How to Upgrade Debian 12 "Bookworm" to Debian 13 "Trixie"

sudo apt update && sudo apt full-upgrade
sudo sed -i 's/bookworm/trixie/g' /etc/apt/sources.list
sudo sed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/*.sources
sudo apt update
sudo apt upgrade --without-new-pkgs
sudo apt full-upgrade
sudo reboot

Before you start: pre-checks

Debian upgrades are reliable when the starting system is clean. These checks follow the official trixie release notes.

1. Back up

Back up /etc, /home, any databases and /var/lib/dpkg. On a VM, take a snapshot — it is the only true rollback. A quick system-state backup:

sudo tar czf ~/pre-trixie-etc.tar.gz /etc /var/lib/dpkg /var/lib/apt/extended_states
dpkg --get-selections '*' > ~/pre-trixie-packages.txt

2. Confirm you are on a fully updated Debian 12

cat /etc/debian_version
sudo apt update
sudo apt full-upgrade
sudo reboot

Example output of the first command: 12.x, any 12 point release is fine. If it shows 11.x, upgrade to bookworm first; Debian does not support skipping a release.

3. Check package health

# half-installed or unconfigured packages: should print nothing
sudo dpkg --audit
# held packages block the upgrade of anything that depends on them
apt-mark showhold
# packages not from Debian (third-party, manual .deb)
apt list '?narrow(?installed, ?not(?origin(Debian)))'
# installed packages no longer available from any repository
apt list '~o'

Release holds with sudo apt-mark unhold PACKAGE. Non-Debian packages are the main cause of "held broken packages" errors during the upgrade; remove the ones you can reinstall later.

4. Free disk space

df -h / /boot /var
sudo apt autoremove
sudo apt clean

A desktop upgrade downloads around 2–3 GB into /var/cache/apt/archives. Keep at least 5 GB free on the filesystem holding /var, and make sure /boot has room for one more kernel and initramfs. If space is tight, see No space left on device.

5. Over SSH: use tmux or screen

sudo apt install tmux
tmux new -s upgrade
# reattach after a dropped connection
tmux attach -t upgrade

A dropped SSH session kills a running apt, which leaves dpkg half-configured. Make sure you have console access (IPMI, VM console) in case networking changes during the upgrade.

Step 1: handle third-party repositories

Disable every non-Debian repository before switching to trixie, then re-enable each one after the upgrade once its vendor supports Debian 13. Look in both locations:

grep -rn '^deb\|^URIs\|^Suites' /etc/apt/sources.list /etc/apt/sources.list.d/

To disable a repository:

• Classic .list file: comment out the line with a leading #.
• deb822 .sources file: add the line Enabled: no to the stanza.

Signed-by keys keep working; you do not need to re-import them. If a repo later reports NO_PUBKEY, see fix NO_PUBKEY.

Step 2: point APT at trixie

Debian 12 installs use either the classic /etc/apt/sources.list or deb822 files in /etc/apt/sources.list.d/. Check which one you have, then replace the codename:

cat /etc/apt/sources.list
ls /etc/apt/sources.list.d/
sudo cp -a /etc/apt/sources.list /etc/apt/sources.list.bookworm
sudo sed -i 's/bookworm/trixie/g' /etc/apt/sources.list
# only if you have deb822 files for the Debian repositories
sudo sed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/debian.sources

A correct classic sources.list for trixie looks like this:

deb http://deb.debian.org/debian trixie main contrib non-free non-free-firmware
deb http://deb.debian.org/debian trixie-updates main contrib non-free non-free-firmware
deb http://security.debian.org/debian-security trixie-security main contrib non-free non-free-firmware

Keep only the components you used before; non-free-firmware is where Wi-Fi and GPU firmware live. Do not use stable instead of trixie: with stable your machine would jump to Debian 14 "forky" automatically when it is released.

