Short answer: to keep FreePBX 17 on Debian 12, remember that FreePBX 17 supports Debian 12 (bookworm) only, so make sure no APT source points at stable or trixie before you run apt upgrade, and check that apt-cache policy libc6 offers a Debian 12 version. The installer adds a pin that blocks Debian 13, but on our lab it blocked only the main trixie suite: with old stable lines, apt still wanted 32 packages from Debian 13 security and updates. Fix the sources to bookworm, add a pin for all three Debian 13 suites, and never run apt full-upgrade while trixie shows up.
Admins on the FreePBX forum keep asking how to stop a FreePBX server upgrading itself to Debian 13, and when FreePBX 18 will support it. The Sangoma installer says it plainly in a comment: “currently FreePBX only supports Debian 12/Bookworm”. We checked on our FreePBX 17 lab what an accidental upgrade would do, and what the installer’s protection actually covers.
Table of Contents
What a Debian 13 upgrade would do to FreePBX 17
We asked APT to simulate apt full-upgrade on our FreePBX 17 server with Debian lines on stable, the way older installs were set up, and without the installer’s pin. Simulation only (apt-get -s, with a separate package-list folder): nothing was installed.
| What APT planned | Result |
|---|---|
| Packages upgraded / new / removed | 779 / 166 / 72 |
| libc6 | 2.36 (Debian 12) to 2.41 (Debian 13) |
| MariaDB server | 10.11 to 11.8 |
| PHP | libapache2-mod-php8.2 and every php8.2 module removed, including php8.2-mysql, php8.2-curl and php8.2-xml |
FreePBX’s web interface and fwconsole run on PHP 8.2. Debian 13 does not ship PHP 8.2, so after that upgrade the GUI would have no PHP to run on. The freepbx17 and sangoma-pbx17 packages are held, which stops them changing, but not the Debian packages underneath them.
Check that FreePBX 17 on Debian 12 is safe in two minutes
grep -rh "^deb " /etc/apt/sources.list /etc/apt/sources.list.d/ # every Debian line must say bookworm
apt-cache policy libc6 | head -3 # Candidate must be 2.36-..., not 2.41
apt-get -s full-upgrade | grep -c "Debian:13\|Debian-Security:13" # must print 0On our lab, after the installer had fixed the sources, all three checks passed: only bookworm lines, a libc6 candidate of 2.36-9+deb12u14, and a simulated upgrade of three packages plus one new one, none from Debian 13. If you see stable, trixie, a libc6 candidate of 2.41, or a non-zero count, stop: do not run apt upgrade or apt full-upgrade until it is fixed.
What the installer’s block covers, and what it misses
The official installer (sng_freepbx_debian_install.sh, SCRIPTVER 1.15, the same version on GitHub on 18 October 2026) writes /etc/apt/preferences.d/99-block-trixie.pref:
# Block Debian 13 Trixie
Package: *
Pin: release n=trixie
Pin-Priority: -1That pin matches the main Debian 13 suite only. The security and update suites are called trixie-security and trixie-updates, and stay at the normal priority of 500. With the old stable lines and this pin in place, the simulation still planned 32 upgrades from Debian 13, including a Debian 13 kernel (linux-image-6.12.113+deb13-amd64), libexpat1, liblzma5 and libfreetype6, and it removed libpng16-16 in favour of the Debian 13 libpng16-16t64. That is a partial Debian 13 system, which is harder to undo than either a clean 12 or a clean 13.
If your sources say bookworm, the gap does not matter, because those suites are never fetched. It matters on servers that still have stable lines.
The fix: bookworm sources and a complete pin
1. Point the sources at bookworm. Edit every Debian line in /etc/apt/sources.list and /etc/apt/sources.list.d/ so it says bookworm, bookworm-security or bookworm-updates. The installer can do part of this: bash sng_freepbx_debian_install.sh --disable-deb-update-v13 rewrites stable lines to bookworm, writes the pin above and exits without installing anything. But it only rewrites lines that use its default mirror, http://ftp.debian.org/debian (or the one given with --debianmirror), plus security.debian.org. We ran its function on a test file: a deb.debian.org ... stable line, the default on many Debian 12 images, and a deb.debian.org ... stable-updates line were left unchanged. So check the result with the commands above. On our lab it printed “Debian repositories have been updated to use the Bookworm (Debian 12) sources” and exited with code 1, by design. It is an installer option: the command fwconsole sa disable-deb-update-v13 that circulates online does not exist on an open-source install (“Command "sa" is not defined”).
2. Pin all three Debian 13 suites, as a second line of defence. Save as /etc/apt/preferences.d/99-block-debian13.pref:
Package: *
Pin: release n=trixie
Pin-Priority: -1
Package: *
Pin: release n=trixie-security
Pin-Priority: -1
Package: *
Pin: release n=trixie-updates
Pin-Priority: -1With this file and the old stable lines, the simulation planned 0 upgrades, 0 new packages and 0 removals, and libexpat1 stayed at its Debian 12 version. Then run apt update and the three checks above again.
3. Back up before any big update. Our tested FreePBX restore guide shows what a backup leaves out (custom config files, recordings) and how to check it.
How we tested
On 18 October 2026 on our FreePBX lab server: Debian 12.15, FreePBX 17.0.33.2, Asterisk 22.11.0, PHP 8.2.34, installed with the official installer (SCRIPTVER 1.15). The package lists for the stable scenario were fetched into a separate folder and every run used apt-get -s with alternative source and preference files, so the server’s own APT configuration was never changed; we compared it before and after the installer option to confirm. The installer’s source-fixing function was also run, unchanged, against a test copy of a sources file. Debian’s stable was Debian 13.7 at the time.
Not tested: the real upgrade (only APT’s plan), commercial modules and the Sysadmin module, FreePBX systems built from the ISO, and FreePBX 18.
Related: upgrade FreePBX 16 to 17, install FreePBX 17 on Debian 12, Asterisk versions and EOL dates.
At a glance
Frequently asked questions
Can I run FreePBX 17 on Debian 13?
Not supported. FreePBX 17 targets Debian 12, and Debian 13 has no PHP 8.2. A 2025 post on the FreePBX forum said FreePBX 18 will target Debian 13; as of October 2026 there was no firm date.
Is unattended-upgrades safe on a FreePBX server?
Only with bookworm sources. With stable lines, automatic upgrades would pull Debian 13 security packages even with the installer’s pin, as the simulation above shows.
My server already pulled some Debian 13 packages. What now?
Stop updating, take a full FreePBX backup plus a copy of /etc/asterisk, and plan a clean Debian 12 rebuild and restore rather than mixing versions further. Downgrading packages in place is possible but error-prone; we have not tested it.
Reading a lot of our guides? Go ad-free with srvScripts Pro for $6 a month. It also pays for new guides. Cancel any time.