diff --git a/Brewfile b/Brewfile
index bc36dbd09223f4..d5c52c0f4a5bd1 100644
--- a/Brewfile
+++ b/Brewfile
@@ -9,6 +9,8 @@ brew 'qemu'
 brew 'docker'
 brew 'docker-buildx'
 
+### If updating below this line, please also update REQUIRED_APT_PKGS in devenv/post_fetch.py ###
+
 # required for pnpm test -u
 brew 'watchman'
 
diff --git a/devenv/post_fetch.py b/devenv/post_fetch.py
index 590bb4ace44be4..095ea94afa32d7 100644
--- a/devenv/post_fetch.py
+++ b/devenv/post_fetch.py
@@ -1,12 +1,66 @@
 from __future__ import annotations
 
 import configparser
+import shutil
+import subprocess
+
+from devenv import constants
+from devenv.lib import proc
+
+# we only support apt-based linuxes
+LINUX = shutil.which("dpkg") is not None
+
+# these are the subset of requirements from the Brewfile that are necessary on linux
+REQUIRED_APT_PKGS = ["watchman", "chromium-chromedriver"]
+
+
+def dpkg_is_installed(pkg: str) -> bool:
+    try:
+        out = subprocess.check_output(
+            ["dpkg-query", "-W", "-f=${Status}", pkg],
+            stderr=subprocess.DEVNULL,
+            text=True,
+        ).strip()
+    except subprocess.CalledProcessError:
+        return False
+
+    # <want> <error> <status>
+    return out == "install ok installed"
+
+
+def dpkgs_not_installed(pkgs: list[str]) -> list[str]:
+    return [pkg for pkg in pkgs if not dpkg_is_installed(pkg)]
 
 
 def main(context: dict[str, str]) -> int:
-    # post_fetch is meant for recommended but not required defaults
     reporoot = context["reporoot"]
 
+    if constants.DARWIN:
+        print("Installing sentry's brew dependencies...")
+        if constants.CI:
+            # Installing everything from brew takes too much time,
+            # and chromedriver cask flakes occasionally. Really all we need to
+            # set up the devenv is colima and docker-cli.
+            # This is also required for arm64 macOS GHA runners.
+            # We manage colima, so just need to install docker + qemu here.
+            proc.run(("brew", "install", "docker", "qemu"))
+        else:
+            proc.run(
+                (f"{constants.homebrew_bin}/brew", "bundle"),
+                cwd=reporoot,
+            )
+    elif LINUX:
+        if not constants.CI:
+            not_installed = dpkgs_not_installed(REQUIRED_APT_PKGS)
+            if not_installed:
+                raise SystemExit(
+                    f"Please install the following apt packages: {' '.join(not_installed)}"
+                )
+    else:
+        print(
+            f"Unsupported platform; assuming you have the equivalent of the following apt packages installed: {' '.join(REQUIRED_APT_PKGS)}"
+        )
+
     git_config = configparser.ConfigParser()
     git_config.read(f"{reporoot}/.git/config")
     git_config["blame"] = {"ignoreRevsFile": ".git-blame-ignore-revs"}
diff --git a/setup.cfg b/setup.cfg
index f3783b6e4d7069..81141bb460228e 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -97,7 +97,7 @@ extend-ignore = E203,E501,E402,E731,B007,B009,B010,B011,B020,B023,B024,B026,B027
 per-file-ignores =
     # these scripts must have minimal dependencies so opt out of the usual sentry rules
     .github/*: S
-    devenv/sync.py: S
+    devenv/*.py: S
     src/sentry/build/*: S
     tools/*: S
     # testing the options manager itself