How can I use natively installed KeePassXC with a flatpak installed browser?

I'm trying to use a natively installed KeePassXC (apt) with flatpak installed Waterfox (because that's the only viable packaging available).

I enabled browser integration in KeePassXC for Chromium, Firefox and custom browser configuration with browser type Firefox and config location ~/.waterfox/native-messaging-hosts.

Firefox and Chromium work fine without further configuration after installing the browser extension.

Waterfox however, does not.

I followed these directions to the letter (corrected for Waterfox of course):

#Shared environment variables:
KP_CUSTOM=/home/$USER/.keepass-browser
KP_JSON_NAME=org.keepassxc.keepassxc_browser.json

#Firefox environment variables:
KP_FLATPAK_PACKAGE=net.waterfox.waterfox
KP_JSON_START=~/.mozilla/native-messaging-hosts
KP_JSON_END=~/.var/app/org.mozilla.firefox/.mozilla/native-messaging-hosts

#Put KeePass proxy and needed library files in user directory
mkdir -p $KP_CUSTOM/lib
mkdir -p $KP_JSON_END #Needed for firefox
cp /usr/bin/keepassxc-proxy $KP_CUSTOM/
rsync -a /usr/lib/x86_64-linux-gnu/libicudata* /usr/lib/x86_64-linux-gnu/libicuuc* /usr/lib/x86_64-linux-gnu/libicui* /usr/lib/x86_64-linux-gnu/libdouble* /usr/lib/x86_64-linux-gnu/libsodium* /usr/lib/x86_64-linux-gnu/libQt5* $KP_CUSTOM/lib

#Copy the json file to the flatpak app directory and change the executable path in the file
cp $KP_JSON_START/$KP_JSON_NAME $KP_JSON_END/
#sed -i "s/\/usr\/bin\//"$(echo $KP_CUSTOM | sed 's_/_\\/_g')"\//" $KP_JSON_END/$KP_JSON_NAME

#flatpak override --user --filesystem=$KP_CUSTOM:ro $KP_FLATPAK_PACKAGE #Only required if home directory is not shared to the flatpak
flatpak override --user --filesystem="$KP_CUSTOM":ro $KP_FLATPAK_PACKAGE
flatpak override --user --filesystem=xdg-run/org.keepassxc.KeePassXC.BrowserServer:ro $KP_FLATPAK_PACKAGE
flatpak override --user --env=LD_LIBRARY_PATH=$(flatpak info --show-permissions $KP_FLATPAK_PACKAGE | grep -oP '(?<=LD_LIBRARY_PATH=).*')";$KP_CUSTOM/lib" $KP_FLATPAK_PACKAGE

(I used this answer instead of the accepted one, since my KeePass is installed natively, not via flatpak and this seemed more fitting.)

But, no joy, the extension reports that a connection is impossible.

The configuration file exists and looks fine.

gerald@laptop:~$ cat /home/gerald/.waterfox/native-messaging-hosts/org.keepassxc.keepassxc_browser.json
{
    "allowed_extensions": [
        "[email protected]"
    ],
    "description": "KeePassXC integration with native messaging support",
    "name": "org.keepassxc.keepassxc_browser",
    "path": "/usr/bin/keepassxc-proxy",
    "type": "stdio"
}

Access to the directory is configured via override in flatpak:

gerald@laptop:~$ flatpak info --show-permissions net.waterfox.waterfox 
[Context]
shared=network;ipc;
sockets=wayland;pulseaudio;fallback-x11;cups;
devices=all;
filesystems=xdg-music;xdg-pictures;xdg-videos;xdg-run/speech-dispatcher:ro;~/snap:ro;xdg-download;~/.waterfox/native-messaging-hosts:ro;xdg-run/org.keepassxc.KeePassXC.BrowserServer:ro;xdg-documents;xdg-desktop;xdg-run/pipewire-0;
persistent=.waterfox;

[Session Bus Policy]
org.freedesktop.FileManager1=talk
org.freedesktop.Notifications=talk
org.freedesktop.ScreenSaver=talk
org.mpris.MediaPlayer2.firefox.*=own
org.a11y.bus=talk
org.mozilla.waterfox.*=own

Yet, the file is not found:

gerald@laptop:~$ sudo LANG=C strace -f -p $(pgrep waterfox) -e trace=file -s 200 2>&1 |   grep -i -E 'keepass|native-messaging-hosts|kdbx'
[pid 43154] openat(AT_FDCWD, "/home/gerald/.waterfox/native-messaging-hosts/org.keepassxc.keepassxc_browser.json", O_RDONLY) = -1 ENOENT (No such file or directory)
[pid 43154] openat(AT_FDCWD, "/usr/lib/waterfox/native-messaging-hosts/org.keepassxc.keepassxc_browser.json", O_RDONLY) = -1 ENOENT (No such file or directory)

What am I missing?

Other things I fixed:

$KP_CUSTOM:ro triggers bash magic and mangles the variable content. The correct command to run is:

flatpak override --user --filesystem="$KP_CUSTOM":ro $KP_FLATPAK_PACKAGE

KeePass constantly rewrites the path to the proxy binary in org.keepassxc.keepassxc_browser.json. I circumvented this by configuring a custom proxy binary location in KeePassXC, which makes the sed command superflous