{
  pkgs,
  lib,
  inputs,
  config,
  ...
}:
let
  firefox-addons = inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system};
  buildFirefoxXpiAddon =
    inputs.firefox-addons.lib.${pkgs.stdenv.hostPlatform.system}.buildFirefoxXpiAddon;

  hacker-smacker = buildFirefoxXpiAddon {
    pname = "hacker-smacker";
    version = "2.2";
    addonId = "jid1-eo0mcXLTqCkaWA@jetpack";
    url = "https://addons.mozilla.org/firefox/downloads/file/4715262/hacker_smacker-2.2.xpi";
    sha256 = "d28f0597d5c4bae5db712b4875f4104120f7e55e5ea769c44d70996be31cc0d1";
    meta = with lib; {
      homepage = "https://www.hackersmacker.org";
      description = "Highlight (friend) and filter (foe) individual authors on Hacker News";
      license = licenses.mit;
      platforms = platforms.all;
    };
  };

  consumer-rights-wiki = buildFirefoxXpiAddon {
    pname = "consumer-rights-wiki";
    version = "1.0.34";
    addonId = "@crw-extension-firefox";
    url = "https://addons.mozilla.org/firefox/downloads/file/4730448/consumer_rights_wiki-1.0.34.xpi";
    sha256 = "732969ed4d5c7965b6254a1190a82ce4ab0ff44bda2295264eb8a22c452899ea";
    meta = with lib; {
      homepage = "https://github.com/FULU-Foundation/CRW-Extension";
      description = "Shows a popup when the site you're viewing has an article on the Consumer Rights Wiki";
      license = licenses.mit;
      platforms = platforms.all;
    };
  };

  ublockSettings = import ./ublock.nix { inherit lib; };
  darkReaderSettings = import ./dark-reader.nix { inherit lib; };
  redirectorSettings = import ./redirector.nix { inherit lib; };
in
{
  programs.zen-browser = {
    enable = true;
    profiles.default = {
      isDefault = true;

      extensions = {
        force = true;

        packages =
          (with firefox-addons; [
            bitwarden
            buster-captcha-solver
            consent-o-matic
            darkreader
            fastforwardteam
            localcdn
            redirector
            refined-github
            return-youtube-dislikes
            search-by-image # reverse image search
            ruffle_rs
            snowflake
            steam-database
            ublock-origin
          ])
          ++ [
            hacker-smacker
            consumer-rights-wiki
          ];

        settings = {
          "uBlock0@raymondhill.net" = ublockSettings;
          "addon@darkreader.org" = darkReaderSettings;
          "redirector@einaregilsson.com" = redirectorSettings;
        };
      };

      search = {
        force = true;
        default = "kagi";
        privateDefault = "ddg";
        order = [
          "kagi"
          "ddg"
          "google"
        ];
        engines = {
          kagi = {
            name = "Kagi";
            urls = [ { template = "https://kagi.com/search?q={searchTerms}"; } ];
            iconMapObj."16" = "https://kagi.com/favicon.ico";
            definedAliases = [ "@k" ];
          };
          google.metaData.alias = "@g";
        };
      };

      settings = {
        "identity.sync.tokenserver.uri" = "https://firefox-sync.sigkill.computer/1.0/sync/1.5";
        # auto-enable extensions on install
        "extensions.autoDisableScopes" = 0;
        # don't sync prefs/addons — we manage them declaratively via nix
        # syncing fights with the declarative config and can cause data loss
        # https://github.com/nix-community/home-manager/issues/6083
        "services.sync.engine.prefs" = false;
        "services.sync.engine.addons" = false;
        # disable built-in password manager — using bitwarden
        "signon.rememberSignons" = false;
        "signon.autofillForms" = false;
        "signon.management.page.breach-alerts.enabled" = false;
        "signon.formlessCapture.enabled" = false;
        "signon.privateBrowsingCapture.enabled" = false;
        # disable the autocomplete popup on login fields
        "signon.firefoxRelay.feature" = "";
        "signon.generation.enabled" = false;
        # disable passkey/webauthn prompts from the built-in manager
        "security.webauthn.enable_conditional_mediation" = false;
      };
    };
  };

  # Zen ignores XDG and hardcodes ~/.zen — symlink to module-managed path
  home.file.".zen".source = config.lib.file.mkOutOfStoreSymlink "${config.xdg.configHome}/zen";

  home.sessionVariables.BROWSER = "zen";
}