diff --git a/automatic/nexus-repository/Readme.md b/automatic/nexus-repository/Readme.md
index b3c7d4732dd0..2c1d8dee092c 100644
--- a/automatic/nexus-repository/Readme.md
+++ b/automatic/nexus-repository/Readme.md
@@ -22,10 +22,10 @@ Nexus product does not have a built-in web gallery for components.
 
 This package supports the following parameters:
 
-* `/Fqdn` - The fqdn that matches the subject you are using for your Nexus instance SSL certificate.
-* `/Port` - Specify what port Nexus should listen on. Defaults to `8081`.
-* `/BackupSslConfig` - Ensures that the ssl configuration survives an upgrade.
-* `/BackupLocation` - Species the path to backup ssl configuration to during upgrade. Defaults to `~/NexusSSLBackup`.
+* `/Fqdn` - The fully-qualified domain name that matches the subject you are using for your Nexus instance SSL certificate.
+* `/Port` - Specify what port Nexus should listen on. Defaults to `8081`, or whatever was previously configured.
+* `/BackupSslConfig` - Ensures that the SSL configuration survives an upgrade, if it's otherwise undetected.
+* `/BackupLocation` - Specifies the path to backup the SSL configuration to during upgrade. Defaults to `~/NexusSSLBackup`.
 
 You can pass parameters as follows:
 
@@ -38,6 +38,8 @@ You can pass parameters as follows:
     This means that you will need to migrate your database from OrientDb, if you are using it.
     See [here](https://help.sonatype.com/en/orient-3-70-java-8-or-11.html) for further details,
     or check out the nexus-repository-migrator package.
+    Versions after this will also overwrite rather than merge the program directory, i.e. `$env:ProgramFiles/nexus`,
+    and back-up HTTPS configuration and the keystore from there if it is configured.
 
 - **ATTENTION BREAKING CHANGE FOR UPGRADES FROM VERSIONS BEFORE 3.3.2.02**  
     Nexus no longer provided a setup.exe for installing Nexus Repository 3.x on Windows.
diff --git a/automatic/nexus-repository/nexus-repository.nuspec b/automatic/nexus-repository/nexus-repository.nuspec
index d59819f9e20c..c9ac12ab5265 100644
--- a/automatic/nexus-repository/nexus-repository.nuspec
+++ b/automatic/nexus-repository/nexus-repository.nuspec
@@ -29,10 +29,10 @@ Nexus product does not have a built-in web gallery for components.
 
 This package supports the following parameters:
 
-* `/Fqdn` - The fqdn that matches the subject you are using for your Nexus instance SSL certificate.
-* `/Port` - Specify what port Nexus should listen on. Defaults to `8081`.
-* `/BackupSslConfig` - Ensures that the ssl configuration survives an upgrade.
-* `/BackupLocation` - Species the path to backup ssl configuration to during upgrade. Defaults to `~/NexusSSLBackup`.
+* `/Fqdn` - The fully-qualified domain name that matches the subject you are using for your Nexus instance SSL certificate.
+* `/Port` - Specify what port Nexus should listen on. Defaults to `8081`, or whatever was previously configured.
+* `/BackupSslConfig` - Ensures that the SSL configuration survives an upgrade, if it's otherwise undetected.
+* `/BackupLocation` - Specifies the path to backup the SSL configuration to during upgrade. Defaults to `~/NexusSSLBackup`.
 
 You can pass parameters as follows:
 
@@ -45,6 +45,8 @@ You can pass parameters as follows:
     This means that you will need to migrate your database from OrientDb, if you are using it.
     See [here](https://help.sonatype.com/en/orient-3-70-java-8-or-11.html) for further details,
     or check out the nexus-repository-migrator package.
+    Versions after this will also overwrite rather than merge the program directory, i.e. `$env:ProgramFiles/nexus`,
+    and back-up HTTPS configuration and the keystore from there if it is configured.
 
 - **ATTENTION BREAKING CHANGE FOR UPGRADES FROM VERSIONS BEFORE 3.3.2.02**  
     Nexus no longer provided a setup.exe for installing Nexus Repository 3.x on Windows.
diff --git a/automatic/nexus-repository/tools/chocolateyinstall.ps1 b/automatic/nexus-repository/tools/chocolateyinstall.ps1
index 4f5ca7edc7b0..0b914bf4639e 100644
--- a/automatic/nexus-repository/tools/chocolateyinstall.ps1
+++ b/automatic/nexus-repository/tools/chocolateyinstall.ps1
@@ -29,6 +29,7 @@ $NexusPort = if ($pp.ContainsKey("Port")) {
   Write-Host "/Port was used, Nexus will listen on port $($PP['Port'])."
 } elseif ($CurrentConfig.'application-port-ssl' -gt 0) {
   $CurrentConfig.'application-port-ssl'
+  $SslConfigured = $true
   Write-Host "Nexus is configured to use application-port-ssl, Nexus will listen on port $($CurrentConfig.'application-port-ssl')"
 } elseif ($CurrentConfig.'application-port' -gt 0) {
   $CurrentConfig.'application-port'
@@ -55,7 +56,7 @@ if ((Get-Service $ServiceName -ErrorAction SilentlyContinue)) {
   Get-Service $ServiceName | Stop-Service -Force
 }
 
-if ($pp.ContainsKey("BackupSslConfig") -or $CurrentConfig.'application-port-ssl' -gt 0) {
+if ($pp.ContainsKey("BackupSslConfig") -or $SslConfigured) {
   if ($pp.ContainsKey("BackupLocation")) {
     Backup-NexusSSL -BackupLocation $pp["BackupLocation"]
   } else {
@@ -80,10 +81,9 @@ Install-ChocolateyZipPackage @PackageArgs
 
 Write-Host "Copying files to '$TargetFolder' with overwrite"
 if (Test-Path "$TargetFolder") {
-  Copy-Item "$ExtractFolder\$nexusversionedfolder\*" "$TargetFolder" -Force -Recurse
-} else {
-  Copy-Item "$ExtractFolder\$nexusversionedfolder" "$TargetFolder" -Force -Recurse
+  Remove-Item "$TargetFolder" -Force -Recurse
 }
+Copy-Item "$ExtractFolder\$nexusversionedfolder" "$TargetFolder" -Force -Recurse
 
 # Create the Nexus data directory, if it doesn't exist
 if (!(Test-Path "$TargetDataFolder")) {
@@ -103,7 +103,7 @@ $processArgs = @{
 
 $null = Start-ChocolateyProcessAsAdmin @processArgs
 
-if ($pp.ContainsKey("BackupSslConfig") -or $CurrentConfig.'application-port-ssl' -gt 0) {
+if ($pp.ContainsKey("BackupSslConfig") -or $SslConfigured) {
   if ($pp.ContainsKey("BackupLocation")) {
     Restore-NexusSSL -BackupLocation $pp['BackupLocation']
   } else {
@@ -112,7 +112,7 @@ if ($pp.ContainsKey("BackupSslConfig") -or $CurrentConfig.'application-port-ssl'
 }
 
 # Update Port in Configuration before starting the service
-if ($NexusPort -ne '8081') {
+if ($NexusPort -ne '8081' -and -not $SslConfigured) {
   if (Test-Path "$NexusConfigFile") {
     Write-Host "Configuring Nexus to listen on port $NexusPort."
         (Get-Content "$NexusConfigFile") -replace "^#\s*application-port=.*$", "application-port=$NexusPort" |