Step 3: minimal upgrade, then full upgrade

Record the session so you can review errors later (optional, recommended by Debian):

script -t 2>~/upgrade-trixie.time -a ~/upgrade-trixie.script

Then run the upgrade in two stages:

sudo apt update
sudo apt upgrade --without-new-pkgs
sudo apt full-upgrade

The first stage upgrades what it can without installing or removing anything, which reduces the chance of the resolver removing something important. The second stage completes the upgrade, pulling in new dependencies and removing obsolete packages. Read the removal list before you confirm: if it wants to remove your desktop meta-package (for example task-gnome-desktop) or a major service, stop and look for the third-party package that causes it.

During the upgrade you will see:

• Configuration file prompts ("Configuration file '/etc/...' modified... keep your currently-installed version?"). Press D to see the difference. If unsure, keep your version (N, the default); the new file is saved as .dpkg-dist to compare later.
• Service restart questions from needrestart or debconf. Accepting the defaults is safe.
• apt-listchanges news. Read anything flagged as important, then press q.

When it finishes, reboot:

sudo reboot

Step 4: verify and clean up

cat /etc/debian_version
uname -r
# should report no broken packages
sudo apt full-upgrade
sudo apt autoremove
# leftover obsolete packages from bookworm
apt list '~o'
# config files that got a new default version
sudo find /etc -name '*.dpkg-dist' -o -name '*.dpkg-old' -o -name '*.ucf-dist'

Example output of cat /etc/debian_version: 13.x. Optionally convert your sources to the deb822 format that new trixie installs use:

sudo apt modernize-sources

Now re-enable third-party repositories one at a time, changing their suite to trixie where needed, and run sudo apt update after each.

What changes in Debian 13 that can surprise you

• APT 3.0 with a new, colour-coded output layout. Commands are the same.
• Linux 6.12 LTS kernel, plus newer GNOME and KDE Plasma 6 on desktops. KDE users go from Plasma 5 to Plasma 6, so expect some widgets and themes to need replacing (see the KDE Plasma guide).
• /tmp is a tmpfs (in RAM) on new installs and files there are cleaned up periodically. Upgraded systems can get it too. Do not keep anything in /tmp you need; to keep it on disk, run sudo systemctl mask tmp.mount.
• 32-bit PC (i386) is no longer a supported install architecture. Upgrading an i386 system is not supported; reinstall as amd64 if the CPU is 64-bit.
• OpenSSH dropped DSA keys. If you still log in with an ssh-dss key, switch to Ed25519 before upgrading the server (see SSH keys).

The release notes' issues to be aware of page lists the rest; read it before upgrading a server.

When the upgrade fails: recovery

The upgrade stopped half-way

If the connection dropped, power failed or a package script errored, finish the job; do not revert the sources first:

sudo dpkg --configure -a
sudo apt --fix-broken install
sudo apt full-upgrade

These configure unpacked packages, resolve missing dependencies and then complete the upgrade. For specific messages see dpkg was interrupted and dpkg returned an error code (1).

Unmet dependencies or "held broken packages"

# show why a package cannot be installed
apt-cache policy PACKAGE
sudo apt install PACKAGE
# the usual culprits: non-Debian packages still installed
apt list '?narrow(?installed, ?not(?origin(Debian)))'

Remove the offending third-party package (sudo apt remove PACKAGE), then rerun sudo apt full-upgrade.

The system does not boot after the upgrade

1. At the GRUB menu choose Advanced options for Debian and pick the older 6.1 kernel. Bookworm's kernel stays installed until you remove it.
2. If the desktop fails but the system boots, press Ctrl+Alt+F3, log in and run the commands in the previous section. Proprietary NVIDIA drivers often need sudo apt install --reinstall nvidia-driver after a kernel change.
3. If the boot drops to "You are in emergency mode", see emergency mode fix; it is usually an /etc/fstab entry.
4. If GRUB itself is broken, boot a Debian live USB and follow fix grub rescue.

Rolling back

Debian has no supported downgrade path. Restore your VM snapshot, an LVM or Btrfs snapshot, or reinstall Debian 12 and restore /etc and /home from backup. Putting bookworm back in sources.list does not downgrade packages and usually makes things worse.

Upgrade paths

The same process works for LMDE 6 to LMDE 7, though Mint publishes its own upgrade tool for that; and Ubuntu users should follow upgrade Ubuntu instead, because Ubuntu uses do-release-upgrade.

Frequently asked questions