How to upgrade Debian 12 to Debian 13

A Debian release upgrade changes the operating system's core packages. APT upgrades Debian 12 to Debian 13 while you keep a recovery path and check the upgraded system after reboot.

Debian supports release upgrades one stable release at a time. Debian 12 bookworm upgrades directly to Debian 13 trixie, the current stable release. Debian 14 forky remains testing, so a Debian 13 to 14 upgrade is not yet a stable-release upgrade path.

APT sources should use the codenames bookworm and trixie rather than moving names such as stable or oldstable. Third-party repositories and package pinning can prevent a consistent release upgrade. A local console or a persistent terminal session protects the upgrade process if an SSH connection drops. For routine package updates that keep the same Debian release, use How to upgrade packages on Debian with apt instead.

Steps to upgrade Debian 12 to Debian 13:

Confirm that the installed system is Debian 12.
```
$ cat /etc/debian_version
12.15
```
Systems on older releases need each intermediate release upgrade first. Debian 13 does not support upgrading i386 or MIPS installations, as the Trixie release issues explain.
Confirm that the system has a restorable backup and a recovery path outside the upgraded operating system.

Replacing packages and rebooting can interrupt services or leave the system unbootable. The backup needs the data and configuration required to restore the working Debian 12 system, including /etc, /var/lib/dpkg, and /var/lib/apt/extended_states. Restoring that backup is the recovery path; changing APT sources back does not undo the upgrade. Do not start a remote release upgrade when SSH is the only recovery path.

Related: How to boot Debian rescue mode
Use a local console or a persistent terminal session for the upgrade.

A screen or tmux session started before the upgrade keeps APT running if an SSH connection drops.

Keep a package selection record with the backup.

$ dpkg --get-selections '*' > ~/debian-package-selections.txt

Save the current APT configuration before editing release sources.
```
$ sudo cp -a /etc/apt /root/apt-before-release-upgrade
```

Check available disk space.

$ df -h
Filesystem      Size  Used Avail Use% Mounted on
udev            1.9G     0  1.9G   0% /dev
tmpfs           393M  668K  392M   1% /run
/dev/vda1        24G  736M   22G   4% /
tmpfs           2.0G     0  2.0G   0% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
efivarfs        256K  4.2K  252K   2% /sys/firmware/efi/efivars
/dev/vda15      127M   13M  115M  10% /boot/efi
tmpfs           393M     0  393M   0% /run/user/1000

The upgrade needs room on the filesystems that hold /, /usr, and /var. A separate /boot partition should be at least 768 MB with about 300 MB free, according to Debian's release notes.
Related: How to clean up disk space on Debian

Refresh the Bookworm package index.
```
$ sudo apt update
```
The enabled Debian suites should still name bookworm, because a moving alias such as stable can already point at Debian 13.
Bring Bookworm fully up to date before switching codenames.
```
$ sudo apt full-upgrade
```
If this installs a new kernel or low-level system package, a reboot into the updated Bookworm system is appropriate before continuing.
Install the current Debian archive keyring and certificate store.
```
$ sudo apt install ca-certificates debian-archive-keyring
```
Minimal systems without ca-certificates can fail certificate verification when using HTTPS archive entries.
Check for broken package states before editing sources.
```
$ dpkg --audit
```
No output means dpkg found no package-state problems. Do not continue with packages awaiting configuration or reporting errors.
Check for held packages before changing releases.
```
$ apt-mark showhold
```
No output means no packages are held by apt-mark. If a hold blocks a required upgrade, it needs a deliberate decision before proceeding.
Related: How to hold a Debian package
Disable third-party repositories, backports, proposed updates, and release-specific APT pinning before the release change.

Repository entries are in /etc/apt/sources.list and /etc/apt/sources.list.d. A leading # disables a .list entry, and Enabled: no disables a .sources stanza. Pinning is in /etc/apt/preferences and /etc/apt/preferences.d. Disabling a repository does not remove its installed packages.
Related: How to remove an APT repository on Debian

Replace the active Debian archive entries with the Trixie entries.

