diff --git a/hooks/boot/01-kafo-hook-extensions.rb b/hooks/boot/01-kafo-hook-extensions.rb
index b1be23539..a09a79f3b 100644
--- a/hooks/boot/01-kafo-hook-extensions.rb
+++ b/hooks/boot/01-kafo-hook-extensions.rb
@@ -31,6 +31,20 @@ def ensure_packages(packages, state = 'installed')
     end
   end
 
+  def ensure_dnf_module(dnf_module, version)
+    code = "package { ['#{dnf_module}']: ensure => #{version}, enable_only => true, provider => 'dnfmodule' }"
+    logger.info("Ensuring #{dnf_module}:#{version} is enabled")
+    stdout, stderr, status = apply_puppet_code(code)
+
+    unless [0, 2].include?(status.exitstatus)
+      log_and_say(:error, "Failed to ensure #{dnf_module}:#{version} is enabled")
+      log_and_say(:error, stderr.strip) if stderr && stderr.strip
+      logger.debug(stdout.strip) if stdout && stdout.strip
+      logger.debug("Exit status is #{status.exitstatus.inspect}")
+      exit(1)
+    end
+  end
+
   def apply_puppet_code(code)
     bin_path = Kafo::PuppetCommand.search_puppet_path('puppet')
     Open3.capture3(*Kafo::PuppetCommand.format_command("echo \"#{code}\" | #{bin_path} apply --detailed-exitcodes"))
@@ -93,6 +107,10 @@ def el7?
     facts[:os][:release][:major] == '7' && facts[:os][:family] == 'RedHat'
   end
 
+  def el8?
+    facts[:os][:release][:major] == '8' && facts[:os][:family] == 'RedHat'
+  end
+
   def log_and_say(level, message, do_say = true, do_log = true)
     style = case level
             when :error
diff --git a/hooks/pre/40-el8_modules.rb b/hooks/pre/40-el8_modules.rb
new file mode 100644
index 000000000..776fdca12
--- /dev/null
+++ b/hooks/pre/40-el8_modules.rb
@@ -0,0 +1,7 @@
+if (module_enabled?('katello') || module_enabled?('foreman_proxy_content')) && el8?
+  ensure_dnf_module('pki-core', 'present')
+
+  if local_postgresql?
+    ensure_dnf_module('postgresql', '12')
+  end
+end