diff --git a/extra/firefox/build b/extra/firefox/build
index 923981a6..7db5959a 100755
--- a/extra/firefox/build
+++ b/extra/firefox/build
@@ -53,7 +53,6 @@ export CXXFLAGS="$CXXFLAGS -w"
 # change them to relative paths ($PWD/... ./...).
 export RUSTFLAGS="$RUSTFLAGS --remap-path-prefix=$PWD=."
 
-export LDFLAGS="$LDFLAGS -Wl,-rpath=/usr/lib/firefox,--enable-new-dtags"
 export RUSTFLAGS="$RUSTFLAGS -Cdebuginfo=0"
 export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=system
 export MOZ_DEBUG_FLAGS=-g0
@@ -78,8 +77,8 @@ ac_add_options --with-system-png
 ac_add_options --with-system-jpeg
 ac_add_options --with-system-zlib
 ac_add_options --with-system-pixman
-ac_add_options --without-system-nss
-ac_add_options --without-system-nspr
+ac_add_options --with-system-nss
+ac_add_options --with-system-nspr
 ac_add_options --without-wasm-sandboxed-libraries
 ac_add_options --disable-eme
 ac_add_options --disable-dbus
diff --git a/extra/firefox/checksums b/extra/firefox/checksums
index 124b090f..04d53515 100644
--- a/extra/firefox/checksums
+++ b/extra/firefox/checksums
@@ -1,4 +1,4 @@
-1a294a651dc6260f9a72a3ab9f10e7792a4ab41a9cfa8527ad3dd9979cdc98ce
+f23f4198bd9ba1bbb7420a622080301adb924fafbd6d83b00b1e6cc687e75f4e
 3dce6601b495f5b3d45b59f7d2492a340ee7e84b5beca17e48f862502bd5603f
 f0e8bb1f9b7eb0b01285495a2699df3a4b766784c1765a8f1aeedf63c0806369
 036d96991646d0449ed0aa952e4fbe21b476ce994abc276e49d30e686708bd37
@@ -6,3 +6,4 @@ ba6e380bc3d2cbd1b3a505ab97687498335c334d8a4be7f465ad30ee366806c7
 86ce49e650dd117f0f2928a7f810a58df526b1087c274d35eeb9c5bbf09eac5b
 bed3f4e39dcb8065dba174d37fb15f2a75887a6dd7ce6b872e5ab287c8bc386f
 4a232e3aa3973894a58c126b9e901c924d4e1ca3e00c4fc82d08de4b880183a9
+ed51ce8a6730c489ea9dda354f02c579fb3632925096a0260bfae7a6b82ceace
diff --git a/extra/firefox/depends b/extra/firefox/depends
index c7d777fc..5397e3e4 100644
--- a/extra/firefox/depends
+++ b/extra/firefox/depends
@@ -20,8 +20,9 @@ m4            make
 mesa
 nasm          make
 nodejs        make
+nspr
+nss
 pango
-perl          make
 pixman
 pkgconf       make
 python        make
diff --git a/extra/firefox/patches/no-perl.patch b/extra/firefox/patches/no-perl.patch
new file mode 100644
index 00000000..bcde015a
--- /dev/null
+++ b/extra/firefox/patches/no-perl.patch
@@ -0,0 +1,65 @@
+diff --git a/moz.configure b/moz.configure
+index 95763e2..dc0ed30 100755
+--- a/moz.configure
++++ b/moz.configure
+@@ -527,60 +527,6 @@ def awk_for_old_configure(value):
+ 
+ add_old_configure_assignment("AWK", awk_for_old_configure)
+ 
+-
+-# Perl detection
+-# ==============================================================
+-perl = check_prog("PERL", ("perl5", "perl"))
+-
+-# Until the PERL variable is not necessary in old-configure
+-
+-
+-@depends(perl)
+-def perl_for_old_configure(value):
+-    return value
+-
+-
+-add_old_configure_assignment("PERL", perl_for_old_configure)
+-
+-
+-@template
+-def perl_version_check(min_version):
+-    @depends(perl)
+-    @checking("for minimum required perl version >= %s" % min_version)
+-    def get_perl_version(perl):
+-        return Version(
+-            check_cmd_output(
+-                perl,
+-                "-e",
+-                "print $]",
+-                onerror=lambda: die("Failed to get perl version."),
+-            )
+-        )
+-
+-    @depends(get_perl_version)
+-    def check_perl_version(version):
+-        if version < min_version:
+-            die("Perl %s or higher is required.", min_version)
+-
+-    @depends(perl)
+-    @checking("for full perl installation")
+-    @imports("subprocess")
+-    def has_full_perl_installation(perl):
+-        ret = subprocess.call([perl, "-e", "use Config; exit(!-d $Config{archlib})"])
+-        return ret == 0
+-
+-    @depends(has_full_perl_installation)
+-    def require_full_perl_installation(has_full_perl_installation):
+-        if not has_full_perl_installation:
+-            die(
+-                "Cannot find Config.pm or $Config{archlib}. "
+-                "A full perl installation is required."
