diff --git a/security/build/Makefile.in b/security/build/Makefile.in
index 71e14c0217c..92c40ac9930 100644
--- a/security/build/Makefile.in
+++ b/security/build/Makefile.in
@@ -11,42 +11,31 @@ VPATH		= @srcdir@
 include $(DEPTH)/config/autoconf.mk
 CC_WRAPPER =
 CXX_WRAPPER =
+
+default::
+
 include $(topsrcdir)/config/config.mk
 
-ifndef MOZ_NATIVE_NSS
-LOADABLE_ROOT_MODULE = $(DLL_PREFIX)nssckbi$(DLL_SUFFIX)
-endif
+NSS_DLLS = \
+  nss3 \
+  nssutil3 \
+  smime3 \
+  ssl3 \
+  $(NULL)
 
-NSS3_LIB = $(DLL_PREFIX)nss3$(DLL_SUFFIX)
-NSSUTIL3_LIB = $(DLL_PREFIX)nssutil3$(DLL_SUFFIX)
-SMIME3_LIB = $(DLL_PREFIX)smime3$(DLL_SUFFIX)
-SSL3_LIB =  $(DLL_PREFIX)ssl3$(DLL_SUFFIX)
-SOFTOKEN3_LIB = $(DLL_PREFIX)softokn3$(DLL_SUFFIX)
+NSS_EXTRA_DLLS = \
+  nssckbi \
+  softokn3 \
+  $(NULL)
 
 ifndef NSS_DISABLE_DBM
-NSSDBM3_LIB = $(DLL_PREFIX)nssdbm3$(DLL_SUFFIX)
-else
-NSSDBM3_LIB = 
+NSS_EXTRA_DLLS += nssdbm3
 endif
 
-ifndef MOZ_NATIVE_NSS
+SDK_LIBS = crmf
+
 ifneq (,$(filter OS2 WINNT,$(OS_ARCH)))
-SDK_LIBS = \
-  $(DIST)/lib/$(LIB_PREFIX)crmf.$(LIB_SUFFIX) \
-  $(DIST)/lib/$(LIB_PREFIX)smime3.$(LIB_SUFFIX) \
-  $(DIST)/lib/$(LIB_PREFIX)ssl3.$(LIB_SUFFIX) \
-  $(DIST)/lib/$(LIB_PREFIX)nss3.$(LIB_SUFFIX) \
-  $(DIST)/lib/$(LIB_PREFIX)nssutil3.$(LIB_SUFFIX) \
-  $(NULL)
-else
-SDK_LIBS = \
-  $(DIST)/lib/$(LIB_PREFIX)crmf.$(LIB_SUFFIX) \
-  $(DIST)/lib/$(LIB_PREFIX)smime.$(LIB_SUFFIX) \
-  $(DIST)/lib/$(LIB_PREFIX)ssl.$(LIB_SUFFIX) \
-  $(DIST)/lib/$(LIB_PREFIX)nss.$(LIB_SUFFIX) \
-  $(DIST)/lib/$(LIB_PREFIX)nssutil.$(LIB_SUFFIX) \
-  $(NULL)
-endif
+SDK_LIBS += $(NSS_DLLS)
 endif
 
 # Default
@@ -77,18 +66,18 @@ endif
 endif
 
 ifdef HAVE_FREEBL_LIBS
-FREEBL_LIB = $(DLL_PREFIX)freebl3$(DLL_SUFFIX)
+NSS_EXTRA_DLLS += freebl3
 endif
 ifdef HAVE_FREEBL_LIBS_32
-FREEBL_32INT_LIB = libfreebl_32int_3$(DLL_SUFFIX)
-FREEBL_32FPU_LIB = libfreebl_32fpu_3$(DLL_SUFFIX)
+NSS_EXTRA_DLLS += freebl_32int_3
+NSS_EXTRA_DLLS += freebl_32fpu_3
 endif
 ifdef HAVE_FREEBL_LIBS_32INT64
-FREEBL_32INT64_LIB = libfreebl_32int64_3$(DLL_SUFFIX)
+NSS_EXTRA_DLLS += freebl_32int64_3
 endif
 ifdef HAVE_FREEBL_LIBS_64
-FREEBL_64INT_LIB = libfreebl_64int_3$(DLL_SUFFIX)
-FREEBL_64FPU_LIB = libfreebl_64fpu_3$(DLL_SUFFIX)
+NSS_EXTRA_DLLS += freebl_64int_3
+NSS_EXTRA_DLLS += freebl_64fpu_3
 endif
 
