[4RExplorer]

I wanted a nut above each 2nd row window to bolt things to, so I removed the grab bars there, revealing small rectangular holes where the grab bars are attached to the 4Runner sheet metal body. Then I cut a small flap in the headliner on the rearward side of those holes and sanded down the paint around the holes.

For a stronger bond, I cut a squarish fender washer from a stainless steel "door push plate" from the hardware store. I enlarged the hole in the DIY fender washer to the bolt diameter using a regular handheld drill and some cutting oil. Then I roughed up both surfaces of the fender washer using a file.

I used stainless steel M8 x 1.25 flanged serrated nuts, but M6 would have been fine. I glued the nut to the fender washer, putting a lot of JBWeld around and over the flange. After it cured, I buttered the back of the fender washer with a thin layer of JBWeld and glued the assembly to the area I had sanded earlier, aligning the hole in the nut with the rectangular hole in the 4Runner body so that a bolt could go through both. Then I pushed the flap that I had cut in the headliner back in place, to help cover the fender washer. The uncut part of the headliner around the rectangular hole held the assembly in place while the JBWeld cured.