diff --git a/scripts/harkaq/harkaq-farm-setup.sh b/scripts/harkaq/harkaq-farm-setup.sh
index 993eedce..b3ccdccc 100755
--- a/scripts/harkaq/harkaq-farm-setup.sh
+++ b/scripts/harkaq/harkaq-farm-setup.sh
@@ -51,7 +51,7 @@ $SSH "root@$IP" "cd $REMOTE &&
     printf 'ro /usr/lib/os-release\n' >> /root/.cache/harkaq/base.policy
     # Sondas de compilador de Alpine: se DENIEGAN y se clasifican (D3). Concederlas dejaría a
     # zig/configure usar el gcc de Alpine por detrás — justo lo que la campaña matar-gcc caza.
-    for p in /usr/bin/gcc /usr/bin/ldd /usr/bin/c89 /usr/bin/c99; do
+    for p in /usr/bin/gcc /usr/bin/ldd /usr/bin/c89 /usr/bin/c99 /usr/bin/cpp /usr/bin/getent; do
         printf '# expect %s\n' \"\$p\" >> /root/.cache/harkaq/base.policy
     done
     echo \"   runtime base: \$(grep -c '^ro ' /root/.cache/harkaq/base.policy) reglas + \$(grep -c '^# expect' /root/.cache/harkaq/base.policy) esperadas\""