diff --git a/hosts/by-name/moby/default.nix b/hosts/by-name/moby/default.nix
index 7618084be..e0460b071 100644
--- a/hosts/by-name/moby/default.nix
+++ b/hosts/by-name/moby/default.nix
@@ -20,7 +20,7 @@
     neededForUsers = true;
   };
 
-  sane.web-browser = {
+  sane.programs.web-browser.config = {
     # compromise impermanence for the sake of usability
     persistCache = "private";
     persistData = "private";
diff --git a/hosts/common/home/mime.nix b/hosts/common/home/mime.nix
index bf624be82..63fdd7e60 100644
--- a/hosts/common/home/mime.nix
+++ b/hosts/common/home/mime.nix
@@ -1,7 +1,7 @@
 { config, sane-lib, ...}:
 
 let
-  www = config.sane.web-browser.browser.desktop;
+  www = config.sane.programs.web-browser.config.browser.desktop;
   pdf = "org.gnome.Evince.desktop";
   md = "obsidian.desktop";
   thumb = "org.gnome.gThumb.desktop";
diff --git a/hosts/common/programs/web-browser.nix b/hosts/common/programs/web-browser.nix
index fa3752334..c45ee3f39 100644
--- a/hosts/common/programs/web-browser.nix
+++ b/hosts/common/programs/web-browser.nix
@@ -9,7 +9,7 @@
 { config, lib, pkgs, sane-lib, ...}:
 with lib;
 let
-  cfg = config.sane.web-browser;
+  cfg = config.sane.programs.web-browser.config;
   # allow easy switching between firefox and librewolf with `defaultSettings`, below
   librewolfSettings = {
     browser = pkgs.librewolf-unwrapped;
@@ -100,53 +100,61 @@ let
       };
     };
   };
-in
-{
-  options = {
-    sane.web-browser.browser = mkOption {
-      default = defaultSettings;
-      type = types.attrs;
-    };
-    sane.web-browser.persistData = mkOption {
-      description = "optional store name to which persist browsing data (like history)";
-      type = types.nullOr types.str;
-      default = null;
-    };
-    sane.web-browser.persistCache = mkOption {
-      description = "optional store name to which persist browser cache";
-      type = types.nullOr types.str;
-      default = "cryptClearOnBoot";
-    };
-    sane.web-browser.addons = mkOption {
-      type = types.attrsOf addonOpts;
-      default = {
-        # get names from:
-        # - ~/ref/nix-community/nur-combined/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
-        # `wget ...xpi`; `unar ...xpi`; `cat */manifest.json | jq '.browser_specific_settings.gecko.id'`
-        # browserpass-ce.package = addon "browserpass-ce" "browserpass@maximbaz.com" "sha256-sXgUBbRvMnRpeIW1MTkmTcoqtW/8RDXAkxAq1evFkpc=";
-        browserpass-extension.package = localAddon pkgs.browserpass-extension;
-        # TODO: build bypass-paywalls from source? it's mysteriously disappeared from the Mozilla store.
-        # bypass-paywalls-clean.package = addon "bypass-paywalls-clean" "{d133e097-46d9-4ecc-9903-fa6a722a6e0e}" "sha256-oUwdqdAwV3DezaTtOMx7A/s4lzIws+t2f08mwk+324k=";
-        ether-metamask.package = addon "ether-metamask" "webextension@metamask.io" "sha256-G+MwJDOcsaxYSUXjahHJmkWnjLeQ0Wven8DU/lGeMzA=";
-        i2p-in-private-browsing.package = addon "i2p-in-private-browsing" "i2ppb@eyedeekay.github.io" "sha256-dJcJ3jxeAeAkRvhODeIVrCflvX+S4E0wT/PyYzQBQWs=";
-        sidebery.package = addon "sidebery" "{3c078156-979c-498b-8990-85f7987dd929}" "sha256-YONfK/rIjlsrTgRHIt3km07Q7KnpIW89Z9r92ZSCc6w=";
-        sponsorblock.package = addon "sponsorblock" "sponsorBlocker@ajay.app" "sha256-hRsvLaAsVm3dALsTrJqHTNgRFAQcU7XSaGhr5G6+mFs=";
-        ublacklist.package = addon "ublacklist" "@ublacklist" "sha256-RqY5iHzbL2qizth7aguyOKWPyINXmrwOlf/OsfqAS48=";
-        ublock-origin.package = addon "ublock-origin" "uBlock0@raymondhill.net" "sha256-eHlQrU/b9X/6sTbHBpGAd+0VsLT7IrVCnd0AQ948lyA=";
 