+-            )
+-
+-
+-perl_version_check("5.006")
+-
+-
+ # GNU make detection
+ # ==============================================================
+ option(env="MAKE", nargs=1, help="Path to GNU make")
diff --git a/extra/firefox/sources b/extra/firefox/sources
index 16b3cd8e..4e092eb4 100644
--- a/extra/firefox/sources
+++ b/extra/firefox/sources
@@ -6,3 +6,4 @@ patches/fix-clang-as.patch
 patches/fix-linux-header.patch
 patches/no-dbus.patch
 patches/no-fribidi.patch
+patches/no-perl.patch
diff --git a/extra/firefox/version b/extra/firefox/version
index 6b4eb38a..e85af8e9 100644
--- a/extra/firefox/version
+++ b/extra/firefox/version
@@ -1 +1 @@
-104.0 1
+104.0.1 1
diff --git a/extra/nspr/build b/extra/nspr/build
new file mode 100755
index 00000000..d5c7a0e5
--- /dev/null
+++ b/extra/nspr/build
@@ -0,0 +1,27 @@
+#!/bin/sh -e
+
+mkdir build
+cd build
+
+# ./nspr/pr/include/md/_linux.h tests only __GLIBC__ version
+# to detect c-library features, list musl features here for now.
+CFLAGS="$CFLAGS -D_PR_POLL_AVAILABLE -D_PR_HAVE_OFF64_T -D_PR_INET6 \
+-D_PR_HAVE_INET_NTOP -D_PR_HAVE_GETHOSTBYNAME2 -D_PR_HAVE_GETADDRINFO \
+-D_PR_INET6_PROBE" \
+../nspr/configure \
+    --prefix=/usr \
+    --disable-debug \
+    --enable-optimize \
+    --enable-64bit
+
+make
+make install
+
+# $1 is never unset
+# shellcheck disable=2115
+rm -rf \
+    "$1/usr/lib/"*.a \
+    "$1/usr/bin/prerr.properties" \
+    "$1/usr/bin/compile-et.pl" \
+    "$1/usr/share" \
+    "$1/usr/include/nspr/md"
diff --git a/extra/nspr/checksums b/extra/nspr/checksums
new file mode 100644
index 00000000..7ef3f0cb
--- /dev/null
+++ b/extra/nspr/checksums
@@ -0,0 +1 @@
+c5b8354c48b632b8f4c1970628146c0e0c0ca8f32c7315d7d5736c002e03774f
diff --git a/extra/nspr/sources b/extra/nspr/sources
new file mode 100644
index 00000000..9641d45d
--- /dev/null
+++ b/extra/nspr/sources
@@ -0,0 +1 @@
+https://ftp.mozilla.org/pub/mozilla.org/nspr/releases/vVERSION/src/nspr-VERSION.tar.gz
diff --git a/extra/nspr/version b/extra/nspr/version
new file mode 100644
index 00000000..b5a3e825
--- /dev/null
+++ b/extra/nspr/version
@@ -0,0 +1 @@
+4.34.1 1
diff --git a/extra/nss/build b/extra/nss/build
new file mode 100755
index 00000000..3393c469
--- /dev/null
+++ b/extra/nss/build
@@ -0,0 +1,46 @@
+#!/bin/sh -e
+
+export USE_64=1
+export BUILD_OPT=1
+export FREEBL_NO_DEPEND=0
+export NSS_USE_SYSTEM_SQLITE=1
+export NSS_DISABLE_GTESTS=1
+export NSS_ENABLE_WERROR=0
+export NSS_DISABLE_DEPRECATED_SEED=1
+export NSS_DISABLE_DEPRECATED_RC2=1
+export NSPR_INCLUDE_DIR=/usr/include/nspr
+
+export CCC="$CXX"
+
+patch -p1 < no-perl.patch
+
+make -C nss all
+
+mkdir -p \
+    "$1/usr/include/nss/private" \
+    "$1/usr/lib/pkgconfig"
+
+cp dist/public/nss/*.h "$1/usr/include/nss/"
+cp dist/private/nss/blapi.h dist/private/nss/alghmac.h \
+    "$1/usr/include/nss/private/"
+cp dist/Linux*/lib/*.so "$1/usr/lib/"
+cp dist/Linux*/lib/*.chk "$1/usr/lib/"
+
+nspr_ver="$(nspr-config --version)"
+
+# This is disgusting and I hate this package with a passion.
