DATE }}
           fi
diff --git a/package-lock.json b/package-lock.json
index 484c33d77..7a0bc5651 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,7 @@
       "devDependencies": {
         "@babel/preset-typescript": "^7.27.0",
         "@zen-browser/prettier": "^3.9.3",
-        "@zen-browser/surfer": "^1.14.8",
+        "@zen-browser/surfer": "^1.14.9",
         "formal-git": "^1.2.9",
         "globals": "^16.3.0",
         "husky": "^9.1.7",
@@ -860,9 +860,9 @@
       }
     },
     "node_modules/@zen-browser/surfer": {
-      "version": "1.14.8",
-      "resolved": "https://registry.npmjs.org/@zen-browser/surfer/-/surfer-1.14.8.tgz",
-      "integrity": "sha512-5HHcfibwHIK5n3huhJL2TLBX2+8odj6ebCMA6U2EcUj9ROSrcz7/bjY2n5MIa9oIRL9gtV3ott0jwJj6SlapxA==",
+      "version": "1.14.9",
+      "resolved": "https://registry.npmjs.org/@zen-browser/surfer/-/surfer-1.14.9.tgz",
+      "integrity": "sha512-XbMzG4GHSRoGzKR/DkpyywcbTYemieDRD1A6qgJ8CaVDixenj/uzMhp6HXAUksRTeh1u9j3lzNcVrI99axcZLw==",
       "dev": true,
       "license": "MPL-2.0",
       "dependencies": {
diff --git a/package.json b/package.json
index c0ed6239c..9265a194b 100644
--- a/package.json
+++ b/package.json
@@ -49,7 +49,7 @@
   "devDependencies": {
     "@babel/preset-typescript": "^7.27.0",
     "@zen-browser/prettier": "^3.9.3",
-    "@zen-browser/surfer": "^1.14.8",
+    "@zen-browser/surfer": "^1.14.9",
     "formal-git": "^1.2.9",
     "globals": "^16.3.0",
     "husky": "^9.1.7",
diff --git a/src/browser/installer/windows/nsis/shared-nsh.patch b/src/browser/installer/windows/nsis/shared-nsh.patch
new file mode 100644
index 000000000..88b4b6165
--- /dev/null
+++ b/src/browser/installer/windows/nsis/shared-nsh.patch
@@ -0,0 +1,124 @@
+diff --git a/browser/installer/windows/nsis/shared.nsh b/browser/installer/windows/nsis/shared.nsh
+index b81c7ef59be0d25f67668215028008a451860df2..fa0ab8947e011289d25158cab17ff9388b5cab0d 100755
+--- a/browser/installer/windows/nsis/shared.nsh
++++ b/browser/installer/windows/nsis/shared.nsh
+@@ -873,50 +873,87 @@ FunctionEnd
+ !ifdef MOZ_MAINTENANCE_SERVICE
+ ; Adds maintenance service certificate keys for the install dir.
+ ; For the cert to work, it must also be signed by a trusted cert for the user.
++; Writes this application's allowed certificate values into _KEY, which must be
++; a maintenance service registry path such as the one returned by
++; ServicesHelper::PathToUniqueRegistryPath.
++!macro AddMaintCertKeyValues _KEY
++  ; PrefetchProcessName was originally used to experiment with deleting
++  ; Windows prefetch as a speed optimization.  It is no longer used though.
++  DeleteRegValue HKLM "${_KEY}" "prefetchProcessName"
++
++  ; Setting the Attempted value will ensure that a new Maintenance Service
++  ; install will never be attempted again after this from updates.  The value
++  ; is used only to see if updates should attempt new service installs.
++  WriteRegDWORD HKLM "Software\Mozilla\MaintenanceService" "Attempted" 1
++
++  ; More than one certificate can be specified in a different subfolder
++  ; for example: ${_KEY}\1, but each individual binary can be signed
++  ; with at most one certificate.  A fallback certificate can only be used
++  ; if the binary is replaced with a different certificate.
++  WriteRegStr HKLM "${_KEY}\0" "name" "${CERTIFICATE_NAME}"
++  WriteRegStr HKLM "${_KEY}\0" "issuer" "${CERTIFICATE_ISSUER}"
++  ; These values associate the allowed certificates for the previous
++  ;  installation, so that we can update from it cleanly using the
++  ;  old updater.exe (which will still have this signature).
++  WriteRegStr HKLM "${_KEY}\1" "name" "${CERTIFICATE_NAME_PREVIOUS}"
++  WriteRegStr HKLM "${_KEY}\1" "issuer" "${CERTIFICATE_ISSUER_PREVIOUS}"
++  ClearErrors
++!macroend
++
