diff --git a/modules/programs.nix b/modules/programs.nix
index cdca826..dd3122b 100644
--- a/modules/programs.nix
+++ b/modules/programs.nix
@@ -1,4 +1,13 @@
-{pkgs, ...}: {
+{pkgs, ...}: let
+  lock-false = {
+    Value = false;
+    Status = "locked";
+  };
+  lock-true = {
+    Value = true;
+    Status = "locked";
+  };
+in {
   # Common packages for ALL systems
   environment.systemPackages = with pkgs; [
     # networking
@@ -81,6 +90,52 @@
     # programs
     firefox = {
       enable = true;
+      policies = {
+        /*
+        ---- POLICIES ----
+        */
+
+        DisableTelemetry = true;
+        DisableFirefoxStudies = true;
+        EnableTrackingProtection = {
+          Value = true;
+          Locked = true;
+          Cryptomining = true;
+          Fingerprinting = true;
+        };
+
+        DisablePocket = true;
+        /*
+        ---- EXTENSIONS ----
+        */
+        # Check about:support for extension/add-on ID strings.
+        # Valid strings for installation_mode are "allowed", "blocked",
+        # "force_installed" and "normal_installed".
+        ExtensionSettings = {
+          "*".installation_mode = "normal_installed";
+          # uBlock Origin:
+          "uBlock0@raymondhill.net" = {
+            install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi";
+            installation_mode = "force_installed";
+          };
+          # Privacy Badger:
+          "jid1-MnnxcxisBPnSXQ@jetpack" = {
+            install_url = "https://addons.mozilla.org/firefox/downloads/latest/privacy-badger17/latest.xpi";
+            installation_mode = "force_installed";
+          };
+        };
+
+        /*
+        ---- PREFERENCES ----
+        */
+        Preferences = {
+          "browser.newtabpage.activity-stream.showSponsoredTopSites" = lock-false;
+          "extensions.activeThemeID" = {
+            Value = "{21ab01a8-2464-4824-bccb-6db15659347e}";
+            Status = "locked";
+          };
+        };
+      };
     };
     thunderbird.enable = true;
     steam = {