diff --git a/README.md b/README.md
index eb6afc0..f93b2ef 100644
--- a/README.md
+++ b/README.md
@@ -51,4 +51,24 @@ WTFPL licensed.
 3. Click **Load Temporary Add-on...**
 4. Select `dist/splirate-firefox-v<version>.xpi`
 
-Note: on standard Firefox, unsigned extensions are temporary via `about:debugging` and are removed on restart.
\ No newline at end of file
+Note: on standard Firefox, unsigned extensions are temporary via `about:debugging` and are removed on restart.
+
+## Signed Build Download
+
+- Direct signed XPI: [splirate-signed.xpi](https://git.zetaphor.com/zetaphor/splirate/releases/download/signed/splirate-signed.xpi)
+- Releases page: [Splirate Releases](https://git.zetaphor.com/zetaphor/splirate/releases)
+
+## Persistent Install (Private / Unlisted Signing)
+
+Use Mozilla's unlisted signing to get a persistent signed XPI without public listing.
+
+1. Create AMO API credentials:
+   - [Firefox Add-on Developer Hub](https://addons.mozilla.org/developers/)
+2. Export credentials in your shell:
+   - `export AMO_JWT_ISSUER="your-issuer"`
+   - `export AMO_JWT_SECRET="your-secret"`
+3. Run signing:
+   - `npm run sign`
+4. Install the signed `.xpi` from:
+   - `dist/signed/`
+   - Firefox: `about:addons` → gear icon → **Install Add-on From File...**
\ No newline at end of file
diff --git a/icons/icon-128.png b/icons/icon-128.png
new file mode 100644
index 0000000..cb8e16b
Binary files /dev/null and b/icons/icon-128.png differ
diff --git a/icons/icon-48.png b/icons/icon-48.png
new file mode 100644
index 0000000..99c962b
Binary files /dev/null and b/icons/icon-48.png differ
diff --git a/icons/icon-96.png b/icons/icon-96.png
new file mode 100644
index 0000000..503d093
Binary files /dev/null and b/icons/icon-96.png differ
diff --git a/manifest.json b/manifest.json
index 0591df9..064ad94 100644
--- a/manifest.json
+++ b/manifest.json
@@ -4,9 +4,9 @@
   "version": "1.0.0",
   "description": "Splirate captures Splice sample links and downloads playable audio.",
   "icons": {
-    "48": "logo-single.png",
-    "96": "logo-single.png",
-    "128": "logo-single.png"
+    "48": "icons/icon-48.png",
+    "96": "icons/icon-96.png",
+    "128": "icons/icon-128.png"
   },
   "permissions": [
     "tabs",
@@ -37,8 +37,8 @@
   "browser_action": {
     "default_title": "Splirate",
     "default_icon": {
-      "48": "logo-single.png",
-      "96": "logo-single.png"
+      "48": "icons/icon-48.png",
+      "96": "icons/icon-96.png"
     },
     "default_popup": "popup.html"
   },
@@ -48,10 +48,15 @@
     "history.css",
     "page-probe.js"
   ],
-  "applications": {
+  "browser_specific_settings": {
     "gecko": {
       "id": "splirate@splice.local",
-      "strict_min_version": "109.0"
+      "strict_min_version": "109.0",
+      "data_collection_permissions": {
+        "required": [
+          "none"
+        ]
+      }
     }
   }
 }
\ No newline at end of file
diff --git a/package.json b/package.json
index 1d5934a..402371a 100644
--- a/package.json
+++ b/package.json
@@ -6,6 +6,8 @@
   "scripts": {
     "build": "bash scripts/build-firefox.sh",
     "build:firefox": "bash scripts/build-firefox.sh",
-    "build:xpi": "bash scripts/build-firefox.sh"
+    "build:xpi": "bash scripts/build-firefox.sh",
+    "sign": "bash scripts/sign-firefox.sh",
+    "sign:firefox": "bash scripts/sign-firefox.sh"
   }
 }
diff --git a/scripts/sign-firefox.sh b/scripts/sign-firefox.sh
new file mode 100755
index 0000000..ccaa860
--- /dev/null
+++ b/scripts/sign-firefox.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DIST_DIR="${ROOT_DIR}/dist/signed"
+
+if [[ -z "${AMO_JWT_ISSUER:-}" || -z "${AMO_JWT_SECRET:-}" ]]; then
+  echo "Missing AMO credentials." >&2
+  echo "Set AMO_JWT_ISSUER and AMO_JWT_SECRET before running this script." >&2
+  exit 1
+fi
+
+mkdir -p "${DIST_DIR}"
+
+cd "${ROOT_DIR}"
+
+# Signs as an unlisted add-on (private distribution).
+npx web-ext sign \
+  --source-dir "${ROOT_DIR}" \
+  --artifacts-dir "${DIST_DIR}" \
+  --channel unlisted \
+  --ignore-files "dist/*" "scripts/*" ".git/*" "*.har" "*.log" "*.tmp"
+
+echo "Signed XPI artifacts are in:"
+echo "${DIST_DIR}"