diff --git a/.gitignore b/.gitignore
index 2e34b6c1c1..1f18d9a1b7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,3 +10,4 @@
 .DS_Store
 npm-debug.log
 electron/dist
+electron/pub
diff --git a/README.md b/README.md
index 5df8b4332b..6d2731d02e 100644
--- a/README.md
+++ b/README.md
@@ -107,6 +107,9 @@ You can configure the app by copying `config.sample.json` to
    valid location on this network. This is used as a hint to the user to indicate
    when a valid location has been entered so it's not necessary for this to be
    exactly correct. Optional.
+1. `update_base_url` (electron app only): HTTPS URL to a web server to download
+   updates from. This should be the path to the directory containing `install`
+   and `update`.
 1. `cross_origin_renderer_url`: URL to a static HTML page hosting code to help display
    encrypted file attachments. This MUST be hosted on a completely separate domain to
    anything else since it is used to isolate the privileges of file attachments to this
diff --git a/electron/riot.im/README b/electron/riot.im/README
new file mode 100644
index 0000000000..09c218740c
--- /dev/null
+++ b/electron/riot.im/README
@@ -0,0 +1,4 @@
+This directory contains the config file for the official riot.im distribution
+of Riot Desktop. You probably do not want to build with this config unless
+you're building the official riot.im distribution, or you'll find your builds
+will replace themselves with the riot.im build.
diff --git a/electron/config.json b/electron/riot.im/config.json
similarity index 97%
rename from electron/config.json
rename to electron/riot.im/config.json
index 7bf4c4d81d..8ed2a3e8bb 100644
--- a/electron/config.json
+++ b/electron/riot.im/config.json
@@ -1,5 +1,5 @@
 {
-    "update_url": "https://riot.im/download/desktop/",
+    "update_base_url": "https://riot.im/download/desktop/",
     "default_hs_url": "https://matrix.org",
     "default_is_url": "https://vector.im",
     "brand": "Riot",
diff --git a/electron/src/electron-main.js b/electron/src/electron-main.js
index 18758eee90..2ca0b9d3bd 100644
--- a/electron/src/electron-main.js
+++ b/electron/src/electron-main.js
@@ -30,7 +30,7 @@ const VectorMenu = require('./vectormenu');
 
 let vectorConfig = {};
 try {
-    vectorConfig = require('../../vector/config.json');
+    vectorConfig = require('../../webapp/config.json');
 } catch (e) {
     // it would be nice to check the error code here and bail if the config
     // is unparseable, but we get MODULE_NOT_FOUND in the case of a missing
@@ -101,9 +101,9 @@ function pollForUpdates() {
     }
 }
 
-function startAutoUpdate(update_url) {
-    if (update_url.slice(-1) !== '/') {
-        update_url = update_url + '/';
+function startAutoUpdate(update_base_url) {
+    if (update_base_url.slice(-1) !== '/') {
+        update_base_url = update_base_url + '/';
     }
     try {
         // For reasons best known to Squirrel, the way it checks for updates
@@ -112,9 +112,9 @@ function startAutoUpdate(update_url) {
         // 204 No Content. On windows it takes a base path and looks for
         // files under that path.
         if (process.platform == 'darwin') {
-            electron.autoUpdater.setFeedURL(update_url);
+            electron.autoUpdater.setFeedURL(update_base_url + 'macos/');
         } else if (process.platform == 'win32') {
-            electron.autoUpdater.setFeedURL(update_url + 'win32/');
+            electron.autoUpdater.setFeedURL(update_base_url + 'win32/' + process.arch + '/');
         } else {
             // Squirrel / electron only supports auto-update on these two platforms.