+sed nss/pkg/pkg-config/nss.pc.in \
+    -e "s,%libdir%,/usr/lib,g" \
+    -e "s,%prefix%,/usr,g" \
+    -e "s,%exec_prefix%,/usr/bin,g" \
+    -e "s,%includedir%,/usr/include/nss,g" \
+    -e "s,%NSPR_VERSION%,$nspr_ver,g" \
+    -e "s,%NSS_VERSION%,$2,g" > "$1/usr/lib/pkgconfig/nss.pc"
+
+for file in \
+        nss/lib/ckfw/builtins/*/certdata.c \
+        nss/lib/ckfw/builtins/testlib/*/certdata-testlib.c; do
+    git hash-object -t blob "$file" >> build.hash
+done
+
+cmp generated.hash build.hash
diff --git a/extra/nss/checksums b/extra/nss/checksums
new file mode 100644
index 00000000..fc049c22
--- /dev/null
+++ b/extra/nss/checksums
@@ -0,0 +1,4 @@
+32bf673b72c2f9953ed3b4c7033abf5a6cad302854a24ae588c575a6567c1573
+b80a88c9daeab628242c2098b7c0ffc2ff5e1ffdbe99f5ba1f8702953726cbaf
+ad9723a6b4e2810c3125db3b08e3b84d427efc306cd3ede0e450d260df6df440
+84c5cb9210b5effd45ac233f6c08d3e0296ec1d3a3cb6570f5c0f3f6fb3143c0
diff --git a/extra/nss/depends b/extra/nss/depends
new file mode 100644
index 00000000..05a7f4b9
--- /dev/null
+++ b/extra/nss/depends
@@ -0,0 +1,5 @@
+git make
+linux-headers make
+nspr
+sqlite
+zlib
diff --git a/extra/nss/files/certdata.sh b/extra/nss/files/certdata.sh
new file mode 100755
index 00000000..832b82f3
--- /dev/null
+++ b/extra/nss/files/certdata.sh
@@ -0,0 +1,133 @@
+#!/bin/sh -eu
+
+# Run `sed -e 's|}$|},|' -e 's|,.*[A-Z]$|&,|' -e 's|,  |, |g'` on the perl
+# output for an accurate diff
+
+exec > "$2"
+
+cat << EOF
+/* THIS IS A GENERATED FILE */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef BUILTINS_H
+#include "builtins.h"
+#endif /* BUILTINS_H */
+
+EOF
+
+tolower()
+{
+    tr '[:upper:]' '[:lower:]' << EOF
+$1
+EOF
+}
+
+count()
+{
+    tr -dc "$2" << EOF | wc -m
+$1
+EOF
+}
+
+while read -r attr typ val; do
+    case $attr in
+        ''|\#*|BEGINDATA) continue
+    esac
+
+    case $typ in
+        CK_*) printf 'static const %s %s = %s;\n' "$typ" "$(tolower "$val")" "$val";
+    esac
+done < "$1" | sort -u
+
+cnt=0
+while read -r attr typ val; do
+    case $attr in
+        ''|\#*|BEGINDATA) continue ;;
+        CKA_CLASS)
+            [ "$cnt" -eq 0 ] || printf '\n};\n'
+            printf 'static const CK_ATTRIBUTE_TYPE nss_builtins_types_%d [] = {\n' \
+                "$((cnt += 1))"
+        ;;
+    esac
+
+    case $attr in CKA_*)
+        printf ' %s,' "$attr"
+    esac
+done < "$1"
+printf '\n};\n'
+
+cnt=0
+is_multiline_octal=0
+datasz=0
+while read -r attr typ val; do
+    case $attr in
+        ''|\#*|BEGINDATA) continue ;;
+        CKA_CLASS)
+            [ "$cnt" -eq 0 ] || printf '};\n'
+            printf 'static const NSSItem nss_builtins_items_%d [] = {\n' \
+                "$((cnt += 1))"
+        ;;
+    esac
+
+    if [ "$is_multiline_octal" = 1 ]; then
+        case $attr in
+            END)
+                printf ', (PRUint32)%d },\n' "$datasz"
+                is_multiline_octal=0
+                datasz=0
+            ;;
+            *)
+                printf '"%s"\n' "$attr"
+                : $((datasz += $(count "$attr" '\')))
+            ;;
+        esac
+        continue