+ !macro AddMaintCertKeys
+   Push $R0
+   ; Allow main Mozilla cert information for updates
+   ; This call will push the needed key on the stack
+   ServicesHelper::PathToUniqueRegistryPath "$INSTDIR"
+   Pop $R0
++  Push $R1
++  Push $R2
++  Push $R3
++  ; We always use the 64bit registry for certs.
++  ${If} ${RunningX64}
++  ${OrIf} ${IsNativeARM64}
++    SetRegView 64
++  ${EndIf}
++
+   ${If} $R0 != ""
+-    ; More than one certificate can be specified in a different subfolder
+-    ; for example: $R0\1, but each individual binary can be signed
+-    ; with at most one certificate.  A fallback certificate can only be used
+-    ; if the binary is replaced with a different certificate.
+-    ; We always use the 64bit registry for certs.
+-    ${If} ${RunningX64}
+-    ${OrIf} ${IsNativeARM64}
+-      SetRegView 64
+-    ${EndIf}
++    !insertmacro AddMaintCertKeyValues "$R0"
++  ${Else}
++    ; ServicesHelper could not be loaded.  This happens when PostUpdate is run
++    ; by the updater, which launches it with an environment too minimal for
++    ; NSIS to load its plugins, leaving the unique registry path uncomputable.
++    ; Fall back to refreshing every key that already records one of our own
++    ; certificate names, so that any installation of this application is kept
++    ; current rather than only the first one found.  Keys belonging to other
++    ; applications record a different name and are left alone.
++    StrCpy $R1 0
++    ${Do}
++      EnumRegKey $R2 HKLM "Software\Mozilla\MaintenanceService" $R1
++      ${If} $R2 == ""
++        ${ExitDo}
++      ${EndIf}
++      ReadRegStr $R3 HKLM "Software\Mozilla\MaintenanceService\$R2\0" "name"
++      ${If} $R3 == "${CERTIFICATE_NAME}"
++      ${OrIf} $R3 == "${CERTIFICATE_NAME_PREVIOUS}"
++        StrCpy $R0 "Software\Mozilla\MaintenanceService\$R2"
++        !insertmacro AddMaintCertKeyValues "$R0"
++      ${EndIf}
++      IntOp $R1 $R1 + 1
++    ${Loop}
++    StrCpy $R0 ""
++  ${EndIf}
+ 
+-    ; PrefetchProcessName was originally used to experiment with deleting
+-    ; Windows prefetch as a speed optimization.  It is no longer used though.
+-    DeleteRegValue HKLM "$R0" "prefetchProcessName"
+-
+-    ; Setting the Attempted value will ensure that a new Maintenance Service
+-    ; install will never be attempted again after this from updates.  The value
+-    ; is used only to see if updates should attempt new service installs.
+-    WriteRegDWORD HKLM "Software\Mozilla\MaintenanceService" "Attempted" 1
+-
+-    ; These values associate the allowed certificates for the current
+-    ; installation.
+-    WriteRegStr HKLM "$R0\0" "name" "${CERTIFICATE_NAME}"
+-    WriteRegStr HKLM "$R0\0" "issuer" "${CERTIFICATE_ISSUER}"
+-    ; These values associate the allowed certificates for the previous
+-    ;  installation, so that we can update from it cleanly using the
+-    ;  old updater.exe (which will still have this signature).
+-    WriteRegStr HKLM "$R0\1" "name" "${CERTIFICATE_NAME_PREVIOUS}"
+-    WriteRegStr HKLM "$R0\1" "issuer" "${CERTIFICATE_ISSUER_PREVIOUS}"
+-    ${If} ${RunningX64}
+-    ${OrIf} ${IsNativeARM64}
+-      SetRegView lastused
+-    ${EndIf}
+-    ClearErrors
++  ${If} ${RunningX64}
++  ${OrIf} ${IsNativeARM64}
++    SetRegView lastused
+   ${EndIf}
++
++  Pop $R3
++  Pop $R2
++  Pop $R1
+   ; Restore the previously used value back
+   Pop $R0
+ !macroend
++
+ !define AddMaintCertKeys "!insertmacro AddMaintCertKeys"
+ !endif
+ 
diff --git a/src/browser/themes/shared/preferences/zen-preferences.css b/src/browser/themes/shared/preferences/zen-preferences.css
index fe659afca..986cfee9c 100644
--- a/src/browser/themes/shared/preferences/zen-preferences.css
+++ b/src/browser/themes/shared/preferences/zen-preferences.css
@@ -40,7 +40,7 @@ html|dialog {
 }
 