             // I'm not even going to try to guess which feed style they'd use if they
@@ -149,11 +149,11 @@ process.on('uncaughtException', function (error) {
 electron.ipcMain.on('install_update', installUpdate);
 
 electron.app.on('ready', () => {
-    if (vectorConfig.update_url) {
-        console.log("Starting auto update with URL: " + vectorConfig.update_url);
-        startAutoUpdate(vectorConfig.update_url);
+    if (vectorConfig.update_base_url) {
+        console.log("Starting auto update with base URL: " + vectorConfig.update_base_url);
+        startAutoUpdate(vectorConfig.update_base_url);
     } else {
-        console.log("No update_url is defined: auto update is disabled");
+        console.log("No update_base_url is defined: auto update is disabled");
     }
 
     mainWindow = new electron.BrowserWindow({
diff --git a/package.json b/package.json
index 4f4a75cb0c..4fed9c8a09 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     "build:compile": "babel --source-maps -d lib src",
     "build:bundle": "NODE_ENV=production webpack -p --progress",
     "build:bundle:dev": "webpack --optimize-occurence-order --progress",
-    "build:electron": "npm run clean && npm run build && cpx electron/config.json webapp/ && build -lwm",
+    "build:electron": "npm run clean && npm run build && build -wml --ia32 --x64",
     "build": "node scripts/babelcheck.js && npm run build:res && npm run build:config && npm run build:emojione && npm run build:css && npm run build:bundle",
     "build:dev": "node scripts/babelcheck.js && npm run build:res && npm run build:config && npm run build:emojione && npm run build:css && npm run build:bundle:dev",
     "dist": "scripts/package.sh",
@@ -47,7 +47,7 @@
     "start:skins:css": "mkdirp build && catw \"src/skins/vector/css/**/*.css\" -o build/components.css",
     "start": "node scripts/babelcheck.js && parallelshell \"npm run start:emojione\" \"npm run start:res\" \"npm run start:config\" \"npm run start:js\" \"npm run start:skins:css\"",
     "start:prod": "parallelshell \"npm run start:emojione\" \"npm run start:js:prod\" \"npm run start:skins:css\"",
-    "clean": "rimraf build lib webapp",
+    "clean": "rimraf build lib webapp electron/dist",
     "prepublish": "npm run build:compile",
     "test": "karma start --single-run=true --autoWatch=false --browsers PhantomJS --colors=false",
     "test:multi": "karma start"
@@ -97,7 +97,7 @@
     "catw": "^1.0.1",
     "cpx": "^1.3.2",
     "css-raw-loader": "^0.1.1",
-    "electron-builder": "^7.23.2",
+    "electron-builder": "^10.4.1",
     "emojione": "^2.2.3",
     "expect": "^1.16.0",
     "fs-extra": "^0.30.0",
@@ -134,14 +134,17 @@
     "dereference": true,
     "//files": "We bundle everything, so we only need to include webapp/",
     "files": [
-      "!**/*",
       "electron/src/**",
       "electron/img/**",
       "webapp/**",
       "package.json"
     ],
-    "squirrelWindows": {
-      "iconUrl": "https://riot.im/favicon.ico"
+    "linux": {
+      "target": "deb",
+      "maintainer": "support@riot.im"
+    },
+    "win": {
+        "target": "squirrel"
     }
   },
   "directories": {
diff --git a/scripts/electron-package.sh b/scripts/electron-package.sh
new file mode 100755
index 0000000000..5830c62dbe
--- /dev/null
+++ b/scripts/electron-package.sh
@@ -0,0 +1,131 @@
+#!/bin/bash
+
+set -e
+
+usage() {
+    echo "Usage: $0 -v <version> -c <config file> [-n]"
+    echo
+    echo "version: commit-ish to check out and build"
+    echo "config file: a path to a json config file to"
+    echo "ship with the build. In addition, update_base_url:"
+    echo "from this file is used to set up auto-update."
+    echo "-n: build with no config file."
