diff --git a/typo3/sysext/install/Classes/Updates/BackendUserStartModuleUpdate.php b/typo3/sysext/install/Classes/Updates/BackendUserStartModuleUpdate.php
index 3cef0d613091d883d2fe3158f4939b8213e91540..29cd903a3dc0377c0e7b1ee42bf660d044645dfa 100644
--- a/typo3/sysext/install/Classes/Updates/BackendUserStartModuleUpdate.php
+++ b/typo3/sysext/install/Classes/Updates/BackendUserStartModuleUpdate.php
@@ -41,7 +41,7 @@ class BackendUserStartModuleUpdate extends AbstractUpdate
         $needsExecution = false;
         while ($backendUser = $statement->fetch()) {
             if ($backendUser['uc'] !== null) {
-                $userConfig = unserialize($backendUser['uc']);
+                $userConfig = unserialize($backendUser['uc'], ['allowed_classes' => false]);
                 if ($userConfig['startModule'] === 'help_aboutmodules'
                     || $userConfig['startModule'] === 'help_AboutmodulesAboutmodules'
                 ) {
@@ -71,7 +71,7 @@ class BackendUserStartModuleUpdate extends AbstractUpdate
         $statement = $queryBuilder->select('uid', 'uc')->from('be_users')->execute();
         while ($backendUser = $statement->fetch()) {
             if ($backendUser['uc'] !== null) {
-                $userConfig = unserialize($backendUser['uc']);
+                $userConfig = unserialize($backendUser['uc'], ['allowed_classes' => false]);
                 if ($userConfig['startModule'] === 'help_aboutmodules'
                     || $userConfig['startModule'] === 'help_AboutmodulesAboutmodules'
                 ) {
diff --git a/typo3/sysext/install/Classes/Updates/FileListIsStartModuleUpdate.php b/typo3/sysext/install/Classes/Updates/FileListIsStartModuleUpdate.php
index 3480cae9cf5b1bd6cbc51f20de7373b3806dc0d9..4a13b5280b03b5a798c62a075756fe595592c0dd 100644
--- a/typo3/sysext/install/Classes/Updates/FileListIsStartModuleUpdate.php
+++ b/typo3/sysext/install/Classes/Updates/FileListIsStartModuleUpdate.php
@@ -14,6 +14,9 @@
 
 namespace TYPO3\CMS\Install\Updates;
 
+use TYPO3\CMS\Core\Database\ConnectionPool;
+use TYPO3\CMS\Core\Utility\GeneralUtility;
+
 /**
  * Update backend user setting startModule if set to "file_list"
  */
@@ -36,13 +39,27 @@ class FileListIsStartModuleUpdate extends AbstractUpdate
             return false;
         }
 
-        if ($this->getDatabaseConnection()->exec_SELECTcountRows('uid', 'be_users') === 0) {
-            return false;
+        $needsExecution = false;
+
+        $statement = GeneralUtility::makeInstance(ConnectionPool::class)
+            ->getConnectionForTable('be_users')
+            ->select(['uid', 'uc'], 'be_users');
+        while ($backendUser = $statement->fetch()) {
+            if ($backendUser['uc'] !== null) {
+                $userConfig = unserialize($backendUser['uc'], ['allowed_classes' => false]);
+                if ($userConfig['startModule'] === 'file_list') {
+                    $needsExecution = true;
+                    break;
+                }
+            }
         }
 
-        $description = 'The backend user setting startModule is changed for the extension filelist. Update all backend users that use ext:filelist as startModule.';
+        if ($needsExecution) {
+            $description = 'The backend user setting startModule is changed for the extension filelist.'
+               . ' Update all backend users that use ext:filelist as startModule.';
+        }
 
-        return true;
+        return $needsExecution;
     }
 
     /**
@@ -54,27 +71,24 @@ class FileListIsStartModuleUpdate extends AbstractUpdate
      */
     public function performUpdate(array &$databaseQueries, &$customMessages)
     {
-        $db = $this->getDatabaseConnection();
-        $backendUsers = $db->exec_SELECTgetRows('uid,uc', 'be_users', '1=1');
-        if (!empty($backendUsers)) {
-            foreach ($backendUsers as $backendUser) {
-                if ($backendUser['uc'] !== null) {
-                    $userConfig = unserialize($backendUser['uc']);
-                    if ($userConfig['startModule'] === 'file_list') {
-                        $userConfig['startModule'] = 'file_FilelistList';
-                        $db->exec_UPDATEquery(
-                            'be_users',
-                            'uid=' . (int)$backendUser['uid'],
-                            array(
-                                'uc' => serialize($userConfig),
-                            )
-                        );
-                        $databaseQueries[] = $db->debug_lastBuiltQuery;
-                    }
+        $queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)
+            ->getQueryBuilderForTable('be_users');
+        $statement = $queryBuilder->select('uid', 'uc')->from('be_users')->execute();
+        while ($backendUser = $statement->fetch()) {
+            if ($backendUser['uc'] !== null) {
+                $userConfig = unserialize($backendUser['uc'], ['allowed_classes' => false]);
+                if ($userConfig['startModule'] === 'file_list') {
+                    $userConfig['startModule'] = 'file_FilelistList';
+                    $queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)
+                        ->getQueryBuilderForTable('be_users');
+                    $queryBuilder->update('be_users')
+                        ->where($queryBuilder->expr()->eq('uid', (int)$backendUser['uid']))
+                        ->set('uc', $queryBuilder->quote(serialize($userConfig)), false);
+                    $databaseQueries[] = $queryBuilder->getSQL();
+                    $queryBuilder->execute();
                 }
             }
         }
-
         $this->markWizardAsDone();
         return true;
     }