Debian 11 bullseye LTS ended on 31 August 2026: what it means for your servers and how to move on

On 31 August 2026 the Debian LTS team announced that Long Term Support for Debian 11 "bullseye" had ended, five years after its release on 14 August 2021. From September onwards Debian publishes no further security updates for bullseye. Servers still running it keep working, but every vulnerability found from now on, in the kernel, OpenSSH, OpenSSL, PHP or anything else, stays open on them.

What changed on 31 August

• No more DLAs for bullseye. The LTS team now concentrates on Debian 12 (bookworm), which it supports until 30 June 2028.
• Extended LTS is a separate, commercial service. According to the Debian wiki, ELTS is "not an official Debian project" and is managed by Freexian. It covers a subset of packages chosen by its paying customers, with bullseye covered until 30 June 2031. Freexian says it aims to keep updates freely available to individual users and small non-profit organisations on request.
• The supported way forward is an upgrade. Both the LTS team and Debian's announcement encourage users to upgrade to Debian 12 and then to Debian 13 (trixie), the current stable release.

Find your bullseye machines

On each server, check the release:

cat /etc/debian_version
grep PRETTY_NAME /etc/os-release

A version starting with 11. means bullseye. Include containers and VM templates in the search: a Docker image built FROM debian:bullseye carries the same unpatched packages.

Choose a path

1. Upgrade in place, one release at a time. The bookworm release notes state that only upgrades from Debian 11 are supported, and the trixie release notes that only upgrades from Debian 12 are supported. A bullseye server therefore goes 11 → 12 → 13, never straight to 13.
2. Rebuild and migrate. For servers with a clear role (a web server, a database), installing a fresh Debian 13 machine and moving the application and data is often cleaner than two upgrades in a row, and it gives you a tested rollback: the old server.
3. Buy time with ELTS. Only if neither is possible soon, and only for the packages ELTS actually covers.

Upgrading from bullseye to bookworm: the short version

Read the official bookworm upgrade chapter first. Its core steps are:

1. Back up. The release notes name /etc, /var/lib/dpkg, /var/lib/apt/extended_states and the list of installed packages, in addition to your data and databases:

sudo tar czf /root/pre-upgrade-$(date +%F).tar.gz /etc /var/lib/dpkg /var/lib/apt/extended_states
dpkg --get-selections '*' > ~/selections-$(date +%F).txt

2. Bring bullseye fully up to date and check package health:

sudo apt update && sudo apt full-upgrade
sudo dpkg --audit
apt-mark showhold

dpkg --audit should print nothing, and nothing essential should be on hold.

3. Point APT at bookworm. Edit /etc/apt/sources.list and every file in /etc/apt/sources.list.d/. The Debian LTS/Using page gives this layout for bookworm (drop the components you do not use; bookworm adds non-free-firmware for firmware packages):

deb http://deb.debian.org/debian/ bookworm main contrib non-free-firmware non-free
deb https://deb.debian.org/debian-security bookworm-security main contrib non-free-firmware non-free

Third-party repositories (for example for PHP, Docker or a database) need their own bookworm entries; disable any that do not offer one yet.

4. Upgrade in two stages, then reboot:

sudo apt update
sudo apt upgrade --without-new-pkgs
sudo apt full-upgrade
sudo reboot

The release notes recommend the minimal --without-new-pkgs stage first so that the full upgrade does not remove packages you want to keep. Read each configuration-file prompt instead of accepting defaults blindly. After the reboot, cat /etc/debian_version should show 12.x.

5. Then repeat for trixie using the trixie release notes, which follow the same pattern with their own list of known issues.

Pitfalls

• Remote access. Run the upgrade inside screen or tmux, or from a provider console, so a dropped SSH connection does not interrupt dpkg.
• Kernel. The release notes strongly recommend having a linux-image-* metapackage installed so the new kernel is pulled in.
• Disk space. Check free space in /, /var and /boot before you start.
• Application versions jump. PHP, PostgreSQL, MariaDB and Python all move to new major versions between releases. Test your application on a copy first.
• Monitoring that restarts services (such as monit) can interfere; the release notes suggest stopping it during the upgrade.

What you should do

• List every bullseye server, VM template and container image you run.
• Decide per machine: upgrade in place, rebuild on Debian 13, or (temporarily) ELTS.
• Back up first, then upgrade 11 → 12 → 13 following the official release notes, one release at a time.
• Until a machine is upgraded, reduce its exposure: firewall it tightly and do not expose new services on it.
• Note the next deadline: Debian 12 LTS ends on 30 June 2028.

Sources

• debian.org/News/2026/20260831
• lists.debian.org/debian-announce/2026/msg00008.html
• lists.debian.org/debian-lts-announce/2026/08/msg00033.html
• debian.org/releases
• wiki.debian.org/LTS
• wiki.debian.org/LTS/Extended
• wiki.debian.org/LTS/Using
• debian.org/releases/bookworm/amd64/release-notes/ch-upgrading.en.html
• debian.org/releases/trixie/release-notes/upgrading.en.html