@@ -46,8 +46,10 @@ ChromeUtils.defineESModuleGetters(lazy, {
   clearBlockedAboutPages: "resource://gre/modules/PoliciesHelpers.sys.mjs",
   clearRunOnceModification: "resource://gre/modules/PoliciesHelpers.sys.mjs",
   describePreferenceFailure: "resource://gre/modules/PoliciesHelpers.sys.mjs",
+  discardAMOUpdateURLs: "resource://gre/modules/PoliciesHelpers.sys.mjs",
   installAddonFromURL: "resource://gre/modules/PoliciesHelpers.sys.mjs",
   installAddonFromRepository: "resource://gre/modules/PoliciesHelpers.sys.mjs",
+  installAddonFromUpdateURL: "resource://gre/modules/PoliciesHelpers.sys.mjs",
   pemToBase64: "resource://gre/modules/PoliciesHelpers.sys.mjs",
   processMIMEInfo: "resource://gre/modules/PoliciesHelpers.sys.mjs",
   replacePathVariables: "resource://gre/modules/PoliciesHelpers.sys.mjs",
@@ -1788,6 +1790,7 @@ export var Policies = {
 
   ExtensionSettings: {
     onBeforeAddons(manager, param) {
+      lazy.discardAMOUpdateURLs(param, "ExtensionSettings");
       try {
         manager.setExtensionSettings(param);
       } catch (e) {
@@ -1865,7 +1868,20 @@ export var Policies = {
                 "ExtensionSettings"
               );
             } else if (!existingAddon) {
-              lazy.installAddonFromRepository(extensionID, "ExtensionSettings");
+              // An unusable update_url is an error, not a reason to install a
+              // different build of the add-on from AMO.
+              if (extensionSettings[extensionID].update_url) {
+                lazy.installAddonFromUpdateURL(
+                  extensionSettings[extensionID].update_url,
+                  extensionID,
+                  "ExtensionSettings"
+                );
+              } else {
+                lazy.installAddonFromRepository(
+                  extensionID,
+                  "ExtensionSettings"
+                );
+              }
             }
             manager.disallowFeature(`uninstall-extension:${extensionID}`);
             if (
 
@@ -184,3 +184,325 @@ add_task(
     await AddonTestUtils.promiseShutdownManager();
   }
 );
+
+// With only update_url, the newest compatible version in the update manifest is
+// installed; a newer but incompatible entry is skipped. An entry for an
+// unrelated add-on listed first in the manifest is ignored, confirming the
+// lookup is keyed by extension ID rather than by response order.
+add_task(
+  {
+    pref_set: [["extensions.checkUpdateSecurity", false]],
+  },
+  async function test_install_from_update_url() {
+    await AddonTestUtils.promiseStartupManager();
+
+    const id = "update-url-only@test";
+    const unrelatedId = "unrelated-extension@test";
+
+    for (const version of ["1.0", "2.0"]) {
+      server.registerFile(
+        `/data/update-url-only-${version}.xpi`,
+        AddonTestUtils.createTempWebExtensionFile({
+          manifest: {
+            version,
+            browser_specific_settings: { gecko: { id } },
+          },
+        })
+      );
+    }
+
+    server.registerFile(
+      "/data/unrelated-extension-5.0.xpi",
+      AddonTestUtils.createTempWebExtensionFile({
+        manifest: {
+          version: "5.0",
+          browser_specific_settings: { gecko: { id: unrelatedId } },
+        },
+      })
+    );
+
+    server.registerPathHandler("/data/update.json", (request, response) => {
+      response.setHeader("Content-Type", "application/json");
+      response.write(
+        JSON.stringify({
+          addons: {
+            [unrelatedId]: {
+              updates: [
+                {
+                  version: "5.0",
+                  update_link: `${BASE_URL}/unrelated-extension-5.0.xpi`,
+                },
+              ],
+            },
+            [id]: {
+              updates: [
+                {
+                  version: "1.0",
+                  update_link: `${BASE_URL}/update-url-only-1.0.xpi`,
+                },
+                {
+                  version: "2.0",
+                  update_link: `${BASE_URL}/update-url-only-2.0.xpi`,
+                },
+                {
+                  version: "3.0",
+                  update_link: `${BASE_URL}/update-url-only-3.0.xpi`,
+                  applications: { gecko: { strict_min_version: "9999" } },
+                },
+              ],
+            },
+          },
+        })
+      );
+    });
+
+    let extension = ExtensionTestUtils.expectExtension(id);
+    await Promise.all([
+      extension.awaitStartup(),
+      setupPolicyEngineWithJson({
+        policies: {
+          ExtensionSettings: {
+            [id]: {
+              installation_mode: "force_installed",
+              update_url: `${BASE_URL}/update.json`,
+            },
+          },
+        },
+      }),
+    ]);
+
+    const addon = await AddonManager.getAddonByID(id);
+    notEqual(addon, null, "Addon should be installed from the update manifest");
+    equal(addon.version, "2.0", "Newest compatible version was installed");
+
+    await addon.uninstall();
+    await AddonTestUtils.promiseShutdownManager();
+  }
+);
+
+// update_hash from the manifest is enforced against the downloaded XPI. No prefs
+// needed: a strong update_hash keeps the http update_link past
+// checkUpdateSecurity.
