Debian 11 end of life: what to do now
Debian 11 "bullseye" reached the end of its Long Term Support on 31 August 2026. Debian sends no more security updates for it. Here are the options, and the safest way to Debian 13.
- Debian LTS
- Ended 31 Aug 2026, 67 days ago
- Paid Extended LTS
- Freexian, to June 2031, some packages
- Move to
- Debian 13, supported to June 2030
- Path
- 11 → 12 → 13 in place, or a rebuild on 13
What end of life means for bullseye
Debian 11 had already left regular security support in August 2024. Since then, the volunteer and sponsored LTS team kept the important packages patched. On 31 August 2026 that ended too, and from September Debian releases nothing more for bullseye.
The servers keep running, and apt still installs from the archive. But every flaw found from now on in the kernel, OpenSSH, OpenSSL, the web server, PHP or the database stays open.
Bullseye also ships PHP 7.4, which the PHP project stopped patching in 2022. Debian kept it patched while bullseye was supported, but scanners and customers flag it on sight.
Your options
| Option | What it costs | What you get | When it fits |
|---|---|---|---|
| Freexian Extended LTS | A paid subscription, priced by the packages and servers covered | Security fixes to June 2031, for the packages customers sponsor | A server that can't move yet, where the packages you need are covered |
| Upgrade in place | Two planned windows: 11 → 12, then 12 → 13 | The same server, IP and data, on Debian 13 to June 2030 | A well-kept server with few third-party repositories |
| Rebuild on Debian 13 | A new server running alongside the old one for a few days | A clean install, built from a written recipe, with the old server kept as the way back | Servers with years of changes on them, or one nobody fully understands any more |
Dates from debian.org and Freexian, read 6 November 2026.
What changes on the way to Debian 13
These are the changes that break things, release by release.
| Package | 11 | 12 | 13 | What to watch |
|---|---|---|---|---|
| PHP | 7.4 | 8.2 | 8.4 | The biggest job on most web servers. PHP 7.4 code needs fixing for PHP 8, and older WordPress plugins and frameworks fail. See the PHP 8.2 page for the steps. |
| Python | 3.9 | 3.11 | 3.13 | Virtualenvs must be rebuilt. From Debian 12, pip install outside a virtualenv is blocked. |
| MariaDB | 10.5 | 10.11 | 11.8 | Take a dump before each step, and test the application's queries on the new version. |
| PostgreSQL | 13 | 15 | 17 | The old cluster keeps running on the old version after the upgrade. Move it with pg_upgradecluster, after a backup. |
| OpenSSL | 1.1.1 | 3.0 | 3.5 | Old ciphers and SHA-1 certificates are refused. Old payment gateways, APIs and database servers can stop connecting. |
| OpenSSH | 8.4 | 9.2 | 10.0 | Debian 12 turns off ssh-rsa (SHA-1) signatures, and Debian 13 removes DSA keys entirely. Old deploy tools and SFTP clients can fail to log in. |
| Kernel | 5.10 | 6.1 | 6.12 | Out-of-tree drivers and old firmware need checking. Debian 12 moved firmware to a new non-free-firmware section. |
| apt sources | sources.list | sources.list | deb822 option | Debian 13 can convert the sources to the newer format with apt modernize-sources. Third-party repositories need their bookworm and trixie versions either way. |
Before you upgrade
Find every Debian 11 server. cat /etc/debian_version on each one: anything starting with 11 is bullseye.
List what came from outside Debian. grep -r ^deb /etc/apt/sources.list /etc/apt/sources.list.d/, and apt list '?narrow(?installed, ?not(?origin(Debian)))' for installed packages that didn't come from Debian.
Check held packages and space. apt-mark showhold lists anything pinned. Leave a few GB free on /.
Take a snapshot you can restore, plus separate database dumps, and rehearse the upgrade on a copy first.
Then each step in a window: change bullseye to bookworm in the sources, then apt update, apt upgrade --without-new-pkgs, apt full-upgrade, a reboot, and every site checked. Then the same again from bookworm to trixie.
How I run the move
- 01Inventory and a fixed quote
What's on the server, what depends on it, and which of the changes above will bite. In place or rebuild, with the reasons.
- 02Rehearsal on staging
A copy upgraded or rebuilt first, every site and job tested, every problem fixed there.
- 03The window, with a way back
The real move at a time you agree, the old server or a snapshot kept ready, then two weeks' stabilisation.
Upgrades and migrations →
Questions
When did Debian 11 reach end of life?
Regular security support ended on 14 August 2024, and Debian's Long Term Support ended on 31 August 2026. Since September 2026 Debian itself releases no more security updates for bullseye.
Can I still get security fixes for Debian 11?
Only by paying. Freexian's Extended LTS covers Debian 11 to 30 June 2031, for a subset of packages that its customers sponsor.
Can I upgrade Debian 11 straight to Debian 13?
Not in one step. Debian supports upgrades one release at a time: 11 to 12, then 12 to 13. A rebuild on a fresh Debian 13 server skips the middle step.
Is it worth stopping at Debian 12?
Only briefly. Debian 12 left regular security support in June 2026 and is on LTS to June 2028. Debian 13 is supported to June 2030, so aim for it.
What is the upgrade command?
Change bullseye to bookworm in the apt sources (adding bookworm-security and the new non-free-firmware component if you use firmware), then run apt update, apt upgrade --without-new-pkgs and apt full-upgrade. Read the release notes for the version first.
What breaks most often going from 11 to 13?
PHP jumping from 7.4 to 8.4, Python's pip refusing system-wide installs, PostgreSQL and MariaDB clusters needing their own upgrade, and old clients that only speak TLS 1.0 or use SHA-1 or DSA keys.
Still running Debian 11?
Tell me what's on the server. I'll tell you whether to upgrade in place or rebuild, and give you a fixed quote for the move to Debian 13.