 groupbox button {
-  border-radius: 5px !important;
+  border-radius: calc(5px * var(--zen-squircle-value)) !important;
 }
 
 groupbox button,
diff --git a/src/zen/common/styles/zen-buttons.css b/src/zen/common/styles/zen-buttons.css
index e0f614cf6..0f6bbae5c 100644
--- a/src/zen/common/styles/zen-buttons.css
+++ b/src/zen/common/styles/zen-buttons.css
@@ -27,7 +27,7 @@ dialog::part(dialog-button) {
 
   position: relative;
   border: none;
-  border-radius: 10px;
+  border-radius: calc(10px * var(--zen-squircle-value));
 }
 
 @media (-moz-platform: macos) {
diff --git a/src/zen/common/styles/zen-omnibox.css b/src/zen/common/styles/zen-omnibox.css
index 7ad2a72b2..532632174 100644
--- a/src/zen/common/styles/zen-omnibox.css
+++ b/src/zen/common/styles/zen-omnibox.css
@@ -60,6 +60,9 @@
 .urlbar-background {
   background: var(--zen-toolbar-element-bg) !important;
   border-radius: var(--border-radius-medium);
+  :root:not([zen-single-toolbar="true"]) & {
+    border-radius: calc(var(--border-radius-medium) * var(--zen-squircle-value));
+  }
   outline: none !important;
 
   #urlbar:not([breakout-extend]) & {
@@ -137,12 +140,12 @@
   & #identity-box {
     margin-inline-end: 0 !important;
 
-    &[pageproxystate="invalid"] {
+    :root[zen-has-empty-tab="true"] &[pageproxystate="invalid"]:not(.chromeUI) {
       margin-inline-end: -4px !important;
     }
 
     &.chromeUI:not([pageproxystate="invalid"]) #identity-icon-box {
-      border-radius: 10px !important;
+      border-radius: calc(10px * var(--zen-squircle-value)) !important;
     }
   }
 
@@ -171,13 +174,9 @@
 }
 
 :root:not([zen-single-toolbar="true"]):not([zen-has-empty-tab="true"]) #urlbar:not([breakout-extend]) .urlbar-input-container {
-  padding: 2px 3px;
+  padding: 2px 5px;
   gap: 2px;
 
-  & .urlbar-page-action {
-    height: 100%;
-  }
-
   & #zen-copy-url-button {
     order: -1;
   }
@@ -296,7 +295,7 @@
 
   &,
   .urlbar-background {
-    border-radius: 12px !important;
+    border-radius: calc(12px * var(--zen-squircle-value)) !important;
   }
 
   &[breakout-extend][animate-searchmode="true"]::before {
@@ -411,7 +410,7 @@
 }
 
 #notification-popup-box {
-  border-radius: 10px !important;
+  border-radius: calc(10px * var(--zen-squircle-value)) !important;
 }
 
 /* Border radius on hover */
@@ -706,7 +705,7 @@
 
 :root:not([zen-single-toolbar="true"]) #urlbar[breakout-extend]:not([zen-floating-urlbar="true"]) {
   & .urlbar-background {
-    border-radius: 10px !important;
+    border-radius: calc(10px * var(--zen-squircle-value)) !important;
   }
 
   #urlbar-results {
diff --git a/src/zen/common/styles/zen-panels/dialog.css b/src/zen/common/styles/zen-panels/dialog.css
index e25f3e8d7..ce73d8738 100644
--- a/src/zen/common/styles/zen-panels/dialog.css
+++ b/src/zen/common/styles/zen-panels/dialog.css
@@ -4,7 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 .dialogBox {
-  border-radius: 12px !important;
+  border-radius: calc(12px * var(--zen-squircle-value)) !important;
   border: 0.5px solid light-dark(rgba(0, 0, 0, 0.4), var(--zen-dialog-background)) !important;
   outline: 1px solid light-dark(transparent, rgba(168, 168, 169, 0.50)) !important;
   box-shadow: 0 10px 8px rgba(0, 0 , 0, 0.15) !important;
diff --git a/src/zen/common/styles/zen-single-components.css b/src/zen/common/styles/zen-single-components.css
index a93faa7f7..f6f846c73 100644
--- a/src/zen/common/styles/zen-single-components.css
+++ b/src/zen/common/styles/zen-single-components.css
@@ -291,7 +291,7 @@
   --panel-width: 234px;
   --menu-panel-width-wide: calc(var(--panel-width) - var(--panel-padding) * 2);
   --uei-icon-size: 16px;
-  --arrowpanel-menuitem-border-radius: 10px;
+  --arrowpanel-menuitem-border-radius: calc(10px * var(--zen-squircle-value));
 }
 
