diff --git a/apps/zen.nix b/apps/zen.nix
index e47f0fa..186cda6 100644
--- a/apps/zen.nix
+++ b/apps/zen.nix
@@ -28,6 +28,13 @@ let
   # Diagnosing a silent failure: about:config -> fred.zenTheme.status holds
   # "ok <mtime>", "missing <path>" or "error <exception>" from the last pass.
   themeHotReload = ''
+    // Stage markers, in about:config. pref() is the one API autoconfig always
+    // has, sandboxed or not, so this line cannot be what fails:
+    //   fred.zenTheme.autoconfig  defaults/pref/autoconfig.js was read
+    //   fred.zenTheme.cfg         mozilla.cfg executed
+    //   fred.zenTheme.status      the watcher ran, and what it did
+    pref("fred.zenTheme.cfg", true);
+
     try {
       const kCc = Components.classes;
       const kCi = Components.interfaces;
@@ -96,7 +103,10 @@ in
       (inputs.zen-browser.packages.${pkgs.stdenv.hostPlatform.system}.default.override {
         # Lands in defaults/pref/autoconfig.js, the only place this pref is
         # read — setting it from mozilla.cfg is too late to unsandbox itself.
-        extraAutoConfig = ''pref("general.config.sandbox_enabled", false);'';
+        extraAutoConfig = ''
+          pref("general.config.sandbox_enabled", false);
+          pref("fred.zenTheme.autoconfig", true);
+        '';
         extraPrefs = themeHotReload;
       })
     ];