diff --git a/flake.lock b/flake.lock
index b649aab..bffb0c7 100644
--- a/flake.lock
+++ b/flake.lock
@@ -193,11 +193,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776454077,
-        "narHash": "sha256-7zSUFWsU0+jlD7WB3YAxQ84Z/iJurA5hKPm8EfEyGJk=",
+        "lastModified": 1776562531,
+        "narHash": "sha256-Lh5Ns9DI67E+lSMOCGK0S+mFPy0mz0yOGiJTUXiR9JI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "565e5349208fe7d0831ef959103c9bafbeac0681",
+        "rev": "5b56ad02dc643808b8af6d5f3ff179e2ce9593f4",
         "type": "github"
       },
       "original": {
@@ -237,11 +237,11 @@
         "lastModified": 1731402384,
         "narHash": "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=",
         "type": "tarball",
-        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
+        "url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip"
       },
       "original": {
         "type": "tarball",
-        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
+        "url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip"
       }
     },
     "indigo": {
@@ -310,11 +310,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1776509722,
-        "narHash": "sha256-oHVMjAMBukYnGeEE0EtCQsx8cNRv8WadHD8ZV3oZFSM=",
+        "lastModified": 1776602954,
+        "narHash": "sha256-C41nazGNIM/58ISKaIirq8/z1sDgS6CVJnWBwAzhaGQ=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "f8cc32a3aba29fdacd06d80b0986028cfd413a22",
+        "rev": "c175f415488243723dc1a5514b286abbea6f93c1",
         "type": "github"
       },
       "original": {
@@ -343,11 +343,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1776505268,
-        "narHash": "sha256-+hK+EgAwuRG+lhqwOkKfXlqMEdELIoTMdjfVosIlLb0=",
+        "lastModified": 1776598536,
+        "narHash": "sha256-7Bbp0fDBJMDRpKfdHelMXbhY51bdCa5+Qn/+XONaOwk=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "9e5716a9dbf7dbf9622a95a5bd23a898867759c6",
+        "rev": "68bb942d2146cd2c8af69c0f16db18396b4388fe",
         "type": "github"
       },
       "original": {
@@ -401,11 +401,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776544041,
-        "narHash": "sha256-ryzOZLvuS/4ZbYJzR8+wYZpyG/Ssp6BAe6oTQ8ttAqU=",
+        "lastModified": 1776635459,
+        "narHash": "sha256-3UVWm751p/8VAY1Mq+DgSTCv9HpMmdB2byhnRrVKflk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f731538cdf1410a3c53d3a75a6a1142afc08e3af",
+        "rev": "8d8538e67e516362d9d09ee5d3ce73dce944612b",
         "type": "github"
       },
       "original": {
diff --git a/home/desktop/firefox.nix b/home/desktop/firefox.nix
index af7a49a..fbd92b5 100644
--- a/home/desktop/firefox.nix
+++ b/home/desktop/firefox.nix
@@ -50,6 +50,7 @@
         "mousewheel.with_control.action" = 5;
         "sidebar.revamp" = true;
         "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
+        "identity.sync.tokenserver.uri" = "https://fox.forest.monke";
       };
       ExtensionSettings = {
         "uBlock0@raymondhill.net" = {
diff --git a/modules/server/firefox-syncserver.nix b/modules/server/firefox-syncserver.nix
