diff --git a/ci/linux-install-node.sh b/ci/linux-install-node.sh
new file mode 100755
index 000000000..4c6f047bc
--- /dev/null
+++ b/ci/linux-install-node.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+node_version=20.10.0
+
+npm install compare-versions
+
+node -e "import pkg from 'compare-versions'; const { compareVersions } = pkg; process.exit(compareVersions('$node_version', process.version));"
+result=$?
+echo "result: $result"
+if [ "$result" != "1" ]; then
+  echo "node version is >= $node_version, no install will be performed."
+  exit
+fi
+
+cd /opt
+sudo curl -k -O https://unofficial-builds.nodejs.org/download/release/v$node_version/node-v$node_version-linux-x64-glibc-217.tar.xz
+echo "dcfc5dfcdea4d0883bb35a4f2e09bc4745b6e689d88f4ad09d9ccc252024049b  node-v$node_version-linux-x64-glibc-217.tar.xz" | sudo tee node-v$node_version-linux-x64-glibc-217.tar.xz.sha256
+sudo sha256sum --check node-v$node_version-linux-x64-glibc-217.tar.xz.sha256
+sudo tar xf node-v$node_version-linux-x64-glibc-217.tar.xz
+sudo tee /etc/profile.d/nodejs.sh << EOF
+export NODE_HOME=/opt/node-v$node_version-linux-x64-glibc-217
+export PATH=\$PATH:\$NODE_HOME/bin
+EOF
+sudo update-alternatives --install /usr/bin/node node /opt/node-v$node_version-linux-x64-glibc-217/bin/node 1
+sudo update-alternatives --install /usr/bin/npm npm /opt/node-v$node_version-linux-x64-glibc-217/bin/npm 1
+sudo update-alternatives --install /usr/bin/npx npx /opt/node-v$node_version-linux-x64-glibc-217/bin/npx 1
+sudo update-alternatives --install /usr/bin/corepack corepack /opt/node-v$node_version-linux-x64-glibc-217/bin/corepack 1
+cd /root
+
diff --git a/ci/linux-install-php.sh b/ci/linux-install-php.sh
new file mode 100755
index 000000000..00716357e
--- /dev/null
+++ b/ci/linux-install-php.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/bash
+
+php_version=8.3.20
+
+if command -v php; then
+  if php 'version_compare(PHP_VERSION, "$php_version") > 0 || exit(1);'; then
+    exit
+  fi
+fi
+
+# TODO: query the package manager to see if a sufficient php version is available
+
+# install PHP 8.3 from source
+sudo apt-get -y install gcc g++ make pkg-config libxml2-dev libsqlite3-dev \
+libcurl4-openssl-dev libpng-dev libonig-dev libldap2-dev libzip-dev \
+zlib1g-dev libssl-dev
+
+cd /tmp
+wget https://www.php.net/distributions/php-$php_version.tar.gz
+tar xzf php-$php_version.tar.gz
+cd php-$php_version
+
+# --enable-bcmath is needed by tecnickcom/tc-lib-barcode and tecnickcom/tc-lib-pdf
+./configure --prefix=/usr/local --with-curl --enable-bcmath --enable-gd --enable-mbstring --with-ldap --with-openssl --with-zlib
+
+make -j"$(nproc)"
+sudo make install
+
+php -v
+# END of PHP installation
diff --git a/ci/setup-bootstrap-host.sh b/ci/setup-bootstrap-host.sh
new file mode 100755
index 000000000..cd12cc170
--- /dev/null
+++ b/ci/setup-bootstrap-host.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/bash
+set -e
+thisdir="$(dirname "$0")"
+
+rm -f /etc/apt/sources.list.d/*; echo 'deb http://archive.debian.org/debian/ stretch main contrib non-free' >/etc/apt/sources.list
+apt-get -qy update
+apt-get -qy upgrade
+apt-get -y install git autogen autoconf automake m4 make bison flex binutils libtool gcc g++ libc-dev \
+           liblmdb-dev libpam0g-dev python libssl-dev libpcre3-dev psmisc curl jq unzip \
+           pigz parallel libpcre2-dev php-zip
+
+if ! command -v php; then
+  bash "$thisdir"/linux-install-php.sh
+fi
+
+if ! command -v node; then
+  bash "$thisdir"/linux-install-node.sh
+fi
+
+curl -sSfL https://raw.githubusercontent.com/cfengine/buildscripts/refs/heads/master/user-scripts/composer-install.sh | \
+COMPOSER_INSTALL_DIR="/usr/bin" \
+bash
+
+# install jdk "manually"
+cd /opt
+wget https://download.java.net/java/GA/jdk21.0.1/415e3f918a1f4062a0074a2794853d0d/12/GPL/openjdk-21.0.1_linux-x64_bin.tar.gz
+echo "7e80146b2c3f719bf7f56992eb268ad466f8854d5d6ae11805784608e458343f openjdk-21.0.1_linux-x64_bin.tar.gz" > openjdk-21.0.1_linux-x64_bin.tar.gz.sha256
+sha256sum --check openjdk-21.0.1_linux-x64_bin.tar.gz.sha256
+sudo tar xf openjdk-21.0.1_linux-x64_bin.tar.gz
+sudo tee /etc/profile.d/jdk.sh << EOF
+export JAVA_HOME=/opt/jdk-21.0.1
+export PATH=\$PATH:\$JAVA_HOME/bin
+EOF
+sudo update-alternatives --install /usr/bin/java java /opt/jdk-21.0.1/bin/java 1
diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh
index 03626ff02..cac131fde 100755
--- a/ci/setup-cfengine-build-host.sh
+++ b/ci/setup-cfengine-build-host.sh
@@ -139,6 +139,12 @@ if grep -q 6.10 /etc/issue 2>/dev/null; then
     urlget https://cfengine-package-repos.s3.amazonaws.com/enterprise/Enterprise-3.24.3/misc/cfengine-masterfiles-3.24.3-1.pkg.tar.gz
 fi
 
+# Here we start replacing the use of CFEngine policy with scripts. See ENT-14330
+if [ -f /etc/cfengine-bootstrap-pr-host.flag ]; then
+  "$thisdir"/setup-bootstrap-host.sh
+  exit
+fi
+
 if grep -q ubuntu /etc/os-release; then
     if grep -qi version=\"16 /etc/os-release; then
         urlget https://cfengine-package-repos.s3.amazonaws.com/enterprise/Enterprise-3.21.8/agent/agent_ubuntu16_x86_64/cfengine-nova_3.21.8-1.ubuntu16_amd64.deb