$ sudoedit /etc/apt/sources.list.d/debian.sources

Types: deb
URIs: https://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 
Types: deb
URIs: https://security.debian.org/debian-security
Suites: trixie-security
Components: main non-free-firmware
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg

If the file is new, enter the shown contents as its complete contents. Keep contrib or non-free in the Components lines when the system already uses those components. Other stanzas in the file stay as they are. No bookworm entry should stay active anywhere, including in /etc/apt/sources.list.

Refresh APT metadata from the target release.

$ sudo apt update
##### snipped #####
Get:1 https://security.debian.org/debian-security trixie-security InRelease [43.4 kB]
Get:2 https://deb.debian.org/debian trixie InRelease [140 kB]
Get:3 https://deb.debian.org/debian trixie-updates InRelease [47.3 kB]
##### snipped #####
283 packages can be upgraded. Run 'apt list --upgradable' to see them.

Every Debian repository line should name a trixie suite. A bookworm line means an old entry is still active; APT refreshes it without any error, so its absence has to be read from this output.

Certificate, signature, or missing-release errors must be resolved before any package upgrade.

Estimate the release upgrade's space requirements without accepting package changes.
```
$ sudo apt full-upgrade --assume-no
##### snipped #####
283 upgraded, 79 newly installed, 21 to remove and 0 not upgraded.
Need to get 146 MB of archives.
After this operation, 165 MB of additional disk space will be used.
Do you want to continue? [Y/n] N
Abort.
```
The --assume-no option declines the prompt, so the Abort. line is expected and no packages change. The Need to get size should fit in the free space for /var, and the additional disk space should fit in the free space for / and /usr. If APT stops with a resolver error instead of this summary, repeat the estimate after the minimal upgrade. Debian's space guidance lists ways to free room.
Run the minimal upgrade phase.
```
$ sudo apt upgrade --without-new-pkgs
```
This phase upgrades packages that do not need new package installs or removals. Held-back packages are expected here. Locally modified files can trigger configuration prompts.
Run the full release upgrade.

The confirmation prompt lists removals and disk-space requirements before installation. Do not accept removals that would delete required services, drivers, kernels, or vendor packages without a confirmed replacement path. Services can restart during installation.
```
$ sudo apt full-upgrade
```
Reboot into the upgraded system.

The reboot disconnects remote sessions. Console access provides recovery if networking or booting fails. Debian warns that network interface names can change on this reboot, and systems with encrypted filesystems need the systemd-cryptsetup package installed first.

An arm64 VM built from a cloud.debian.org image can need Debian's manual boot loader steps before this reboot.
```
$ sudo reboot
```
Refresh APT metadata on the upgraded system.
```
$ sudo apt update
```
A new SSH login also shows that remote access works again. The enabled Debian archives should report trixie, trixie-updates, and trixie-security without repository errors.

Check for failed systemd units.

$ systemctl --failed
  UNIT LOAD ACTIVE SUB DESCRIPTION

0 loaded units listed.

A healthy result lists zero failed units.

Test each essential application through its normal client.

A web request or a database connection tests the service beyond its unit state. Unexpected errors need resolving before removing old packages.
Check that the system is running the Debian 13 kernel.
```
$ uname -r
6.12.115+deb13.1-cloud-arm64
```
A 6.12 release is the Debian 13 kernel. A 6.1 release means the system booted the old Bookworm kernel, and the Debian kernel upgrade instructions explain how to choose a kernel metapackage.
Review packages that APT no longer needs before confirming their removal.

Removal deletes the listed packages. An old kernel can still be useful for recovery, so do not remove the only fallback before the new kernel and services work.
Related: How to clean up disk space on Debian
```
$ sudo apt autoremove
```
Check for obsolete or locally created packages that still need an owner decision.
```
$ apt list '?obsolete'
```
Listed packages are installed but unavailable from the enabled repositories. A local package or an older recovery kernel can be intentional; the list is not an instruction to purge everything.
Confirm that the rebooted system identifies itself as Debian 13.
```
$ cat /etc/debian_version
13.7
```

Written by

Mohd Shakir Zakaria

Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.