{ ... }: {

  programs.librewolf = {
    enable = true;

    policies = {
      # -----------------------
      # Privacy / telemetry
      # -----------------------
      DisableTelemetry = true;
      DisableFirefoxStudies = true;
      DisablePocket = true;

      # -----------------------
      # Accounts / sync
      # -----------------------
      OfferToSaveLogins = false;
      PasswordManagerEnabled = false;
      SyncDisabled = true;

      # -----------------------
      # Security baseline
      # -----------------------
      DefaultCookiesSetting = 1;
      DefaultGeolocationSetting = 2;
      DefaultNotificationsSetting = 2;
      DefaultPopupsSetting = 2;

      # -----------------------
      # DNS over HTTPS
      # -----------------------
      DNSOverHTTPS = {
        Enabled = true;
        ProviderURL = "https://dns.quad9.net/dns-query";
        Locked = true;
      };

      # -----------------------
      # Search engine
      # -----------------------
      SearchEngines = {
        Default = "Startpage";
        PreventInstalls = true;
      };

      # -----------------------
      # UI restrictions
      # -----------------------
      Homepage = {
        URL = "https://duckduckgo.com";
        StartPage = "homepage";
      };

      ShowHomeButton = false;
      BookmarkBar = false;

      # -----------------------
      # Extensions (optional enforcement)
      # -----------------------
      ExtensionSettings = {
        "uBlock0@raymondhill.net" = {
          installation_mode = "force_installed";
        };

        "multi-account-containers@mozilla.org" = {
          installation_mode = "force_installed";
        };

        "{73a6fe31-595d-460b-a920-fcc0f8843232}" = {
          installation_mode = "force_installed"; # NoScript
        };
      };
    };
  };
}