--- a/taskcluster/ci/build/windows.yml
+++ b/taskcluster/ci/build/windows.yml
@@ -645,16 +645,17 @@ win32-mingw32/debug:
         product: firefox
         job-name: win32-mingw32-debug
     treeherder:
         platform: windows-mingw32-32/debug
         symbol: B
         tier: 2
     worker-type: aws-provisioner-v1/gecko-{level}-b-linux
     worker:
+        docker-image: {in-tree: mingw32-build}
         max-run-time: 7200
     run:
         using: mozharness
         actions: [build]
         script: mozharness/scripts/fx_desktop_build.py
         config:
             - builds/releng_base_firefox.py
             - builds/releng_base_windows_32_mingw_builds.py

--- a/taskcluster/ci/docker-image/kind.yml
+++ b/taskcluster/ci/docker-image/kind.yml
@@ -74,16 +74,19 @@ jobs:
       DIST: stretch
       BASE_TAG: '20170620'
       SNAPSHOT: '20170830T000511Z'
     packages:
       - deb9-mercurial
   android-build:
     symbol: I(agb)
     parent: debian9-base
+  mingw32-build:
+    symbol: I(mingw)
+    parent: debian9-base
   index-task:
     symbol: I(idx)
   funsize-update-generator:
     symbol: I(pg)
   google-play-strings:
     symbol: I(gps)
   funsize-balrog-submitter:
     symbol: I(fbs)

--- a/taskcluster/ci/toolchain/linux.yml
+++ b/taskcluster/ci/toolchain/linux.yml
@@ -501,49 +501,49 @@ linux64-upx:
     description: "UPX build for MinGW32 Cross Compile"
     treeherder:
         kind: build
         platform: toolchains/opt
         symbol: TMW(upx)
         tier: 2
     worker-type: aws-provisioner-v1/gecko-{level}-b-linux
     worker:
-        docker-image: {in-tree: desktop-build}
+        docker-image: {in-tree: mingw32-build}
         max-run-time: 3600
     run:
         using: toolchain-script
         script: build-upx.sh
         toolchain-artifact: public/build/upx.tar.xz
 
 linux64-wine:
     description: "Wine build for MinGW32 Cross Compile"
     treeherder:
         kind: build
         platform: toolchains/opt
         symbol: TMW(wine)
         tier: 2
     worker-type: aws-provisioner-v1/gecko-{level}-b-linux
     worker:
-        docker-image: {in-tree: desktop-build}
+        docker-image: {in-tree: mingw32-build}
         max-run-time: 10800
     run:
         using: toolchain-script
         script: build-wine.sh
         toolchain-artifact: public/build/wine.tar.xz
 
 linux64-mingw32-gcc:
     description: "GCC toolchain build for MinGW32 Cross Compile"
     treeherder:
         kind: build
         platform: toolchains/opt
         symbol: TMW(mingw32-gcc)
         tier: 2
     worker-type: aws-provisioner-v1/gecko-{level}-b-linux
     worker:
-        docker-image: {in-tree: desktop-build}
+        docker-image: {in-tree: mingw32-build}
         max-run-time: 10800
     run:
         using: toolchain-script
         script: build-gcc-mingw32.sh
         resources:
             - 'build/unix/build-gcc/build-gcc.sh'
         toolchain-artifact: public/build/mingw32.tar.xz
 
@@ -551,17 +551,17 @@ linux64-mingw32-nsis:
     description: "NSIS build for MinGW32 Cross Compile"
     treeherder:
         kind: build
         platform: toolchains/opt
         symbol: TMW(mingw32-nsis)
         tier: 2
     worker-type: aws-provisioner-v1/gecko-{level}-b-linux
     worker:
-        docker-image: {in-tree: desktop-build}
+        docker-image: {in-tree: mingw32-build}
         max-run-time: 3600
     run:
         using: toolchain-script
         script: build-mingw32-nsis.sh
         toolchain-artifact: public/build/nsis.tar.xz
     toolchains:
         - linux64-mingw32-gcc
 
