diff --git a/docs/firefox.md b/docs/firefox.md
index 0a3ed5f..2201d5c 100644
--- a/docs/firefox.md
+++ b/docs/firefox.md
@@ -81,8 +81,9 @@ profile's `user.js` to `/app/etc/firefox/steam-frame-nix-desktop-user.js`
 (a sandbox path) right before starting Firefox, waits for it, and once it
 has exited and the profile is no longer in use removes the link and the
 value Firefox stored from it in `prefs.js`. A second launch that just hands
-a URL to the running Firefox leaves both in place. After a crash, the next
-launch or `steam-frame-nix-cleanup` (on switch) removes them.
+a URL to the running Firefox leaves both in place. After a crash (or if
+`prefs.js` can't be rewritten), the next launch or `steam-frame-nix-cleanup`
+(on switch) removes them.
 
 ### Older versions
 
diff --git a/modules/firefox/check.nix b/modules/firefox/check.nix
index 6690fc2..82be618 100644
--- a/modules/firefox/check.nix
+++ b/modules/firefox/check.nix
@@ -1,8 +1,9 @@
 # Checks of the Firefox wrapper's desktop profile user.js (wrapper.nix)
 # against a fake flatpak: the link exists only while Firefox runs, a second
 # launch that hands over to the running Firefox doesn't remove it, the value
-# Firefox stored from it leaves prefs.js once the profile is unlocked, a
-# user.js of the user's own is never touched, the profile manager action and
+# Firefox stored from it leaves prefs.js once the profile is unlocked (not
+# lost if prefs.js can't be rewritten), a user.js of the user's own is never
+# touched, the profile manager action and
 # the Steam session get no --profile.
 { pkgs }:
 let
@@ -61,6 +62,17 @@ pkgs.runCommand "firefox-check" { nativeBuildInputs = [ pkgs.findutils pkgs.gnug
   grep -q ignore-widgets $p/prefs.js || fail "prefs.js changed with an own user.js"
   rm $p/user.js
 
+  # prefs.js can't be rewritten: it and the link stay; the next launch retries
+  echo 'user_pref("other", 1);' > $p/prefs.js
+  mkdir $p/prefs.js.sfn
+  ${launcher} || true
+  grep -q other $p/prefs.js && grep -q ignore-widgets $p/prefs.js || fail "prefs.js lost on a write error"
+  [ -L $p/user.js ] || fail "link removed on a write error"
+  rmdir $p/prefs.js.sfn
+  ${launcher} || true
+  [ "$(cat $p/prefs.js)" = 'user_pref("other", 1);' ] || fail "retry: $(cat $p/prefs.js)"
+  [ ! -L $p/user.js ] || fail "retry left the link"
+
   # profile manager action: no --profile, no link
   : > $FAKE/log
   ${launcher} --ProfileManager || true
diff --git a/modules/firefox/wrapper.nix b/modules/firefox/wrapper.nix
index c40d3b1..a5d2ba9 100644
--- a/modules/firefox/wrapper.nix
+++ b/modules/firefox/wrapper.nix
@@ -8,7 +8,8 @@
 # no longer in use (a second launch that only hands its URL to the running
 # Firefox returns at once) removes the link and the value Firefox stored from
 # it in prefs.js. A user.js of the user's own is never touched. After a crash
-# the next launch or steam-frame-nix-cleanup finishes the removal.
+# (or a failed rewrite of prefs.js) the next launch or steam-frame-nix-cleanup
+# finishes the removal.
 { lib, writeShellScript, coreutils, findutils, gnugrep
 , profileDir             # shell word, e.g. "$HOME/.var/app/…/desktop"
 , desktopFix ? false
@@ -33,9 +34,13 @@ writeShellScript "firefox-wrapper" (''
   sfn_unlink() {
     ours && ! inUse || return 0
     if [ -f "$prof/prefs.js" ] && grep -qF "$pats" "$prof/prefs.js"; then
-      grep -vF "$pats" "$prof/prefs.js" > "$prof/prefs.js.sfn" || true
-      cat "$prof/prefs.js.sfn" > "$prof/prefs.js"
+      # If that fails (grep status 2, a failed write, e.g. a full disk),
+      # prefs.js and the link stay for the next try.
+      { grep -vF "$pats" "$prof/prefs.js"; [ $? -le 1 ]; } > "$prof/prefs.js.sfn" &&
+        cat "$prof/prefs.js.sfn" > "$prof/prefs.js"
+      ok=$?
       rm -f "$prof/prefs.js.sfn"
+      [ $ok = 0 ] || return 0
     fi
     rm -f "$u"
   }