{
  config,
  pkgs,
  lib,
  device,
  ...
}: let
  common = import ./browser-common.nix {inherit pkgs lib device;};
in {
  # ryu (RTX 5090): nvidia VA-API decode needs the RDD-process sandbox off (it
  # blocks the CUDA/nvidia device nodes nvidia-vaapi-driver opens). Firefox's
  # wrapper (wrapFirefox) exposes no per-process env knob — only prefs/policies
  # — so this rides the user's HM session rather than the app launch. It is NOT
  # the system-wide environment.sessionVariables, and MOZ_-prefixed so only
  # Firefox/Zen ever read it (no effect on ollama or anything else). Pairs with
  # the VA-API prefs in browser-common.nix. See project_firefox_vulkan_decode_ryu.
  home.sessionVariables = lib.optionalAttrs (device.name == "ryu") {
    MOZ_DISABLE_RDD_SANDBOX = "1";
  };

  home.activation.firefoxDarwinProfilesIni = lib.mkIf pkgs.stdenv.hostPlatform.isDarwin (
    lib.hm.dag.entryAfter ["linkGeneration"] ''
      ffDir="$HOME/Library/Application Support/Firefox"
      iniLink="$ffDir/profiles.ini"
      if [ -L "$iniLink" ]; then
        target=$(readlink "$iniLink")
        run cp -f "$target" "$iniLink.tmp"
        run rm "$iniLink"
        run mv "$iniLink.tmp" "$iniLink"
        run chmod u+w "$iniLink"
      fi
      run rm -f "$ffDir/installs.ini"
    ''
  );

  stylix.targets.firefox.profileNames = ["default"];
  programs.firefox = {
    enable = true;
    package =
      if pkgs.stdenv.hostPlatform.isDarwin
      then null
      # ryu (RTX 5090) uses nvidia VA-API decode (prefs in browser-common.nix),
      # not Vulkan — so plain stable firefox, no beta/ffmpeg_8 override needed.
      # The Vulkan path (firefox-beta 153 + ffmpeg_8 wrapper override) was
      # dropped: it artifacts on Blackwell and crashes Zen.
      # See project_firefox_vulkan_decode_ryu (agent memory).
      else pkgs.firefox;
    configPath = lib.mkIf pkgs.stdenv.hostPlatform.isLinux "${config.xdg.configHome}/mozilla/firefox";
    profiles.default = {
      # Shared plugins/search/prefs with Zen (browser-common.nix), plus
      # Firefox's own chrome prefs (vertical tabs sidebar, smart-tab-groups off).
      settings =
        common.settings
        // {
          "sidebar.revamp" = true;
          "sidebar.verticalTabs" = true;
          "browser.tabs.groups.smart.enabled" = false;
          "browser.tabs.groups.smart.userEnabled" = false;
        };
      extensions.packages = common.extensions;
      inherit (common) search;
    };
    inherit (common) nativeMessagingHosts;
    # Shared policies plus Firefox's own new-tab-page layout.
    policies =
      common.policies
      // {
        FirefoxHome = {
          "Search" = true;
          "TopSites" = false;
          "SponsoredTopSites" = false;
          "Highlights" = false;
          "Pocket" = false;
          "SponsoredPocket" = false;
          "Snippets" = false;
          "Locked" = false;
        };
      };
  };
}