 ABS_DIST := $(call core_abspath,$(DIST))
@@ -123,8 +112,7 @@ endif
 # To get debug symbols from NSS
 export MOZ_DEBUG_SYMBOLS
 
-# NSS makefiles are not safe for parallel execution.
-DEFAULT_GMAKE_FLAGS = -j1
+DEFAULT_GMAKE_FLAGS =
 DEFAULT_GMAKE_FLAGS += CC="$(CC)"
 DEFAULT_GMAKE_FLAGS += SOURCE_MD_DIR=$(ABS_DIST)
 DEFAULT_GMAKE_FLAGS += SOURCE_MDHEADERS_DIR=$(NSPR_INCLUDE_DIR)
@@ -135,6 +123,9 @@ DEFAULT_GMAKE_FLAGS += MOZILLA_CLIENT=1
 DEFAULT_GMAKE_FLAGS += NO_MDUPDATE=1
 DEFAULT_GMAKE_FLAGS += NSS_ENABLE_ECC=1
 DEFAULT_GMAKE_FLAGS += NSINSTALL="$(NSINSTALL)"
+ifeq ($(OS_ARCH),WINNT)
+DEFAULT_GMAKE_FLAGS += INSTALL="$(NSINSTALL) -t"
+endif
 ifndef MOZ_NATIVE_SQLITE
 DEFAULT_GMAKE_FLAGS += SQLITE_LIB_NAME=mozsqlite3
 DEFAULT_GMAKE_FLAGS += SQLITE_INCLUDE_DIR=$(ABS_DIST)/include
@@ -251,6 +242,18 @@ DEFAULT_GMAKE_FLAGS += XCFLAGS="$(CFLAGS)"
 DEFAULT_GMAKE_FLAGS += DARWIN_DYLIB_VERSIONS="-compatibility_version 1 -current_version 1 $(LDFLAGS)"
 endif
 
+# Put NSS headers directly under $(DIST)/include
+DEFAULT_GMAKE_FLAGS += PUBLIC_EXPORT_DIR='$(ABS_DIST)/include/$$(MODULE)'
+DEFAULT_GMAKE_FLAGS += SOURCE_XPHEADERS_DIR='$$(SOURCE_XP_DIR)/include/$$(MODULE)'
+DEFAULT_GMAKE_FLAGS += MODULE_INCLUDES='$$(addprefix -I$$(SOURCE_XP_DIR)/include/,$$(REQUIRES))'
+
+# Work around NSS's MAKE_OBJDIR being racy. See bug #836220
+DEFAULT_GMAKE_FLAGS += MAKE_OBJDIR='$$(INSTALL) -D $$(OBJDIR)'
+
+# Work around NSS adding IMPORT_LIBRARY to TARGETS with no rule for
+# it, creating race conditions. See bug #836220
+DEFAULT_GMAKE_FLAGS += TARGETS='$$(LIBRARY) $$(SHARED_LIBRARY) $$(PROGRAM)'
+
 ifdef MOZ_B2G_CERTDATA
 include $(srcdir)/b2g-certdata.mk
 endif
@@ -298,53 +301,59 @@ ifneq (,$(filter %--build-id,$(LDFLAGS)))
 DEFAULT_GMAKE_ENV = LDFLAGS=-Wl,--build-id
 endif
 