@@ -569,16 +569,16 @@ linux64-mingw32-fxc2:
     description: "fxc2.exe build for MinGW32 Cross Compile"
     treeherder:
         kind: build
         platform: toolchains/opt
         symbol: TMW(mingw32-fxc2)
         tier: 2
     worker-type: aws-provisioner-v1/gecko-{level}-b-linux
     worker:
-        docker-image: {in-tree: desktop-build}
+        docker-image: {in-tree: mingw32-build}
         max-run-time: 1800
     run:
         using: toolchain-script
         script: build-mingw32-fxc2.sh
         toolchain-artifact: public/build/fxc2.tar.xz
     toolchains:
         - linux64-mingw32-gcc

new file mode 100644
--- /dev/null
+++ b/taskcluster/docker/mingw32-build/Dockerfile
@@ -0,0 +1,53 @@
+# %ARG DOCKER_IMAGE_PARENT
+FROM $DOCKER_IMAGE_PARENT
+MAINTAINER Mike Hommey <mhommey@mozilla.com>
+
+VOLUME /builds/worker/checkouts
+VOLUME /builds/worker/workspace
+VOLUME /builds/worker/tooltool-cache
+
+ENV XZ_OPT=-T0
+
+RUN dpkg --add-architecture i386
+
+# Ideally, we wouldn't need gcc-multilib and the extra linux-libc-dev,
+# but the latter is required to make the former installable, and the former
+# because of bug 1409276.
+RUN apt-get update && \
+    apt-get install \
+      autoconf2.13 \
+      bison \
+      bzip2 \
+      flex \
+      curl \
+      file \
+      gawk \
+      g++-multilib \
+      gnupg \
+      libucl-dev \
+      p7zip-full \
+      scons \
+      tar \
+      unzip \
+      uuid \
+      wget \
+      x11-utils \
+      xvfb \
+      yasm \
+      zip \
+      zlib1g-dev \
+      libfreetype6-dev:i386 \
+      libx11-dev:i386
+
+# Stubbed out credentials; mozharness looks for this file an issues a WARNING
+# if it's not found, which causes the build to fail.  Note that this needs to
+# be in the parent of the workspace directory and in the directory where
+# mozharness is run (not its --work-dir).  See Bug 1169652.
+# %include taskcluster/docker/desktop-build/oauth.txt
+COPY topsrcdir/taskcluster/docker/desktop-build/oauth.txt /builds/worker/
+
+# stubbed out buildprops, which keeps mozharness from choking
+# Note that this needs to be in the parent of the workspace directory and in
+# the directory where mozharness is run (not its --work-dir)
+# %include taskcluster/docker/desktop-build/buildprops.json
+COPY topsrcdir/taskcluster/docker/desktop-build/buildprops.json /builds/worker/

--- a/taskcluster/scripts/misc/build-upx.sh
+++ b/taskcluster/scripts/misc/build-upx.sh
@@ -5,33 +5,20 @@ WORKSPACE=$HOME/workspace
 HOME_DIR=$WORKSPACE/build
 INSTALL_DIR=$WORKSPACE/upx
 UPLOAD_DIR=$HOME/artifacts
 
 mkdir -p $INSTALL_DIR/bin
 
 cd $WORKSPACE
 
-# --------------
-
-wget --progress=dot:mega http://www.oberhumer.com/opensource/ucl/download/ucl-1.03.tar.gz
-echo "5847003d136fbbca1334dd5de10554c76c755f7c  ucl-1.03.tar.gz" | sha1sum -c -
-tar xf ucl-1.03.tar.gz
-cd ucl-1.03
-./configure
-make -j$(nproc)
-
-# --------------
-
-cd ..
 git clone -n https://github.com/upx/upx.git upx-clone
 cd upx-clone
 git checkout d31947e1f016e87f24f88b944439bbee892f0429 # Asserts integrity of the clone (right?)
 git submodule update --init --recursive
-export UPX_UCLDIR=$WORKSPACE/ucl-1.03
 cd src
 make -j$(nproc)
 cp upx.out $INSTALL_DIR/bin/upx
 
 # --------------
 
 cd $WORKSPACE
 tar caf upx.tar.xz upx