+add_task(async function test_update_hash_mismatch_does_not_install() {
+  await AddonTestUtils.promiseStartupManager();
+
+  const id = "update-url-badhash@test";
+
+  server.registerFile(
+    "/data/badhash.xpi",
+    AddonTestUtils.createTempWebExtensionFile({
+      manifest: {
+        version: "1.0",
+        browser_specific_settings: { gecko: { id } },
+      },
+    })
+  );
+
+  server.registerPathHandler(
+    "/data/update-badhash.json",
+    (request, response) => {
+      response.setHeader("Content-Type", "application/json");
+      response.write(
+        JSON.stringify({
+          addons: {
+            [id]: {
+              updates: [
+                {
+                  version: "1.0",
+                  update_link: `${BASE_URL}/badhash.xpi`,
+                  update_hash: `sha256:${"0".repeat(64)}`,
+                },
+              ],
+            },
+          },
+        })
+      );
+    }
+  );
+
+  const downloadFailed = AddonTestUtils.promiseInstallEvent("onDownloadFailed");
+
+  await setupPolicyEngineWithJson({
+    policies: {
+      ExtensionSettings: {
+        [id]: {
+          installation_mode: "force_installed",
+          update_url: `${BASE_URL}/update-badhash.json`,
+        },
+      },
+    },
+  });
+  await downloadFailed;
+
+  equal(
+    await AddonManager.getAddonByID(id),
+    null,
+    "Addon should not be installed when the update_hash does not match"
+  );
+
+  await AddonTestUtils.promiseShutdownManager();
+});
+
+// An update_url the URL parser rejects is an error, not a fallback to AMO.
+add_task(
+  {
+    pref_set: [
+      ["extensions.getAddons.get.url", `${BASE_URL}/amo.json?guid=%IDS%`],
+    ],
+  },
+  async function test_unparseable_update_url_does_not_fall_back_to_amo() {
+    await AddonTestUtils.promiseStartupManager();
+
+    const id = "update-url-unparseable@test";
+
+    const errorLogged = TestUtils.consoleMessageObserved(msg =>
+      msg.wrappedJSObject.arguments[0]?.includes(
+        `update_url for ${id} is not a valid URL`
+      )
+    );
+
+    await setupPolicyEngineWithJson({
+      policies: {
+        ExtensionSettings: {
+          [id]: {
+            installation_mode: "force_installed",
+            update_url: "http://",
+          },
+        },
+      },
+    });
+    await errorLogged;
+
+    equal(
+      await AddonManager.getAddonByID(id),
+      null,
+      "Addon should not be installed from AMO when update_url is unusable"
+    );
+
+    await AddonTestUtils.promiseShutdownManager();
+  }
+);
+
+// An update_url naming the default add-on update service is discarded outright,
+// so neither the install nor a later update check can reuse it, and the add-on
+// still installs through the AMO fallback.