-ifndef MOZ_NATIVE_NSS
-define build_rules
-libs::
-	$$(DEFAULT_GMAKE_ENV) $$(MAKE) -C $$(NSS_SRCDIR)/security/$(1) $$(DEFAULT_GMAKE_FLAGS)
+NSS_DIST_DLL_FILES := $(addprefix $(DIST)/lib/$(DLL_PREFIX),$(addsuffix $(DLL_SUFFIX),$(NSS_DLLS) $(NSS_EXTRA_DLLS)))
+NSS_DIST_DLL_DEST := $(DIST)/bin
+INSTALL_TARGETS += NSS_DIST_DLL
 
-clean clobber clobber_all realclean distclean depend::
-	$$(MAKE) -C $$(NSS_SRCDIR)/security/$(1) $$(DEFAULT_GMAKE_FLAGS) clean
-endef
-$(foreach dir,$(NSS_DIRS),$(eval $(call build_rules,$(dir))))
-
-NSS_LIBS = \
-  $(LOADABLE_ROOT_MODULE) \
-  $(SOFTOKEN3_LIB) \
-  $(NSSDBM3_LIB) \
-  $(NSS3_LIB) \
-  $(NSSUTIL3_LIB) \
-  $(SSL3_LIB) \
-  $(SMIME3_LIB) \
-  $(FREEBL_LIB) \
-  $(FREEBL_32INT_LIB) \
-  $(FREEBL_32FPU_LIB) \
-  $(FREEBL_32INT64_LIB) \
-  $(FREEBL_64INT_LIB) \
-  $(FREEBL_64FPU_LIB) \
-  $(NULL)
-
-define install_rules
-libs::
-ifeq ($(OS_ARCH)_$(1), SunOS_$(SOFTOKEN3_LIB))
+ifeq ($(OS_ARCH)_$(1), SunOS_softokn3)
 # has to use copy mode on Solaris, see #665509
-	$$(NSINSTALL) -t -m 755 $$(DIST)/lib/$(1) $$(DIST)/bin
-else
-	$$(INSTALL) -m 755 $$(DIST)/lib/$(1) $$(DIST)/bin
+$(DIST)/bin/$(DLL_PREFIX)softokn3$(DLL_SUFFIX): INSTALL := $(INSTALL) -t
 endif
 
-install::
-	$$(SYSINSTALL) -m 755 $$(DIST)/lib/$(1) $$(DESTDIR)$$(mozappdir)
-endef
-$(foreach lib,$(NSS_LIBS),$(eval $(call install_rules,$(lib))))
+NSS_SDK_LIB_FILES := \
+  $(addprefix $(DIST)/lib/$(LIB_PREFIX),$(addsuffix .$(LIB_SUFFIX),$(SDK_LIBS))) \
+  $(addprefix $(DIST)/bin/$(DLL_PREFIX),$(addsuffix $(DLL_SUFFIX),$(NSS_DLLS))) \
+  $(NULL)
+NSS_SDK_LIB_DEST := $(DIST)/sdk/lib
+INSTALL_TARGETS += NSS_SDK_LIB
 
-libs::
-	$(INSTALL) -m 755 $(SDK_LIBS) $(DIST)/sdk/lib
-# NSS installs headers to dist/public and we want them in dist/include
-	$(NSINSTALL) -D $(DIST)/include/nss
-	(cd $(DIST)/public/nss && tar $(TAR_CREATE_FLAGS) - .) | \
-	  (cd $(DIST)/include/nss && tar -xf -)
-
-endif # MOZ_NATIVE_NSS
+$(NSS_DIST_DLL_FILES) $(NSS_SDK_LIB_FILES): libs-nss/lib
 
