diff --git a/hosts/common/programs/tor-browser.nix b/hosts/common/programs/tor-browser.nix
index 6c0fa2a53..9a672cbb5 100644
--- a/hosts/common/programs/tor-browser.nix
+++ b/hosts/common/programs/tor-browser.nix
@@ -1,3 +1,9 @@
+# N.B.: to disable scripts, do one of:
+# a. open `about:config` and set `browser.security_level.security_slider=2`
+# b. use the security slider in "configure connection"
+# unfortunately, both of these routes require the browser to be restarted (as they advise),
+# else javascript is silently left enabled.
+
 { pkgs, ... }:
 {
   sane.programs.tor-browser = {
@@ -20,6 +26,8 @@
     # sandbox.mesaCacheDir = ".cache/tor-browser/mesa";  # don't persist mesa dir (privacy)
     persist.byStore.ephemeral = [
       ".local/share/tor-browser"  # persisted because of downloads, i think??
+      #v to persist $profile/prefs.js, required for js toggle. TODO: persist this more narrowly
+      ".tor project/firefox"
     ];
     mime.urlAssociations."^https?://.+\.onion$" = "torbrowser.desktop";
   };