diff --git a/build-in-container-inner.sh b/build-in-container-inner.sh
index 16f708477..c4f250bda 100755
--- a/build-in-container-inner.sh
+++ b/build-in-container-inner.sh
@@ -88,6 +88,23 @@ install_mission_portal_deps() (
     find "$BASEDIR/mission-portal" "$BASEDIR/nova/api/http" -type d -name .git -path '*/vendor/*' -exec rm -rf {} +
 )
 
+# Build the masterfiles tarballs, mirroring build-scripts/bootstrap-tarballs.
+# Produces both the source tarball ("make dist") and the package tarball
+# ("make tar-package", files laid out as installed under prefix) and drops
+# them in /output alongside the platform packages.
+build_masterfiles_tarballs() (
+    set -e
+
+    cd "$BASEDIR/masterfiles"
+    rm -f cfengine-masterfiles*.tar.gz
+    # Configure so the dist targets work, matching bootstrap-tarballs (no args).
+    ./configure
+    make dist        # source tarball:  cfengine-masterfiles-<version>.tar.gz
+    make tar-package # package tarball: cfengine-masterfiles-<version>.pkg.tar.gz
+    mv cfengine-masterfiles*.tar.gz /output/
+    make distclean
+)
+
 # === Step runner with failure reporting ===
 # Disable set -e so we can capture exit codes and report which step failed.
 set +e
@@ -107,12 +124,15 @@ run_step() {
 # === Build steps ===
 run_step "01-autogen" "$BASEDIR/buildscripts/build-scripts/autogen"
 run_step "02-install-dependencies" "$BASEDIR/buildscripts/build-scripts/install-dependencies"
-if [ "$EXPLICIT_ROLE" = "hub" ]; then
+# Mission Portal is an Enterprise/nova-only component; its sources are only
+# synced when PROJECT=nova. Skip this step for community hubs.
+if [ "$PROJECT" = "nova" ] && [ "$EXPLICIT_ROLE" = "hub" ]; then
     run_step "03-mission-portal-deps" install_mission_portal_deps
 fi
 run_step "04-configure" "$BASEDIR/buildscripts/build-scripts/configure"
 run_step "05-compile" "$BASEDIR/buildscripts/build-scripts/compile"
 run_step "06-package" "$BASEDIR/buildscripts/build-scripts/package"
+run_step "07-masterfiles-tarballs" build_masterfiles_tarballs
 
 # === Copy output packages ===
 # Packages are created under $BASEDIR/<project>/ by dpkg-buildpackage / rpmbuild.
diff --git a/build-in-container.py b/build-in-container.py
index adc21fe68..0e79892df 100755
--- a/build-in-container.py
+++ b/build-in-container.py
@@ -474,7 +474,7 @@ def main():
         packages = (
             list(output_dir.glob("*.deb"))
             + list(output_dir.glob("*.rpm"))
-            + list(output_dir.glob("*.pkg.tar.gz"))
+            + list(output_dir.glob("*.tar.gz"))
         )
         if packages:
             log.info("Output packages:")
diff --git a/container/Dockerfile.debian b/container/Dockerfile.debian
index 5b2abdcf3..7b5db3cdf 100644
--- a/container/Dockerfile.debian
+++ b/container/Dockerfile.debian
@@ -17,9 +17,11 @@ RUN apt-get update && apt-get install -y ${NCURSES_PKGS} \
     && rm -rf /var/lib/apt/lists/*
 
 # Hub build tools: Node.js 20 LTS (system nodejs is too old for modern npm
-# packages that use the node: protocol), PHP, and Composer
+# packages that use the node: protocol), PHP, and Composer.
+# php-zip lets Composer extract --prefer-dist zip archives natively instead
+# of falling back to git clones (which leave non-reproducible .git dirs).
 RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
-    && apt-get install -y nodejs php-cli \
+    && apt-get install -y nodejs php-cli php-zip \
     && rm -rf /var/lib/apt/lists/*
 RUN npm install -g less
 RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/bin --filename=composer.phar