 include $(topsrcdir)/config/rules.mk
+
+DEFAULT_GMAKE_FLAGS += $(EXTRA_GMAKE_FLAGS)
+
+$(addprefix libs-,$(NSS_DIRS)): libs-%:
+# Work around NSS's export rule being racy when recursing for private_export
+# See bug #836220.
+$(addprefix export-,$(NSS_DIRS)): EXTRA_GMAKE_FLAGS = PRIVATE_EXPORTS=
+$(addprefix export-,$(NSS_DIRS)): export-%: private_export-%
+$(addprefix private_export-,$(NSS_DIRS)): EXTRA_GMAKE_FLAGS =
+$(addprefix private_export-,$(NSS_DIRS)): private_export-%:
+
+# Work around bug #836228 in pymake
+ifdef .PYMAKE
+$(foreach p,libs export private_export,$(addprefix $(p)-,$(NSS_DIRS))): *=$(subst $(NULL) $(NULL),-,$(wordlist 2,$(words $(subst -, ,$@)),$(subst -, ,$@)))
+endif
+
+$(foreach p,libs export private_export,$(addprefix $(p)-,$(NSS_DIRS))):
+	$(DEFAULT_GMAKE_ENV) $(MAKE) -C $(NSS_SRCDIR)/security/$* $(@:-$*=) $(DEFAULT_GMAKE_FLAGS)
+
+export:: $(addprefix export-,$(NSS_DIRS))
+
+$(addprefix clean-,$(NSS_DIRS)): clean-%:
+	$(MAKE) -C $(NSS_SRCDIR)/security/$* $(DEFAULT_GMAKE_FLAGS) clean
+
+clean clobber clobber_all realclean distclean depend:: $(addprefix clean-,$(NSS_DIRS))
+
+NSS_CMD_TARGETS := $(addprefix libs-,$(filter-out nss/cmd/lib,$(filter nss/cmd/%,$(NSS_DIRS))))
+libs:: $(NSS_CMD_TARGETS)
+
+$(NSS_CMD_TARGETS): libs-nss/lib libs-nss/cmd/lib
+ifndef NSS_DISABLE_DBM
+libs-nss/lib: libs-dbm
+endif
+
+# Work around NSS build system race condition creating certdata.c in
+# security/nss/lib/ckfw/builtins. See bug #836220.
+libs-nss/lib: $(call mkdir_deps,../nss/lib/ckfw/builtins)
diff --git a/security/build/b2g-certdata.mk b/security/build/b2g-certdata.mk
index e36dc0ccbe4..786fdd5ffd3 100644
--- a/security/build/b2g-certdata.mk
+++ b/security/build/b2g-certdata.mk
@@ -30,6 +30,6 @@ hacked-certdata.txt : $(srcdir)/../nss/lib/ckfw/builtins/certdata.txt
 combined-certdata.txt : hacked-certdata.txt $(srcdir)/b2g-certdata.txt
 	cat $^ > $@
 
-libs:: combined-certdata.txt
+libs-nss/lib: combined-certdata.txt
 
 DEFAULT_GMAKE_FLAGS += NSS_CERTDATA_TXT='$(CURDIR)/combined-certdata.txt'
diff --git a/toolkit/toolkit-tiers.mk b/toolkit/toolkit-tiers.mk
index 8f530f974f3..e18182d117c 100644
--- a/toolkit/toolkit-tiers.mk
+++ b/toolkit/toolkit-tiers.mk
@@ -13,6 +13,18 @@ tier_nspr_staticdirs += nsprpub
 tier_nspr_dirs += config/nspr
 endif
 
+TIERS += nss
+
+ifndef MOZ_NATIVE_SQLITE
+tier_nss_dirs += db/sqlite3/src
+endif
+
+ifdef MOZ_PSM
+ifndef MOZ_NATIVE_NSS
+tier_nss_dirs += security/build
+endif
+endif
+
 include $(topsrcdir)/config/js/build.mk
 
 TIERS += platform
@@ -31,16 +43,6 @@ endif
 
 tier_platform_dirs += xpcom
 
-ifndef MOZ_NATIVE_SQLITE
-tier_platform_dirs += db/sqlite3/src
-endif
-
-ifdef MOZ_PSM
-tier_platform_dirs += \
-  security/build \
-  $(NULL)
-endif
-
 tier_platform_dirs += \
 		modules/libpref \
 		intl \