diff --git a/server/libs/fsExtra/copy/copy.js b/server/libs/fsExtra/copy/copy.js
index 09d53dfd7..b63a10a38 100644
--- a/server/libs/fsExtra/copy/copy.js
+++ b/server/libs/fsExtra/copy/copy.js
@@ -2,6 +2,7 @@
 
 const fs = require('graceful-fs')
 const path = require('path')
+const { pipeline } = require('stream')
 const mkdirs = require('../mkdirs').mkdirs
 const pathExists = require('../path-exists').pathExists
 const utimesMillis = require('../util/utimes').utimesMillis
@@ -98,10 +99,20 @@ function mayCopyFile (srcStat, src, dest, opts, cb) {
 }
 
 function copyFile (srcStat, src, dest, opts, cb) {
-  fs.copyFile(src, dest, err => {
+  const finish = err => {
     if (err) return cb(err)
     if (opts.preserveTimestamps) return handleTimestampsAndMode(srcStat.mode, src, dest, cb)
     return setDestMode(dest, srcStat.mode, cb)
+  }
+
+  fs.copyFile(src, dest, err => {
+    if (err?.code !== 'EPERM' || !srcStat.isFile()) return finish(err)
+
+    // Stream the fallback so database copies do not require a full-file buffer.
+    pipeline(fs.createReadStream(src, { highWaterMark: 1024 * 1024 }), fs.createWriteStream(dest, { highWaterMark: 1024 * 1024 }), streamError => {
+      if (streamError) return fs.unlink(dest, () => cb(streamError))
+      finish()
+    })
   })
 }
 
diff --git a/server/libs/fsExtra/move/move.js b/server/libs/fsExtra/move/move.js
index 7dc6ecd1f..3a6dc1a06 100644
--- a/server/libs/fsExtra/move/move.js
+++ b/server/libs/fsExtra/move/move.js
@@ -56,7 +56,7 @@ function doRename (src, dest, overwrite, isChangingCase, cb) {
 function rename (src, dest, overwrite, cb) {
   fs.rename(src, dest, err => {
     if (!err) return cb()
-    if (err.code !== 'EXDEV') return cb(err)
+    if (err.code !== 'EXDEV' && err.code !== 'EPERM') return cb(err)
     return moveAcrossDevice(src, dest, overwrite, cb)
   })
 }
diff --git a/test/server/fsExtraCopy.test.js b/test/server/fsExtraCopy.test.js
new file mode 100644
index 000000000..c1ceee049
--- /dev/null
+++ b/test/server/fsExtraCopy.test.js
@@ -0,0 +1,96 @@
+const { expect } = require('chai')
+const sinon = require('sinon')
+const fs = require('graceful-fs')
+const os = require('os')
+const path = require('path')
+const fsExtra = require('../../server/libs/fsExtra')
+
+describe('fsExtra copy fallback', () => {
+  let dir
+  let source
+  let dest
+  let contents
+
+  beforeEach(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'abs-copy-'))
+    source = path.join(dir, 'source')
+    dest = path.join(dir, 'dest')
+    contents = Buffer.alloc(2 * 1024 * 1024 + 17, 0x61)
+    fs.writeFileSync(source, contents)
+  })
+
+  afterEach(() => {
+    sinon.restore()
+    fs.rmSync(dir, { recursive: true, force: true })
+  })
+
+  it('copies through streams when asynchronous copyFile is denied', async () => {
+    sinon.stub(fs, 'copyFile').callsFake((src, target, callback) => {
+      callback(Object.assign(new Error('copyfile denied'), { code: 'EPERM' }))
+    })
+
+    await fsExtra.copy(source, dest)
+
+    expect(fs.readFileSync(dest).equals(contents)).to.be.true
+  })
+
+  it('moves across devices when asynchronous copyFile is denied', async () => {
+    sinon.stub(fs, 'rename').callsFake((src, target, callback) => {
+      callback(Object.assign(new Error('cross-device link'), { code: 'EXDEV' }))
+    })
+    sinon.stub(fs, 'copyFile').callsFake((src, target, callback) => {
+      callback(Object.assign(new Error('copyfile denied'), { code: 'EPERM' }))
+    })
+
+    await fsExtra.move(source, dest)
+
+    expect(fs.existsSync(source)).to.be.false
+    expect(fs.readFileSync(dest).equals(contents)).to.be.true
+  })
+
+  it('moves over an existing file when asynchronous rename and copyFile are denied', async () => {
+    fs.writeFileSync(dest, 'old database')
+    sinon.stub(fs, 'rename').callsFake((src, target, callback) => {
+      callback(Object.assign(new Error('rename denied'), { code: 'EPERM' }))
+    })
+    sinon.stub(fs, 'copyFile').callsFake((src, target, callback) => {
+      callback(Object.assign(new Error('copyfile denied'), { code: 'EPERM' }))
+    })
+
+    await fsExtra.move(source, dest, { overwrite: true })
+
+    expect(fs.existsSync(source)).to.be.false
+    expect(fs.readFileSync(dest).equals(contents)).to.be.true
+  })
+
+  it('keeps the source when a move cannot copy it', async () => {
+    sinon.stub(fs, 'rename').callsFake((src, target, callback) => {
+      callback(Object.assign(new Error('rename denied'), { code: 'EPERM' }))
+    })
+    sinon.stub(fs, 'copyFile').callsFake((src, target, callback) => {
+      callback(Object.assign(new Error('read failed'), { code: 'EIO' }))
+    })
+
+    try {
+      await fsExtra.move(source, dest)
+      expect.fail('Expected move to fail')
+    } catch (error) {
+      expect(error.code).to.equal('EIO')
+    }
+    expect(fs.readFileSync(source).equals(contents)).to.be.true
+  })
+
+  it('propagates unrelated copy errors', async () => {
+    sinon.stub(fs, 'copyFile').callsFake((src, target, callback) => {
+      callback(Object.assign(new Error('file missing'), { code: 'ENOENT' }))
+    })
+
+    try {
+      await fsExtra.copy(source, dest)
+      expect.fail('Expected copy to fail')
+    } catch (error) {
+      expect(error.code).to.equal('ENOENT')
+    }
+    expect(fs.existsSync(dest)).to.be.false
+  })
+})