Debian 11 ("bullseye") reached the end of its life on 31 August 2026, when its Long Term Support finished. Debian no longer releases security updates for it, so any new security hole found in it, or in the software it includes, stays open on your server. This guide shows you how to upgrade your VPS in place, one release at a time, from Debian 11 to Debian 12 ("bookworm") and then to Debian 13 ("trixie").

This guide is for VPSs running Debian 11 or Debian 12. If you're already on Debian 12, skip to Part 2.

Debian support dates

  • Debian 11: no longer supported since 31 August 2026.
  • Debian 12: regular security support ended in July 2026. The Debian LTS team now provides its security updates, until 30 June 2028.
  • Debian 13: the current stable release. It has full support until 9 August 2028, then Long Term Support until 30 June 2030.

Debian 12 is fine for now, but treat it as a stepping stone and aim to finish on Debian 13.

Why you shouldn't stay on Debian 11

  • New security holes in the kernel, OpenSSH, OpenSSL, your web server or PHP won't be fixed, which makes your server an easy target. A hacked server can be used to send spam or attack others, and its IP address can end up on blocklists.
  • Third-party software, such as Docker, Node.js and newer PHP versions, drops support for old releases, so you won't be able to install current versions.
  • The longer you wait, the bigger the jump, and the harder it is to fix problems along the way.

Some outside companies sell paid extended support for a subset of Debian 11 packages, but for most servers, upgrading is the right answer.

Upgrade in place, or reinstall?

Our Reinstallation tab offers Debian 12 and 13, but not Debian 11. Instead of two upgrades, you can copy your data off the server, reinstall with Debian 13, then set up your software again and restore your data. On an older server this is often cleaner. See Reinstall your VPS with a different operating system. Reinstalling erases everything on your VPS, so make sure you have copies of everything first.

Before you start

  • SSH access as root or as a user with sudo rights. If you're logged in as root, you can leave sudo off the commands.
  • A backup you can restore. A failed upgrade can leave your server unable to boot. If you have our VPS backup add-on, click Login To Panel on your VPS's management page and check you have a recent backup. If you don't have the add-on, you can add it with Upgrade/Downgrade in the left-hand menu, or copy your files and databases off the server yourself.
  • Enough free disk space. Check with df -h /. We suggest having at least 5 GB free.
  • Time, at a quiet moment. Allow an hour or more for each upgrade. Your websites and services will be interrupted.
  • One release at a time. Debian only supports upgrading to the next release. Go from 11 to 12, check everything works, then go from 12 to 13. Never skip straight from 11 to 13.
  • Use screen or tmux. Debian recommends running the upgrade inside screen or tmux, so it keeps going if your SSH connection drops. Install tmux with sudo apt install -y tmux, start a session with tmux new -s upgrade, and if you're disconnected, log back in and run tmux attach -t upgrade. See Keep commands running after you disconnect with screen and tmux.
  • Software versions change. From Debian 11 to 12 to 13, PHP goes from 7.4 to 8.2 to 8.4, Python from 3.9 to 3.11 to 3.13, MariaDB from 10.5 to 10.11 to 11.8, and PostgreSQL from 13 to 15 to 17. Check your apps support the new versions, and back up your databases first.
  • Third-party repositories. Debian recommends upgrading from a "pure" Debian system. You'll turn off third-party repositories, such as Docker or NodeSource, during the upgrade and set them up again afterwards.

Part 1: Debian 11 to Debian 12

Step 1: Update Debian 11 and reboot

sudo apt update
sudo apt full-upgrade
sudo reboot

When you're back in, check the version with cat /etc/debian_version. It should start with 11.

Step 2: Check for held packages and third-party sources

apt-mark showhold
ls /etc/apt/sources.list.d/

Release any held packages with sudo apt-mark unhold PACKAGE_NAME. If /etc/apt/sources.list.d/ contains files for third-party repositories, open each one with sudo nano and put a # at the start of every line to turn it off for now.

Step 3: Point APT at Debian 12

Keep a copy of your sources file, then replace bullseye with bookworm:

sudo cp /etc/apt/sources.list /root/sources.list.bullseye
sudo sed -i 's/bullseye/bookworm/g' /etc/apt/sources.list

Open the file with sudo nano /etc/apt/sources.list and check it. It should look something like this, with no lines left pointing to bullseye:

deb http://deb.debian.org/debian bookworm main
deb http://deb.debian.org/debian bookworm-updates main
deb http://security.debian.org/debian-security bookworm-security main
  • The non-free-firmware component: Debian 12 moved firmware packages into a new component called non-free-firmware. If your lines include non-free, add non-free-firmware after it, for example main contrib non-free non-free-firmware. Most VPSs don't need any non-free firmware, so if your lines only have main, you can leave them as they are.
  • If any line says stable or oldstable instead of a release name, change it to bookworm. "stable" now means Debian 13.

Step 4: Upgrade to Debian 12

Start your tmux session if you haven't already, then run:

sudo apt update
sudo apt upgrade --without-new-pkgs
sudo apt full-upgrade

The first upgrade command does a minimal upgrade, and full-upgrade completes it. Along the way:

  • You may see news about changed packages. Read it, then press q to carry on.
  • When asked whether to restart services during package upgrades without asking, choose Yes.
  • When asked about a configuration file you've changed, such as /etc/ssh/sshd_config, keep your currently installed version if you're not sure. This is the default (N). Press D to see the differences first.

