diff --git a/NEWS b/NEWS
index 096ce124..52fcf876 100644
--- a/NEWS
+++ b/NEWS
@@ -1,7 +1,10 @@
 D-Bus 1.11.0 (UNRELEASED)
 ==
 
-...
+Fixes:
+
+• On Windows, fix the logic for replacing the installation prefix
+  in service files' Exec lines (fd.o #83539; Milan Crha, Simon McVittie)
 
 D-Bus 1.10.0 (2015-08-25)
 ==
diff --git a/dbus/dbus-sysdeps-util-win.c b/dbus/dbus-sysdeps-util-win.c
index e83c5397..096ffee3 100644
--- a/dbus/dbus-sysdeps-util-win.c
+++ b/dbus/dbus-sysdeps-util-win.c
@@ -1493,12 +1493,19 @@ _dbus_replace_install_prefix (const char *configure_time_path)
   if ((!_dbus_get_install_root(runtime_prefix, len) ||
        strncmp (configure_time_path, DBUS_PREFIX "/",
                 strlen (DBUS_PREFIX) + 1))) {
-     strcat (retval, configure_time_path);
-     return retval;
-  }
+     strncpy (retval, configure_time_path, sizeof (retval) - 1);
+     /* strncpy does not guarantee to 0-terminate the string */
+     retval[sizeof (retval) - 1] = '\0';
+  } else {
+     size_t remaining;
 
-  strcpy (retval, runtime_prefix);
-  strcat (retval, configure_time_path + strlen (DBUS_PREFIX) + 1);
+     strncpy (retval, runtime_prefix, sizeof (retval) - 1);
+     retval[sizeof (retval) - 1] = '\0';
+     remaining = sizeof (retval) - 1 - strlen (retval);
+     strncat (retval,
+         configure_time_path + strlen (DBUS_PREFIX) + 1,
+         remaining);
+  }
 
   /* Somehow, in some situations, backslashes get collapsed in the string.
    * Since windows C library accepts both forward and backslashes as
@@ -1647,6 +1654,28 @@ _dbus_get_standard_system_servicedirs (DBusList **dirs)
   return TRUE;
 }
 
+static dbus_bool_t
+_dbus_get_config_file_name (DBusString *str,
+                            const char *basename)
+{
+  DBusString tmp;
+
+  if (!_dbus_string_append (str, _dbus_windows_get_datadir ()))
+    return FALSE;
+
+  _dbus_string_init_const (&tmp, "dbus-1");
+
+  if (!_dbus_concat_dir_and_file (str, &tmp))
+    return FALSE;
+
+  _dbus_string_init_const (&tmp, basename);
+
+  if (!_dbus_concat_dir_and_file (str, &tmp))
+    return FALSE;
+
+  return TRUE;
+}
+
 /**
  * Append the absolute path of the system.conf file
  * (there is no system bus on Windows so this can just
diff --git a/dbus/dbus-sysdeps-win.c b/dbus/dbus-sysdeps-win.c
index b3b459f8..69644b00 100644
--- a/dbus/dbus-sysdeps-win.c
+++ b/dbus/dbus-sysdeps-win.c
@@ -3330,71 +3330,6 @@ _dbus_get_install_root(char *prefix, int len)
     return TRUE;
 }
 
-/** 
-  find config file either from installation or build root according to 
-  the following path layout 
-    install-root/
-      bin/dbus-daemon[d].exe
-      etc/<config-file>.conf *or* etc/dbus-1/<config-file>.conf
-      (the former above is what dbus4win uses, the latter above is
-      what a "normal" Unix-style "make install" uses)
-
-    build-root/
-      bin/dbus-daemon[d].exe
-      bus/<config-file>.conf 
-*/
-dbus_bool_t 
-_dbus_get_config_file_name(DBusString *config_file, char *s)
-{
-  char path[MAX_PATH*2];
-  int path_size = sizeof(path);
-
-  if (!_dbus_get_install_root(path,path_size))
-    return FALSE;
-
-  if(strlen(s) + 4 + strlen(path) > sizeof(path)-2)
-    return FALSE;
-  strcat(path,"etc\\");
-  strcat(path,s);
-  if (_dbus_file_exists(path)) 
-    {
-      // find path from executable 
-      if (!_dbus_string_append (config_file, path))
-        return FALSE;
-    }
-  else 
-    {
-      if (!_dbus_get_install_root(path,path_size))
-        return FALSE;
-      if(strlen(s) + 11 + strlen(path) > sizeof(path)-2)
-        return FALSE;
-      strcat(path,"etc\\dbus-1\\");
-      strcat(path,s);
-  
-      if (_dbus_file_exists(path)) 
-        {
-          if (!_dbus_string_append (config_file, path))
-            return FALSE;
-        }
-      else
-        {
-          if (!_dbus_get_install_root(path,path_size))
-            return FALSE;
-          if(strlen(s) + 4 + strlen(path) > sizeof(path)-2)
-            return FALSE;
-          strcat(path,"bus\\");
-          strcat(path,s);
-          
-          if (_dbus_file_exists(path)) 
-            {
-              if (!_dbus_string_append (config_file, path))
-                return FALSE;
-            }
-        }
-    }
-  return TRUE;
-}    
-
 /* See comment in dbus-sysdeps-unix.c */
 dbus_bool_t
 _dbus_lookup_session_address (dbus_bool_t *supported,
diff --git a/dbus/dbus-sysdeps-win.h b/dbus/dbus-sysdeps-win.h
index a5367705..e9b30d7a 100644
--- a/dbus/dbus-sysdeps-win.h
+++ b/dbus/dbus-sysdeps-win.h
@@ -84,10 +84,6 @@ _dbus_win_sid_to_name_and_domain (dbus_uid_t uid,
 
 dbus_bool_t _dbus_file_exists (const char *filename);
 
-DBUS_PRIVATE_EXPORT
-dbus_bool_t _dbus_get_config_file_name(DBusString *config_file, 
-                                       char *s);
-
 DBUS_PRIVATE_EXPORT
 dbus_bool_t _dbus_get_install_root(char *prefix, int len);