+    echo
+    echo "Values may also be passed as environment variables"
+}
+
+conffile=
+version=
+skipcfg=0
+while getopts "c:v:n" opt; do
+    case $opt in
+        c)
+            conffile=$OPTARG
+            ;;
+        v)
+            version=$OPTARG
+            ;;
+        n)
+            skipcfg=1
+            ;;
+        \?)
+            echo "Invalid option: -$OPTARG" >&2
+            usage
+            exit
+            ;;
+    esac
+done
+
+if [ -z "$version" ]; then
+    echo "No version supplied"
+    usage
+    exit
+fi
+
+if [ -z "$conffile" ] && [ "$skipcfg" = 0 ]; then
+    echo "No config file given. Use -c to supply a config file or"
+    echo "-n to build with no config file (and no auto update)."
+    exit
+fi
+
+if [ -n "$conffile" ]; then
+    update_base_url=`jq -r .update_base_url $conffile`
+
+    if [ -z "$update_base_url" ]; then
+        echo "No update URL supplied. Use update_base_url: null if you really"
+        echo "want a build with no auto-update."
+        usage
+        exit
+    fi
+    # Make sure the base URL ends in a slash if it doesn't already
+    update_base_url=`echo $update_base_url | sed -e 's#\([^\/]\)$#\1\/#'`
+fi
+
+if [ ! -f package.json ]; then
+    echo "No package.json found. This script must be run from"
+    echo "the vector-web directory."
+    exit
+fi
+
+echo "Building $version using Update base URL $update_base_url"
+
+projdir=`pwd`
+builddir=`mktemp -d 2>/dev/null || mktemp -d -t 'buildtmp'`
+pushd "$builddir"
+git clone "$projdir" .
+git checkout "$version"
+
+if [ -n "$conffile" ]; then
+    popd
+    cp "$conffile" "$builddir/"
+    pushd "$builddir"
+fi
+
+npm install
+npm run build:electron
+
+popd
+
+distdir="$builddir/electron/dist"
+pubdir="$projdir/electron/pub"
+rm -r "$pubdir" || true
+mkdir -p "$pubdir"
+
+# figure out what version this build is known as
+# (since we could be building from a branch or indeed
+# any commit-ish, not just a version tag)
+vername=`python -c 'import yaml; import sys; print yaml.load(sys.stdin)["version"]' < $builddir/electron/dist/latest.yml`
+
+# Install packages: what the user downloads the first time,
+# (DMGs for mac, exe installer for windows)
+mkdir -p "$pubdir/install/macos"
+cp $distdir/mac/*.dmg "$pubdir/install/macos/"
+
+mkdir -p "$pubdir/install/win32/ia32/"
+cp $distdir/win-ia32/*.exe "$pubdir/install/win32/ia32/"
+
+mkdir -p "$pubdir/install/win32/x64/"
+cp $distdir/win/*.exe "$pubdir/install/win32/x64/"
+
+# Packages for auto-update
+mkdir -p "$pubdir/update/macos"
+cp $distdir/mac/*.zip "$pubdir/update/macos/"
+echo "$ver" > "$pubdir/update/macos/latest"
+
+mkdir -p "$pubdir/update/win32/ia32/"
+cp $distdir/win-ia32/*.nupkg "$pubdir/update/win32/ia32/"
+cp $distdir/win-ia32/RELEASES "$pubdir/install/win32/ia32/"
+
+mkdir -p "$pubdir/update/win32/x64/"
+cp $distdir/win/*.nupkg "$pubdir/update/win32/x64/"
+cp $distdir/win/RELEASES "$pubdir/update/win32x64ia32/"
+
+# Move the debs to the main project dir's dist folder
+rm -r "$projdir/electron/dist" || true
+mkdir -p "$projdir/electron/dist"
+cp $distdir/*.deb "$projdir/electron/dist/"
+
+rm -rf "$builddir"
+
+echo "Riot Desktop $vername is ready to go in $pubdir: this directory can be hosted on your web server."
+echo "deb archives are in electron/dist/ - these should be added into your debian repository"