{
  lib,
  pkgs,
  osConfig,
  ...
}: let
  enablePlasma = osConfig.services.desktopManager.plasma6.enable;

  extension = shortId: uuid: {
    name = uuid;
    value = {
      install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi";
      installation_mode = "force_installed";
    };
  };
  oldExtensions = builtins.listToAttrs;

  ext = shortId: {
    install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi";
    installation_mode = "force_installed";
  };
  exts = builtins.mapAttrs (_: ext);
in {
  programs.firefox = {
    enable = true;
    nativeMessagingHosts = [
      pkgs.tridactyl-native
    ];

    # https://mozilla.github.io/policy-templates/
    policies = {
      # no need for password manager since we use bitwarden
      OfferToSaveLogins = false;
      OfferToSaveLoginsDefault = false;
      PasswordManagerEnabled = false;

      DisableTelemetry = true;

      ExtensionSettings = lib.mkMerge [
        (oldExtensions [
          (extension "sidebery" "{3c078156-979c-498b-8990-85f7987dd929}") # has no email id
          (extension "kagi-search-for-firefox" "search@kagi.com")
          (extension "ublock-origin" "uBlock0@raymondhill.net")
          (extension "privacy-badger17" "jid1-MnnxcxisBPnSXQ@jetpack")
          (extension "i-dont-care-about-cookies" "jid1-KKzOGWgsW3Ao4Q@jetpack")
          (extension "bitwarden-password-manager" "{446900e4-71c2-419f-a6a7-df9c091e268b}")

          # site-specific
          (extension "sponsorblock" "sponsorBlocker@ajay.app")
        ])
        # TODO: Can we get this from nixpkgs instead?
        (lib.mkIf enablePlasma (exts {
          "plasma-browser-integration@kde.org" = "plasma-integration";
        }))
      ];
    };
    # To add additional extensions, find it on addons.mozilla.org, find
    # the short ID in the url (like https://addons.mozilla.org/en-US/firefox/addon/!SHORT_ID!/)
    # Then, download the XPI by filling it in to the install_url template, unzip it,
    # run `jq .browser_specific_settings.gecko.id manifest.json` or
    # `jq .applications.gecko.id manifest.json` to get the UUID
    # You don’t need to get the UUID from the xpi. You can install it then find the UUID in about:debugging#/runtime/this-firefox.

    profiles.default = {
      # https://searchfox.org/mozilla-central/source/modules/libpref/init/StaticPrefList.yaml
      settings = {
        "app.normandy.first_run" = false;
        "app.shield.optoutstudies.enabled" = false;
        "app.update.channel" = "default";
        # "browser.link.open_newwindow" = true;
        "browser.shell.checkDefaultBrowser" = true;
        "browser.urlbar.showSearchSuggestionsFirst" = false;
        "browser.vpn_promo.enabled" = false;
        # "extensions.activeThemeID" = "firefox-alpenglow@mozilla.org";
        # "extensions.extensions.activeThemeID" = "firefox-alpenglow@mozilla.org";
        "extensions.pocket.enabled" = false;
        "media.ffmpeg.vaapi.enabled" = true;
      };
    };
  };
}