+    fi
+
+    case $typ in
+        UTF8)
+            strsz="$(printf '%s' "$val" | wc -c)"
+            : $((strsz -= 2)) # ""
+            : $((strsz += 1)) # \0
+            printf '  { (void *)%s, (PRUint32)%d },\n' \
+                "$val" "$strsz"
+        ;;
+        MULTILINE_OCTAL)
+            is_multiline_octal=1
+            datasz=0
+            printf '  { (void *)'
+        ;;
+        *)
+            printf '  { (void *)&%s, (PRUint32)sizeof(%s) },\n' \
+                "$(tolower "$val")" "$typ"
+        ;;
+    esac
+done < "$1"
+printf '};\n'
+
+printf "\nbuiltinsInternalObject\nnss_builtins_data[] = {\n";
+
+cnt=0
+objsize=0
+while read -r attr typ val; do
+    case $attr in
+        ''|\#*|BEGINDATA) continue ;;
+        CKA_CLASS)
+            [ "$cnt" = 0 ] || printf "  { %d, nss_builtins_types_%d, nss_builtins_items_%d, {NULL} },\n" \
+                "$objsize" "$cnt" "$cnt"
+            objsize=0
+            : $((cnt += 1))
+        ;;
+    esac
+
+    case $attr in CKA_*)
+        : $((objsize += 1))
+    esac
+done < "$1"
+printf "  { %d, nss_builtins_types_%d, nss_builtins_items_%d, {NULL} },\n" \
+    "$objsize" "$cnt" "$cnt"
+printf '};\n'
+
+printf 'const PRUint32\nnss_builtins_nObjects = %d;\n' "$cnt"
diff --git a/extra/nss/files/generated.hash b/extra/nss/files/generated.hash
new file mode 100644
index 00000000..cdc8edec
--- /dev/null
+++ b/extra/nss/files/generated.hash
@@ -0,0 +1,2 @@
+5235089f6d1d9be46e37db32638afca1bf2c9594
+9ac213b003fcc3f2c707e43dc8e79a6b6392fa01
diff --git a/extra/nss/patches/no-perl.patch b/extra/nss/patches/no-perl.patch
new file mode 100644
index 00000000..0459803e
--- /dev/null
+++ b/extra/nss/patches/no-perl.patch
@@ -0,0 +1,21 @@
+diff --git a/nss/lib/ckfw/builtins/Makefile b/nss/lib/ckfw/builtins/Makefile
+index 2a633d2..561818b 100644
+--- a/nss/lib/ckfw/builtins/Makefile
++++ b/nss/lib/ckfw/builtins/Makefile
+@@ -67,4 +67,4 @@ NSS_CERTDATA_TXT = certdata.txt
+ endif
+ 
+ $(OBJDIR)/certdata.c: $(NSS_CERTDATA_TXT) certdata.perl | $$(@D)/d
+-	$(PERL) certdata.perl $(NSS_CERTDATA_TXT) $@
++	./certdata.sh $(NSS_CERTDATA_TXT) $@
+diff --git a/nss/lib/ckfw/builtins/testlib/Makefile b/nss/lib/ckfw/builtins/testlib/Makefile
+index 9eb29dd..d170325 100644
+--- a/nss/lib/ckfw/builtins/testlib/Makefile
++++ b/nss/lib/ckfw/builtins/testlib/Makefile
+@@ -71,5 +71,5 @@ NSS_CERTDATA-TESTLIB_TXT = certdata-testlib.txt
+ endif
+ 
+ $(OBJDIR)/certdata-testlib.c: $(NSS_CERTDATA-TESTLIB_TXT) | $$(@D)/d
+-	$(PERL) ../certdata.perl $(NSS_CERTDATA-TESTLIB_TXT) $@
++	../certdata.sh $(NSS_CERTDATA-TESTLIB_TXT) $@
+ 
diff --git a/extra/nss/sources b/extra/nss/sources
new file mode 100644
index 00000000..fa19cdfa
--- /dev/null
+++ b/extra/nss/sources
@@ -0,0 +1,4 @@
+https://ftp.mozilla.org/pub/security/nss/releases/NSS_MAJOR_MINOR_RTM/src/nss-VERSION.tar.gz
+files/certdata.sh nss/lib/ckfw/builtins
+files/generated.hash
+patches/no-perl.patch
diff --git a/extra/nss/version b/extra/nss/version
new file mode 100644
index 00000000..e035aa01
--- /dev/null
+++ b/extra/nss/version
@@ -0,0 +1 @@
+3.82 1