Install/Scan over SSH Tunnel?

We are in the process of segmenting our network, and have a few highly secure segments that require tunneling through a bastion host before hitting an end point. I am looking for (creative) solutions for maintaining the software, etc. on these computers. We currently use the PDQ suite and I would like to continue to do so, if possible.