{ ffLib }: {
  policies = {
    DisableAppUpdate = true;
    DisableSystemAddonUpdate = true;
    ExtensionUpdate = false;

    Preferences = ffLib.flattenAttrs {
      app.update.auto = false;
      browser.search.update = false;
    };
  };

  preferences = {
    # try really hard to prevent search engine resets, probably wrong
    browser.search = {
      update = false;
      geoSpecificDefaults = false;
      "geoSpecificDefaults.url" = "";
      geoip.url = "";
      suggest.enabled = false;
      reset.enabled = false;
      reset.whitelist = "";
    };
  };
}