-        browserpass-extension.enable = lib.mkDefault true;
-        # bypass-paywalls-clean.enable = lib.mkDefault true;
-        ether-metamask.enable = lib.mkDefault true;
-        i2p-in-private-browsing.enable = lib.mkDefault config.services.i2p.enable;
-        sidebery.enable = lib.mkDefault true;
-        sponsorblock.enable = lib.mkDefault true;
-        ublacklist.enable = lib.mkDefault true;
-        ublock-origin.enable = lib.mkDefault true;
+  configOpts = {
+    options = {
+      browser = mkOption {
+        default = defaultSettings;
+        type = types.anything;
+      };
+      persistData = mkOption {
+        description = "optional store name to which persist browsing data (like history)";
+        type = types.nullOr types.str;
+        default = null;
+      };
+      persistCache = mkOption {
+        description = "optional store name to which persist browser cache";
+        type = types.nullOr types.str;
+        default = "cryptClearOnBoot";
+      };
+      addons = mkOption {
+        type = types.attrsOf addonOpts;
+        default = {
+          # get names from:
+          # - ~/ref/nix-community/nur-combined/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
+          # `wget ...xpi`; `unar ...xpi`; `cat */manifest.json | jq '.browser_specific_settings.gecko.id'`
+          # browserpass-ce.package = addon "browserpass-ce" "browserpass@maximbaz.com" "sha256-sXgUBbRvMnRpeIW1MTkmTcoqtW/8RDXAkxAq1evFkpc=";
+          browserpass-extension.package = localAddon pkgs.browserpass-extension;
+          # TODO: build bypass-paywalls from source? it's mysteriously disappeared from the Mozilla store.
+          # bypass-paywalls-clean.package = addon "bypass-paywalls-clean" "{d133e097-46d9-4ecc-9903-fa6a722a6e0e}" "sha256-oUwdqdAwV3DezaTtOMx7A/s4lzIws+t2f08mwk+324k=";
+          ether-metamask.package = addon "ether-metamask" "webextension@metamask.io" "sha256-G+MwJDOcsaxYSUXjahHJmkWnjLeQ0Wven8DU/lGeMzA=";
+          i2p-in-private-browsing.package = addon "i2p-in-private-browsing" "i2ppb@eyedeekay.github.io" "sha256-dJcJ3jxeAeAkRvhODeIVrCflvX+S4E0wT/PyYzQBQWs=";
+          sidebery.package = addon "sidebery" "{3c078156-979c-498b-8990-85f7987dd929}" "sha256-YONfK/rIjlsrTgRHIt3km07Q7KnpIW89Z9r92ZSCc6w=";
+          sponsorblock.package = addon "sponsorblock" "sponsorBlocker@ajay.app" "sha256-hRsvLaAsVm3dALsTrJqHTNgRFAQcU7XSaGhr5G6+mFs=";
+          ublacklist.package = addon "ublacklist" "@ublacklist" "sha256-RqY5iHzbL2qizth7aguyOKWPyINXmrwOlf/OsfqAS48=";
+          ublock-origin.package = addon "ublock-origin" "uBlock0@raymondhill.net" "sha256-eHlQrU/b9X/6sTbHBpGAd+0VsLT7IrVCnd0AQ948lyA=";
+
+          browserpass-extension.enable = lib.mkDefault true;
+          # bypass-paywalls-clean.enable = lib.mkDefault true;
+          ether-metamask.enable = lib.mkDefault true;
+          i2p-in-private-browsing.enable = lib.mkDefault config.services.i2p.enable;
+          sidebery.enable = lib.mkDefault true;
+          sponsorblock.enable = lib.mkDefault true;
+          ublacklist.enable = lib.mkDefault true;
+          ublock-origin.enable = lib.mkDefault true;
+        };
       };
     };
   };
-
+in
+{
   config = mkMerge [
+    ({
+      sane.programs.web-browser.configOption = mkOption {
+        type = types.submodule configOpts;
+        default = {};
+      };
+    })
     ({
       sane.programs.web-browser = {
         inherit package;
diff --git a/modules/programs.nix b/modules/programs.nix
index 14851d7cd..f5b17403c 100644
--- a/modules/programs.nix
+++ b/modules/programs.nix
@@ -104,6 +104,19 @@ let
           the secret will have same owner as the user under which the program is enabled.
         '';
       };
+      configOption = mkOption {
+        type = types.raw;
+        default = mkOption {
+          type = types.submodule {};
+          default = {};
+        };
+        description = ''
+          declare any other options the program may be configured with.
+          you probably want this to be a submodule.
+          the option *definitions* can be set with `sane.programs."foo".config = ...`.
+        '';
+      };
+      config = config.configOption;
     };
 
     config = {