diff --git a/.etckeeper b/.etckeeper
index 4a1f9b80..dd8d139a 100755
--- a/.etckeeper
+++ b/.etckeeper
@@ -590,6 +590,7 @@ maybe chmod 0644 'apt/trusted.gpg.d/debian-archive-stretch-stable.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/google-chrome.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/lutris.asc'
 maybe chmod 0644 'apt/trusted.gpg.d/spotify-2021-10-27-5E3C45D7B312C643.gpg'
+maybe chmod 0644 'apt/trusted.gpg.d/spotify-2022-11-14-7A3A762FAFD4A51F.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/steam.gpg'
 maybe chmod 0755 'avahi'
 maybe chmod 0755 'avahi/avahi-autoipd.action'
diff --git a/apparmor.d/usr.bin.thunderbird b/apparmor.d/usr.bin.thunderbird
index 5c69ecdf..59e72aed 100644
--- a/apparmor.d/usr.bin.thunderbird
+++ b/apparmor.d/usr.bin.thunderbird
@@ -17,8 +17,10 @@ profile thunderbird /usr/lib/thunderbird/thunderbird{,-bin} {
   #include <abstractions/dbus-accessibility>
   #include <abstractions/dbus-session>
   #include <abstractions/dconf>
+  #include <abstractions/dri-enumerate>
   #include <abstractions/gnome>
   #include <abstractions/ibus>
+  #include <abstractions/mesa>
   #include <abstractions/nameservice>
   #include <abstractions/nvidia>
   #include <abstractions/p11-kit>
@@ -43,6 +45,10 @@ profile thunderbird /usr/lib/thunderbird/thunderbird{,-bin} {
   # Backported from the dri-enumerate abstraction, available in AppArmor 2.13
   /sys/devices/pci[0-9]*/**/{device,subsystem_device,subsystem_vendor,uevent,vendor} r,
 
+  # Imported from the opencl abstraction, which we cannot include
+  # due to conflicting "x"
+  @{sys}/devices/pci[0-9]*/**/{class,config,resource,revision} r,
+
   # Allow opening attachments
   # TODO: create and use abstractions for opening various file formats
   /{usr/local/,usr/,}bin/* Cx -> sanitized_helper,
@@ -334,6 +340,9 @@ profile thunderbird /usr/lib/thunderbird/thunderbird{,-bin} {
   # TB tries to create this file but has no business doing so
   deny @{HOME}/.gnupg/gpg-agent.conf w,
 
+  # Required for Wayland display protocol support
+  owner /dev/shm/wayland.mozilla.ipc.[0-9]* rw,
+
   profile gpg {
     #include <abstractions/base>
 
@@ -425,6 +434,8 @@ profile thunderbird /usr/lib/thunderbird/thunderbird{,-bin} {
     owner /tmp/gpg-[a-zA-Z0-9]*/S.gpg-agent rw,
 
     /usr/share/sounds/** r,
+
+    deny /dev/shm/org.chromium.* rw, # file_inherit only
   }
 
   # Site-specific additions and overrides. See local/README for details.
diff --git a/apt/trusted.gpg.d/spotify-2022-11-14-7A3A762FAFD4A51F.gpg b/apt/trusted.gpg.d/spotify-2022-11-14-7A3A762FAFD4A51F.gpg
new file mode 100644
index 00000000..6cf41ed9
Binary files /dev/null and b/apt/trusted.gpg.d/spotify-2022-11-14-7A3A762FAFD4A51F.gpg differ
diff --git a/mailcap b/mailcap
index bc77e42e..b80c80db 100644
--- a/mailcap
+++ b/mailcap
@@ -298,6 +298,7 @@ x-scheme-handler/snap; gnome-software %s; test=test -n "$DISPLAY"
 text/plain; pluma %s; test=test -n "$DISPLAY"
 text/x-apt-sources-list; software-properties-gtk %s; test=test -n "$DISPLAY"
 text/x-apt-sources-list; software-properties-gtk %s; test=test -n "$DISPLAY"
+x-scheme-handler/spotify; spotify %s; test=test -n "$DISPLAY"
 x-scheme-handler/steam; steam steam://open/friends %s; test=test -n "$DISPLAY"
 x-scheme-handler/steamlink; steam steam://open/friends %s; test=test -n "$DISPLAY"
 message/rfc822; /usr/bin/thunderbird %s; test=test -n "$DISPLAY"