diff --git a/fineid/README.md b/fineid/README.md
index 8740d87..acaa7eb 100644
--- a/fineid/README.md
+++ b/fineid/README.md
@@ -5,6 +5,7 @@
   - [Requirements for everything](#requirements-for-everything)
   - [Chromium](#chromium)
   - [Firefox and Thunderbird](#firefox-and-thunderbird)
+    - [Firefox policy](#firefox-policy)
   - [Okular](#okular)
     - [Validation](#validation)
   - [Root certificates](#root-certificates)
@@ -58,6 +59,27 @@ In Settings, Advanced, Security devices load the module from (DVV app) `/usr/lib
 `onepin` is a workaround to not ask for PIN2 which is only used for legal agreements,
 email signing also uses PIN1.
 
+### Firefox policy
+
+Firefox organizational policy can also be used for this, Thunderbird likely
+has one too. It will affect all users and instances of the application on the
+computer.
+
+In the file `/etc/firefox/policies/policies.json` which must be created if it
+doesn't exist:
+
+```json
+{
+  "policies": {
+    "SecurityDevices": {
+      "Add": {
+        "Fujitsu mPollux DigiSignApplication": "/usr/lib64/libcryptoki.so"
+      }
+    }
+  }
+}
+```
+
 ## Okular
 
 Okular is the KDE document viewer and supports signing PDF files using FINEID!