new file mode 100644
index 0000000..b352f29
--- /dev/null
+++ b/modules/server/firefox-syncserver.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  hostname = "fox.forest.monke";
+in
+{
+  sops = {
+    secrets = {
+      "ff-sync/master" = { };
+      "ff-sync/fxa" = { };
+    };
+    templates.ff-sync-env.content =
+      let
+        master = config.sops.placeholder."ff-sync/master";
+        fxa = config.sops.placeholder."ff-sync/fxa";
+      in
+      ''
+        SYNC_MASTER_SECRET="${master}"
+        SYNC_TOKENSERVER__FXA_METRICS_HASH_SECRET="${fxa}"
+      '';
+  };
+
+  services.mysql.package = pkgs.mariadb;
+
+  services.firefox-syncserver = {
+    enable = true;
+    singleNode = {
+      inherit hostname;
+      enable = true;
+      capacity = 3;
+      enableNginx = true;
+      url = "https://${hostname}";
+    };
+    secrets = config.sops.templates.ff-sync-env.path;
+    settings = {
+      tokenserver.enabled = true;
+    };
+  };
+
+  forest.nginxHosts = [
+    (lib.mkIf config.services.firefox-syncserver.enable {
+      "${hostname}" = {
+        onlySSL = true;
+        http2 = true;
+        sslCertificate = config.sops.secrets."ssl/cert".path;
+        sslCertificateKey = config.sops.secrets."ssl/key".path;
+      };
+    })
+  ];
+}
diff --git a/secrets/forest.yaml b/secrets/forest.yaml
index 30c355e..e544896 100644
--- a/secrets/forest.yaml
+++ b/secrets/forest.yaml
@@ -1,3 +1,6 @@
+ff-sync:
+    master: ENC[AES256_GCM,data:cJVL8v+K6uh5YfUuPFZz3IvTewB/kzl4zKeOxip+0zYoP65rAxV/fSFR8NuQrvyuG5JVfT2nMgfEoBA6dMcLFw==,iv:XJFqyWwLMMv+lyjXUyAa47TEA2+tI4DC1812LntH/00=,tag:5oaEZ+QF1MF84m9LqPiUNg==,type:str]
+    fxa: ENC[AES256_GCM,data:6uLruy8JDfJG80mUaYD7E9eCdov1G+X7/RJ80bH1CjlxJA5od6C02+nHn7T7v5ODPHJtsATlOJHPQgJFeV0YGA==,iv:6SDTCwo8HWklpIYYaKeJwKEOgcp/+2P/STXqd+nNHAQ=,tag:YevE9pZr7Nujx1gzKbAHsQ==,type:str]
 arrApiKeys:
     prowlarr: ENC[AES256_GCM,data:OU7Zm7hZ+hJbv4s1sO30p2IEgwJUNdlegfiw6oCQhkY=,iv:YBhfhZ0Jpp1pKOkifMV1iKz2VgGniOs1GUXXgTXaJjg=,tag:cnFB/ef0WRQlbvCKDynIzg==,type:str]
     sonarr: ENC[AES256_GCM,data:ZYVLqNdND4rZTQStRoEIRELEvVOgCg1sBKZyiGg/Gco=,iv:ifGu+WN3BNed1ahaIRzZH3U+SOznF8XURAAN9MgcgyE=,tag:0Gq3D1NV8a/0KXP3+9Lh6Q==,type:str]
@@ -57,7 +60,7 @@ sops:
             Q0hjS2ZHamZXUHhCWE5MOHJIZ2xNa0kKUrtOBXmsBhwmDfehU0kDymfTCGaCSoBm
             fwzrYdaF72+lxgvuqm8t6KK+x3yrz3/ksuVRvHPfgvM0cKp1D2vNKA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-10T10:20:34Z"
-    mac: ENC[AES256_GCM,data:xOlMc5bcUnTSxrz1TolOl8VP4JZd7vg4kCJBf+G1En5MJ60wt72QteLZOcYTK9YaPmveCskuNn5W1PPpP8Aqt6y17FSUI73l3EqYC8SjhToKJLRjgNyZusV5NWdMahLB3XHIgtDzsMuKMVcZrHYQPyp8p791uH1D4ssB+ByhB4w=,iv:kmzaqpKvMzUljT63QStnkQU7pkynuWuVjUuS2ptQq+o=,tag:DDQR5zzltYvZuSiWWvVQ8w==,type:str]
+    lastmodified: "2026-04-20T00:45:20Z"
+    mac: ENC[AES256_GCM,data:1PhLjfksDzm0k4TAdYBlsZJcrkvjzP0PEva4VdRC+EEH/HtDBTGWmrhL2BfruT2qjnu4SYDuUqo5SVi53eP1x/96j4lxPwG1hyqmsIy5edo9Xaj/nQOghQFuA7kY1l3b6VmspO5JS0ZeGf29SIwcNbJDCMxW/uy3Jli5OB1rfFU=,iv:kBgye5R4GN3lZ0H72y4E7HeE4+j2lDJmA1M+7CIKtq8=,tag:cZIK2JdjtNNtlmtb7DdLHw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.2