If the upgrade stops with an error, read it carefully. You can usually fix the problem and run sudo apt full-upgrade again.

Step 5: Reboot and check

sudo reboot

Reconnect, then run:

cat /etc/debian_version
systemctl --failed

The version should start with 12. Remove packages that are no longer needed with sudo apt autoremove, and check your websites and apps work before you go on to Part 2.

Part 2: Debian 12 to Debian 13

Step 6: Bring Debian 12 fully up to date and reboot

sudo apt update
sudo apt full-upgrade
sudo reboot

Don't skip this. Debian warns that an older OpenSSH on Debian 12 can leave your server unreachable if an upgrade over SSH is interrupted. Check that openssh-server is version 1:9.2p1-2+deb12u7 or later:

dpkg -l openssh-server

Check for held packages and third-party sources again, as in Step 2. If you run MariaDB, Debian 13 moves it to a new major version, which only works reliably after a clean shutdown. Stop it, and check the log shows Shutdown complete:

sudo systemctl stop mariadb
sudo journalctl -u mariadb -n 20

Step 7: Point APT at Debian 13

Debian's package sources can be in the classic one-line format in /etc/apt/sources.list, or in the newer deb822 format in /etc/apt/sources.list.d/debian.sources. Check which you have:

ls /etc/apt/sources.list /etc/apt/sources.list.d/

Change bookworm to trixie in whichever files you have:

sudo cp /etc/apt/sources.list /root/sources.list.bookworm
sudo sed -i 's/bookworm/trixie/g' /etc/apt/sources.list

or, for the newer format:

sudo cp /etc/apt/sources.list.d/debian.sources /root/debian.sources.bookworm
sudo sed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/debian.sources

Check the result with sudo nano. No lines should still mention bookworm. In the newer format, Debian's release notes give this example:

Types: deb
URIs: https://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Types: deb
URIs: https://security.debian.org/debian-security
Suites: trixie-security
Components: main non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

Step 8: Upgrade to Debian 13

In your tmux session, run the same three commands as before:

sudo apt update
sudo apt upgrade --without-new-pkgs
sudo apt full-upgrade

Answer the prompts the same way as in Step 4.

Step 9: Reboot, check and tidy up

sudo reboot

Reconnect, then run:

cat /etc/debian_version
systemctl --failed
sudo apt autoremove

The version should start with 13. Debian 13 can also convert your package sources to the newer format for you with sudo apt modernize-sources. Finally, set up any third-party repositories again using each provider's current instructions for Debian 13 ("trixie"), then run sudo apt update.

Changes to know about in Debian 13

  • /tmp is now kept in memory after the reboot, and can use up to half your RAM. Files in /tmp and /var/tmp are also cleaned up automatically after a while. To keep /tmp on disk instead, run sudo systemctl mask tmp.mount and reboot.
  • /etc/sysctl.conf is no longer read. If you'd added settings there, move them to a file in /etc/sysctl.d/, such as /etc/sysctl.d/99-local.conf.
  • OpenSSH no longer supports DSA keys. If you still log in with one, set up a new Ed25519 key before you upgrade. See Set up SSH keys to log in to your VPS securely.

Troubleshooting

  • apt update shows errors for the bullseye repositories in Step 1: carry on to Step 3. Once your sources point to bookworm, the errors go away.
  • "Could not perform immediate configuration": run sudo apt full-upgrade -o APT::Immediate-Configure=0.
  • The upgrade was interrupted or packages are broken: run sudo dpkg --configure -a, then sudo apt --fix-broken install, then sudo apt full-upgrade again.
  • SSH doesn't come back after a reboot: wait a few minutes, then click Open Console on your VPS's management page and log in as root (see Use the web console to access your VPS). Check SSH with systemctl status ssh. If the server has no network, run ip addr and check the network interface name matches the one in /etc/network/interfaces.
  • A PHP website stopped working: the PHP version changed, so settings that point to the old version need updating. For example, an Nginx site that used /run/php/php8.2-fpm.sock on Debian 12 needs /run/php/php8.4-fpm.sock on Debian 13. Make sure the PHP packages your site needs are installed for the new version, for example with sudo apt install php-fpm php-mysql.
  • The server won't boot: use Open Console to see where it stops. If you can't fix it, restore your backup or reinstall.

Related guides

Need help?

Our Cloud VPS plans are self-managed, so you're responsible for installing, securing and maintaining the software on your server. If something on our side isn't working, such as the network, or your VPS won't boot, open a support ticket. New to your VPS? Start with our Cloud VPS Getting Started Guide.

Was this answer helpful? 0 Users Found This Useful (0 Votes)

Most Popular Articles

Where are your servers located?

We run our VPS platform from two datacentres: Auckland, New Zealand: DataVault, in Grafton...
Cloud VPS Getting Started Guide

Welcome to your Hoopla Hosting Cloud VPS. This page is the best place to start. It explains...
Should I move to a VPS? Web hosting vs Managed cPanel VPS vs Cloud VPS

Most websites run happily on web hosting. But as a site gets busier, or you need software that...
Find your VPS login details and IP address

To connect to your new VPS, you need three things: its IP address, the username, and the...
Manage your VPS from the client area

Every Hoopla Hosting VPS comes with a management page in the client area. From there you can...