diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a2e857c..4af1770 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -30,8 +30,10 @@ jobs:
           bash -n scripts/composer-wrapper.sh
           bash -n scripts/setup.sh
           php -l scripts/generate-dev-composer.php
+          php -l scripts/repair-bundle-installers.php
           php -l scripts/verify-dev-composer-lock.php
           php tests/generate-dev-composer-test.php
+          php tests/setup-order-test.php
 
   build:
     needs: validate
diff --git a/scripts/repair-bundle-installers.php b/scripts/repair-bundle-installers.php
new file mode 100644
index 0000000..2387226
--- /dev/null
+++ b/scripts/repair-bundle-installers.php
@@ -0,0 +1,97 @@
+#!/usr/bin/env php
+<?php
+
+declare(strict_types=1);
+
+use Pimcore\Bootstrap;
+use Pimcore\Bundle\ApplicationLoggerBundle\Installer as ApplicationLoggerInstaller;
+use Pimcore\Bundle\DataHubBundle\Installer as DataHubInstaller;
+use Pimcore\Bundle\DataImporterBundle\Installer as DataImporterInstaller;
+use Pimcore\Cache;
+use Pimcore\Db;
+use Pimcore\Model\User\Permission\Definition;
+
+$autoload = getcwd() . '/vendor/autoload.php';
+
+if (!is_file($autoload)) {
+    fwrite(STDERR, "Run this repair from the Pimcore project root.\n");
+    exit(1);
+}
+
+require $autoload;
+
+if (!defined('PIMCORE_CONSOLE')) {
+    define('PIMCORE_CONSOLE', true);
+}
+
+Bootstrap::setProjectRoot();
+$kernel = Bootstrap::startupCli();
+
+try {
+    $container = $kernel->getContainer();
+    $repairedBundles = [];
+
+    /** @var DataHubInstaller $dataHubInstaller */
+    $dataHubInstaller = $container->get(DataHubInstaller::class);
+
+    if ($dataHubInstaller->isInstalled() && dataHubInstallerArtifactsMissing()) {
+        fwrite(STDOUT, "Repairing PimcoreDataHubBundle installer state\n");
+        $dataHubInstaller->install();
+        $repairedBundles[] = 'PimcoreDataHubBundle';
+    }
+
+    /** @var DataImporterInstaller $dataImporterInstaller */
+    $dataImporterInstaller = $container->get(DataImporterInstaller::class);
+    /** @var ApplicationLoggerInstaller $applicationLoggerInstaller */
+    $applicationLoggerInstaller = $container->get(ApplicationLoggerInstaller::class);
+
+    $dataImporterPermissionMissing =
+        Definition::getByKey(DataImporterInstaller::DATAHUB_ADAPTER_PERMISSION) === null;
+
+    if (
+        $dataImporterInstaller->isInstalled()
+        && ($dataImporterPermissionMissing || !$applicationLoggerInstaller->isInstalled())
+    ) {
+        fwrite(STDOUT, "Repairing PimcoreDataImporterBundle installer state\n");
+        $dataImporterInstaller->install();
+        $repairedBundles[] = 'PimcoreDataImporterBundle';
+    }
+
+    if ($repairedBundles !== []) {
+        Cache::remove('studio_backend_user_permissions');
+        fwrite(
+            STDOUT,
+            sprintf(
+                "Repaired bundle installer state: %s; cleared studio_backend_user_permissions\n",
+                implode(', ', $repairedBundles)
+            )
+        );
+    } else {
+        fwrite(STDOUT, "Bundle installer state is consistent; no repair required\n");
+    }
+} finally {
+    $kernel->shutdown();
+}
+
+function dataHubInstallerArtifactsMissing(): bool
+{
+    if (Definition::getByKey(DataHubInstaller::CONFIG_NAME) === null) {
+        return true;
+    }
+
+    $db = Db::get();
+
+    foreach (['document', 'asset', 'object'] as $type) {
+        $table = 'plugin_datahub_workspaces_' . $type;
+        $exists = (int) $db->fetchOne(
+            'SELECT COUNT(*) FROM information_schema.tables WHERE table_schema = DATABASE() AND table_name = ?',
+            [$table]
+        );
+
+        if ($exists === 0) {
+            return true;
+        }
+    }
+
+    return false;
+}
diff --git a/scripts/setup.sh b/scripts/setup.sh
index 159564f..ad17451 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -205,7 +205,10 @@ install -d -o developer -g www-data -m 0775 \
 
 chmod -R g+rwX "$app_dir/var" "$app_dir/public/var"
 