 #unified-extensions-empty-state,
@@ -500,6 +500,7 @@
     transition:
       transform 0.12s ease-in-out,
       opacity 0.12s ease-in-out;
+    will-change: transform;
   }
 
   /* stylelint-disable-next-line stylelint-plugin-mozilla/no-has-selector */
@@ -603,6 +604,7 @@
       position: absolute;
       width: 100%;
       height: 100%;
+      will-change: transform;
 
       @media (-moz-platform: macos) {
         background: linear-gradient(to bottom, light-dark(rgb(255, 255, 255), rgb(34, 34, 34)), light-dark(rgb(246, 246, 246), rgb(21, 21, 21)));
diff --git a/src/zen/compact-mode/sidebar.inc.css b/src/zen/compact-mode/sidebar.inc.css
index dce38ff44..e25557d22 100644
--- a/src/zen/compact-mode/sidebar.inc.css
+++ b/src/zen/compact-mode/sidebar.inc.css
@@ -58,7 +58,7 @@
     :root[zen-no-padding='true'] & {
       --zen-compact-float: 10px;
       --zen-compact-top-toolbar-hidden-fix: var(--zen-compact-float);
-      --zen-compact-mode-no-padding-radius-fix: 2px;
+      --zen-compact-mode-no-padding-radius-fix: 6px;
     }
 
     /* Initial padding for when we are animating */
diff --git a/src/zen/spaces/ZenGradientGenerator.mjs b/src/zen/spaces/ZenGradientGenerator.mjs
index a4ffd4f8a..a68dc3bc1 100644
--- a/src/zen/spaces/ZenGradientGenerator.mjs
+++ b/src/zen/spaces/ZenGradientGenerator.mjs
@@ -721,7 +721,7 @@ export class nsZenThemePicker extends nsZenMultiWindowFeature {
     };
 
     const dot = document.createElement("div");
-    dot.classList.add("zen-theme-picker-dot");
+    dot.classList.add("zen-theme-picker-dot", "no-squircles");
 
     dot.style.left = `${dotData.x}px`;
     dot.style.top = `${dotData.y}px`;
diff --git a/src/zen/spaces/create-workspace-form.css b/src/zen/spaces/create-workspace-form.css
index 64a9caf40..076c1ac73 100644
--- a/src/zen/spaces/create-workspace-form.css
+++ b/src/zen/spaces/create-workspace-form.css
@@ -52,7 +52,7 @@ zen-workspace-creation {
 
       & .zen-workspace-creation-name-wrapper {
         padding: 9px 6px;
-        border-radius: 8px !important;
+        border-radius: calc(8px * var(--zen-squircle-value)) !important;
         margin: 0;
         background-color: var(--input-text-background-color);
         gap: 8px;
@@ -119,7 +119,7 @@ zen-workspace-creation {
 
       & .zen-workspace-creation-profile-wrapper {
         padding: 4px;
-        border-radius: 8px !important;
+        border-radius: calc(8px * var(--zen-squircle-value)) !important;
         margin: 0;
         background-color: var(--input-text-background-color);
         gap: 4px;
@@ -148,7 +148,7 @@ zen-workspace-creation {
       }
 
       & .zen-workspace-creation-edit-theme-button {
-        border-radius: 8px !important;
+        border-radius: calc(8px * var(--zen-squircle-value)) !important;
         margin: 0;
         background-color: var(--input-text-background-color);
         justify-content: center;
diff --git a/surfer.json b/surfer.json
index c0e204c51..340cc61c7 100644
--- a/surfer.json
+++ b/surfer.json
@@ -20,7 +20,7 @@
       "brandShortName": "Zen",
       "brandFullName": "Zen Browser",
       "release": {
-        "displayVersion": "1.21.16b",
+        "displayVersion": "1.22b",
         "github": {
           "repo": "zen-browser/desktop"
         },
@@ -40,7 +40,7 @@
       "brandShortName": "Twilight",
       "brandFullName": "Zen Twilight",
       "release": {
-        "displayVersion": "1.22t",
+        "displayVersion": "1.23t",
         "github": {
           "repo": "zen-browser/desktop"
         }