diff --git a/scripts/dev/upstream_merge/install_tools.sh b/scripts/dev/upstream_merge/install_tools.sh
new file mode 100755
index 000000000..29d8d8471
--- /dev/null
+++ b/scripts/dev/upstream_merge/install_tools.sh
@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+: "${TOOLS_DIR:?TOOLS_DIR environment variable is not set}"
+
+required_cmds=(jq curl tar sha256sum perl mktemp grep)
+for cmd in "${required_cmds[@]}"; do
+    if ! command -v "$cmd" >/dev/null; then
+        echo "Required command '$cmd' is missing on the agent." >&2
+        exit 1
+    fi
+done
+
+cwd="$(pwd -P)"
+parent="${cwd%/*}"
+[[ -z "$parent" ]] && parent="/"
+
+mkdir -p -- "$TOOLS_DIR"
+TOOLS_DIR="$(cd -P -- "$TOOLS_DIR" && pwd -P)"
+
+if [[ "$TOOLS_DIR" == "/" || "$TOOLS_DIR" == "$cwd" || "$TOOLS_DIR" == "$parent" ]]; then
+    echo "Refusing to use unsafe TOOLS_DIR: $TOOLS_DIR" >&2
+    exit 1
+fi
+
+rm -rf -- "$TOOLS_DIR"
+mkdir -p -- "$TOOLS_DIR"
+
+export PATH="$TOOLS_DIR:$PATH"
+
+echo "Installing git-send-email..."
+
+GIT_SEND_EMAIL_SHA256=15094e3fc8cfbe7931a9aceac99bdc82537d42d3be67ee90518b2371fc7869bf
+
+curl \
+    --fail \
+    --location \
+    --show-error \
+    --connect-timeout 30 \
+    --max-time 300 \
+    https://raw.githubusercontent.com/git/git/v2.44.0/git-send-email.perl \
+    -o "$TOOLS_DIR/git-send-email"
+
+echo "${GIT_SEND_EMAIL_SHA256}  ${TOOLS_DIR}/git-send-email" \
+    | sha256sum -c -
+
+chmod +x "$TOOLS_DIR/git-send-email"
+
+echo "Installing GitHub CLI..."
+
+ARCH=$(uname -m)
+
+case "$ARCH" in
+    x86_64)
+        GH_ARCH=amd64
+        ;;
+    aarch64|arm64)
+        GH_ARCH=arm64
+        ;;
+    *)
+        echo "Unsupported architecture: $ARCH" >&2
+        exit 1
+        ;;
+esac
+
+readonly GH_VERSION="2.47.0"
+
+workdir="$(mktemp -d)"
+cleanup() {
+    rm -rf -- "$workdir"
+}
+trap cleanup EXIT
+
+cd -- "$workdir"
+
+curl \
+    --fail \
+    --location \
+    --show-error \
+    --connect-timeout 30 \
+    --max-time 300 \
+    -o gh.tar.gz \
+    "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${GH_ARCH}.tar.gz"
+
+curl \
+    --fail \
+    --location \
+    --show-error \
+    --connect-timeout 30 \
+    --max-time 300 \
+    -o checksums.txt \
+    "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_checksums.txt"
+
+grep -F "gh_${GH_VERSION}_linux_${GH_ARCH}.tar.gz" checksums.txt \
+    | sha256sum -c -
+
+tar -xzf gh.tar.gz
+
+cp \
+    "gh_${GH_VERSION}_linux_${GH_ARCH}/bin/gh" \
+    "$TOOLS_DIR/gh"
+
+chmod +x "$TOOLS_DIR/gh"
+
+command -v git-send-email >/dev/null
+command -v gh >/dev/null
+
+gh --version
+
+echo "All required tools are ready."
\ No newline at end of file