+pimcore_was_installed=0
+
 if is_pimcore_installed; then
+    pimcore_was_installed=1
     printf '%s\n' '==> Pimcore core already installed'
 else
     : "${PIMCORE_PRODUCT_KEY:?PIMCORE_PRODUCT_KEY is required for the initial Pimcore installation}"
@@ -227,8 +230,13 @@ fi
 printf '%s\n' '==> Warming development container'
 run_console cache:warmup
 
-printf '%s\n' '==> Running Doctrine migrations'
-run_console doctrine:migrations:migrate --no-interaction
+if (( pimcore_was_installed )); then
+    printf '%s\n' '==> Checking legacy bundle installer state'
+    (
+        cd "$app_dir"
+        run_dev php /opt/aggro/repair-bundle-installers.php
+    )
+fi
 
 printf '%s\n' '==> Installing application bundles'
 install_bundle PimcoreDataHubBundle
@@ -239,7 +247,7 @@ install_bundle AggrosoftPimcoreShopwareBundle
 install_bundle AggrosoftPimcoreShirtnetworkBundle
 install_bundle AggrosoftPimcoreAgentBundle
 
-printf '%s\n' '==> Running remaining migrations'
+printf '%s\n' '==> Running Doctrine migrations'
 run_console doctrine:migrations:migrate --no-interaction
 
 printf '%s\n' '==> Applying idempotent application model upgrades'
diff --git a/tests/setup-order-test.php b/tests/setup-order-test.php
new file mode 100644
index 0000000..6628260
--- /dev/null
+++ b/tests/setup-order-test.php
@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+$setup = file_get_contents(__DIR__ . '/../scripts/setup.sh');
+
+if ($setup === false) {
+    fwrite(STDERR, "Could not read scripts/setup.sh\n");
+    exit(1);
+}
+
+$position = static function (string $needle) use ($setup): int {
+    $position = strpos($setup, $needle);
+
+    if ($position === false) {
+        fwrite(STDERR, sprintf("Missing expected setup step: %s\n", $needle));
+        exit(1);
+    }
+
+    return $position;
+};
+
+$coreInstall = $position('vendor/bin/pimcore-install');
+$repair = $position('repair-bundle-installers.php');
+$dataHubInstall = $position('install_bundle PimcoreDataHubBundle');
+$dataImporterInstall = $position('install_bundle PimcoreDataImporterBundle');
+$lastApplicationBundleInstall = $position('install_bundle AggrosoftPimcoreAgentBundle');
+$migrations = $position('run_console doctrine:migrations:migrate --no-interaction');
+
+if (!($coreInstall < $repair)) {
+    fwrite(STDERR, "Legacy repair must run after the Pimcore core installation block.\n");
+    exit(1);
+}
+
+if (!($repair < $dataHubInstall && $dataHubInstall < $dataImporterInstall)) {
+    fwrite(STDERR, "DataHub and Data Importer installers are in the wrong order.\n");
+    exit(1);
+}
+
+if (!($dataImporterInstall < $lastApplicationBundleInstall && $lastApplicationBundleInstall < $migrations)) {
+    fwrite(STDERR, "All application bundle installers must run before Doctrine migrations.\n");
+    exit(1);
+}
+
+if (substr_count($setup, 'doctrine:migrations:migrate') !== 1) {
+    fwrite(STDERR, "Expected exactly one global Doctrine migration pass.\n");
+    exit(1);
+}
+
+fwrite(STDOUT, "setup order ok\n");