+add_task(
+  {
+    pref_set: [
+      ["extensions.getAddons.get.url", `${BASE_URL}/amo.json?guid=%IDS%`],
+    ],
+  },
+  async function test_update_url_matching_amo_default_is_discarded() {
+    await AddonTestUtils.promiseStartupManager();
+
+    const id = "update-url-amo-default@test";
+    const backgroundId = "update-url-amo-background@test";
+    const defaults = Services.prefs.getDefaultBranch(null);
+    const defaultUpdateHostname = new URL(
+      defaults.getCharPref("extensions.update.url")
+    ).hostname;
+    const backgroundUpdateHostname = new URL(
+      defaults.getCharPref("extensions.update.background.url")
+    ).hostname;
+    const xpiURL = `${BASE_URL}/update-url-amo-default.xpi`;
+
+    server.registerFile(
+      "/data/update-url-amo-default.xpi",
+      AddonTestUtils.createTempWebExtensionFile({
+        manifest: {
+          version: "1.0",
+          browser_specific_settings: { gecko: { id } },
+        },
+      })
+    );
+
+    server.registerPathHandler("/data/amo.json", (request, response) => {
+      response.setHeader("Content-Type", "application/json");
+      response.write(JSON.stringify(makeAMOResponse(id, xpiURL)));
+    });
+
+    const warningLogged = TestUtils.consoleMessageObserved(msg =>
+      msg.wrappedJSObject.arguments[0]?.includes(`Invalid update_url for ${id}`)
+    );
+
+    let extension = ExtensionTestUtils.expectExtension(id);
+    await Promise.all([
+      extension.awaitStartup(),
+      setupPolicyEngineWithJson({
+        policies: {
+          ExtensionSettings: {
+            [id]: {
+              installation_mode: "force_installed",
+              update_url: `http://${defaultUpdateHostname}:8080/update/VersionCheck.php`,
+            },
+            [backgroundId]: {
+              installation_mode: "allowed",
+              update_url: `http://${backgroundUpdateHostname}:8080/update/VersionCheck.php`,
+            },
+          },
+        },
+      }),
+    ]);
+    await warningLogged;
+
+    const addon = await AddonManager.getAddonByID(id);
+    notEqual(
+      addon,
+      null,
+      "Addon should still be installed via AMO when update_url matches the default service"
+    );
+    equal(addon.version, "1.0", "Addon installed from the AMO fallback");
+
+    equal(
+      Services.policies.getExtensionSettings(id)?.update_url,
+      undefined,
+      "update_url should be discarded, not just skipped, so later update checks don't reuse it"
+    );
+
+    equal(
+      Services.policies.getExtensionSettings(backgroundId)?.update_url,
+      undefined,
+      "The background update service hostname should be discarded too"
+    );
+
+    await addon.uninstall();
+    await AddonTestUtils.promiseShutdownManager();
+  }
+);
+
+// The "%...%" placeholders normal update checks substitute are an add-on manager
+// implementation detail, not policy syntax: "%" must be followed by two hex
+// digits to pass the schema's "format": "uri" check. The whole ExtensionSettings
+// entry is dropped when one property fails validation, so installation_mode goes
+// with it and the add-on is never installed by any path.
+add_task(async function test_update_url_with_placeholders_fails_validation() {
+  await AddonTestUtils.promiseStartupManager();
+
+  const id = "update-url-placeholders@test";
+
+  const schemaErrorLogged = TestUtils.consoleMessageObserved(msg =>
+    msg.wrappedJSObject.arguments[0]?.includes(
+      'update_url: String does not match format "uri"'
+    )
+  );
+
+  await setupPolicyEngineWithJson({
+    policies: {
+      ExtensionSettings: {
+        [id]: {
+          installation_mode: "force_installed",
+          update_url: `${BASE_URL}/update-placeholders.json?item=%ITEM_ID%`,
+        },
+      },
+    },
+  });
+  await schemaErrorLogged;
+
+  equal(
+    await AddonManager.getAddonByID(id),
+    null,
+    "Addon should not be installed when update_url fails schema validation"
+  );
+
+  await AddonTestUtils.promiseShutdownManager();
+});