diff --git a/hosts/common/programs/assorted.nix b/hosts/common/programs/assorted.nix
index 8a8f94e4d..cdec59e81 100644
--- a/hosts/common/programs/assorted.nix
+++ b/hosts/common/programs/assorted.nix
@@ -435,6 +435,7 @@ in
       "wireshark"  # could maybe ship the cli as sysadmin pkg
       # "xterm"  # requires Xwayland
       # "zecwallet-lite"  # x86-only
+      "zoom-us"
       # "zulip"
     ];
 
diff --git a/hosts/common/programs/default.nix b/hosts/common/programs/default.nix
index 51aa5cbf5..0e98bd5d3 100644
--- a/hosts/common/programs/default.nix
+++ b/hosts/common/programs/default.nix
@@ -237,6 +237,7 @@
     ./zeal.nix
     ./zecwallet-lite.nix
     ./zelda64recomp.nix
+    ./zoom-us.nix
     ./zulip.nix
     ./zsa-udev-rules.nix
     ./zfs-tools.nix
diff --git a/hosts/common/programs/zoom-us.nix b/hosts/common/programs/zoom-us.nix
new file mode 100644
index 000000000..6dd7d771c
--- /dev/null
+++ b/hosts/common/programs/zoom-us.nix
@@ -0,0 +1,19 @@
+{ ... }:
+{
+  sane.programs.zoom-us = {
+    sandbox.net = "clearnet";
+    sandbox.whitelistAudio = true;
+    sandbox.whitelistAvDev = true;  #< XXX(2025-05-29): it doesn't use pipewire for mic/video
+    sandbox.whitelistDri = true;
+    sandbox.whitelistWayland = true;
+    sandbox.whitelistX = true;  # XXX(2025-05-29): required; TODO: try setting QP_... env vars to get native wayland?
+    # TODO: .config/{zoom,zoomus}.conf
+    # TODO: .config/Unknown Organization/zoom.conf
+    persist.byStore.ephemeral = [
+      ".cache/zoom"  # 8MB qmlcache
+    ];
+    persist.byStore.private = [
+      ".zoom"  # 400MB of app-data (i.e. Zoom downloads its assets instead of shipping them in the package)
+    ];
+  };
+}