diff --git a/setup.sh b/setup.sh
index b61ec2f..538bbc8 100755
--- a/setup.sh
+++ b/setup.sh
@@ -19,8 +19,17 @@ _error()   { echo -e "${RED}✗ $1${NC}"; exit 1; }
 [[ "$OSTYPE" != "darwin"* ]] && _error "This script is designed for macOS."
 
 # ---------------------------------------------------------------------------
-# Clone or update the repo first so step files are available
+# Bootstrap: Homebrew first (installs Xcode CLT → git), then clone the repo
 # ---------------------------------------------------------------------------
+if ! command -v brew &>/dev/null; then
+    _info "Installing Homebrew (this also installs git via Xcode CLT)..."
+    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+    echo >> ~/.zprofile
+    echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zprofile
+    eval "$(/opt/homebrew/bin/brew shellenv)"
+    _success "Homebrew installed"
+fi
+
 _info "Setting up riotsecure repository..."
 if [ -d ~/riotsecure ]; then
     _warning "Repository already exists — updating..."
diff --git a/setup_ollama.sh b/setup_ollama.sh
index 13bef12..428c31b 100755
--- a/setup_ollama.sh
+++ b/setup_ollama.sh
@@ -18,8 +18,17 @@ _error()   { echo -e "${RED}✗ $1${NC}"; exit 1; }
 [[ "$OSTYPE" != "darwin"* ]] && _error "This script is designed for macOS."
 
 # ---------------------------------------------------------------------------
-# Clone or update the repo first so step files are available
+# Bootstrap: Homebrew first (installs Xcode CLT → git), then clone the repo
 # ---------------------------------------------------------------------------
+if ! command -v brew &>/dev/null; then
+    _info "Installing Homebrew (this also installs git via Xcode CLT)..."
+    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+    echo >> ~/.zprofile
+    echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zprofile
+    eval "$(/opt/homebrew/bin/brew shellenv)"
+    _success "Homebrew installed"
+fi
+
 _info "Setting up riotsecure repository..."
 if [ -d ~/riotsecure ]; then
     _warning "Repository already exists — updating..."
diff --git a/setup_onyx.sh b/setup_onyx.sh
index 2058a90..dfbecd2 100755
--- a/setup_onyx.sh
+++ b/setup_onyx.sh
@@ -35,8 +35,17 @@ while [[ $# -gt 0 ]]; do
 done
 
 # ---------------------------------------------------------------------------
-# Clone or update the repo first so step files are available
+# Bootstrap: Homebrew first (installs Xcode CLT → git), then clone the repo
 # ---------------------------------------------------------------------------
+if ! command -v brew &>/dev/null; then
+    _info "Installing Homebrew (this also installs git via Xcode CLT)..."
+    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+    echo >> ~/.zprofile
+    echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zprofile
+    eval "$(/opt/homebrew/bin/brew shellenv)"
+    _success "Homebrew installed"
+fi
+
 _info "Setting up riotsecure repository..."
 if [ -d ~/riotsecure ]; then
     _warning "Repository already exists — updating..."