# Keep FreePBX 17 on Debian 12: Check the Trixie Block Before apt upgrade (Tested)

Source: https://srvscripts.com/guides/keep-freepbx-17-on-debian-12/
Updated: 2026-10-18
Publisher: srvScripts (https://srvscripts.com/)

**Short answer:** to keep FreePBX 17 on Debian 12, remember that FreePBX 17 supports Debian 12 (bookworm) only, so make sure no APT source points at stable or trixie before you run apt upgrade, and check that apt-cache policy libc6 offers a Debian 12 version. The installer adds a pin that blocks Debian 13, but on our lab it blocked only the main trixie suite: with old stable lines, apt still wanted 32 packages from Debian 13 security and updates. Fix the sources to bookworm, add a pin for all three Debian 13 suites, and never run `apt full-upgrade` while trixie shows up.

In short: FreePBX 17 supports Debian 12 (bookworm) only, so make sure no APT source points at stable or trixie before you run apt upgrade, and check that apt-cache policy libc6 offers a Debian 12 vers…

Admins on the FreePBX forum keep asking [how to stop a FreePBX server upgrading itself to Debian 13](https://community.freepbx.org/t/prevent-debian-12-upgrade-to-13-am-i-doing-it-correct/110290), and [when FreePBX 18 will support it](https://community.freepbx.org/t/debian-13-trixie-freepbx-18/110349). The Sangoma installer says it plainly in a comment: “currently FreePBX only supports Debian 12/Bookworm”. We checked on our FreePBX 17 lab what an accidental upgrade would do, and what the installer’s protection actually covers.

## What a Debian 13 upgrade would do to FreePBX 17

We asked APT to simulate `apt full-upgrade` on our FreePBX 17 server with Debian lines on `stable`, the way older installs were set up, and without the installer’s pin. Simulation only (`apt-get -s`, with a separate package-list folder): nothing was installed.

| What APT planned | Result |
| --- | --- |
| Packages upgraded / new / removed | 779 / 166 / 72 |
| libc6 | 2.36 (Debian 12) to 2.41 (Debian 13) |
| MariaDB server | 10.11 to 11.8 |
| PHP | libapache2-mod-php8.2 and every php8.2 module removed, including php8.2-mysql, php8.2-curl and php8.2-xml |

FreePBX’s web interface and `fwconsole` run on PHP 8.2. Debian 13 does not ship PHP 8.2, so after that upgrade the GUI would have no PHP to run on. The `freepbx17` and `sangoma-pbx17` packages are held, which stops them changing, but not the Debian packages underneath them.

## Check that FreePBX 17 on Debian 12 is safe in two minutes

```
grep -rh "^deb " /etc/apt/sources.list /etc/apt/sources.list.d/   # every Debian line must say bookworm
apt-cache policy libc6 | head -3                                      # Candidate must be 2.36-..., not 2.41
apt-get -s full-upgrade | grep -c "Debian:13\|Debian-Security:13"     # must print 0
```

On our lab, after the installer had fixed the sources, all three checks passed: only bookworm lines, a libc6 candidate of `2.36-9+deb12u14`, and a simulated upgrade of three packages plus one new one, none from Debian 13. If you see `stable`, `trixie`, a libc6 candidate of 2.41, or a non-zero count, stop: do not run `apt upgrade` or `apt full-upgrade` until it is fixed.

## What the installer’s block covers, and what it misses

The official installer (`sng_freepbx_debian_install.sh`, SCRIPTVER 1.15, the same version on GitHub on 18 October 2026) writes `/etc/apt/preferences.d/99-block-trixie.pref`:

```
# Block Debian 13 Trixie
Package: *
Pin: release n=trixie
Pin-Priority: -1
```

That pin matches the main Debian 13 suite only. The security and update suites are called `trixie-security` and `trixie-updates`, and stay at the normal priority of 500. With the old `stable` lines and this pin in place, the simulation still planned **32 upgrades from Debian 13**, including a Debian 13 kernel (`linux-image-6.12.113+deb13-amd64`), libexpat1, liblzma5 and libfreetype6, and it removed `libpng16-16` in favour of the Debian 13 `libpng16-16t64`. That is a partial Debian 13 system, which is harder to undo than either a clean 12 or a clean 13.

If your sources say `bookworm`, the gap does not matter, because those suites are never fetched. It matters on servers that still have `stable` lines.

## The fix: bookworm sources and a complete pin

**1. Point the sources at bookworm.** Edit every Debian line in `/etc/apt/sources.list` and `/etc/apt/sources.list.d/` so it says `bookworm`, `bookworm-security` or `bookworm-updates`. The installer can do part of this: `bash sng_freepbx_debian_install.sh --disable-deb-update-v13` rewrites `stable` lines to bookworm, writes the pin above and exits without installing anything. But it only rewrites lines that use its default mirror, `http://ftp.debian.org/debian` (or the one given with `--debianmirror`), plus `security.debian.org`. We ran its function on a test file: a `deb.debian.org ... stable` line, the default on many Debian 12 images, and a `deb.debian.org ... stable-updates` line were left unchanged. So check the result with the commands above. On our lab it printed “Debian repositories have been updated to use the Bookworm (Debian 12) sources” and exited with code 1, by design. It is an installer option: the command `fwconsole sa disable-deb-update-v13` that circulates online does not exist on an open-source install (“Command "sa" is not defined”).

**2. Pin all three Debian 13 suites**, as a second line of defence. Save as `/etc/apt/preferences.d/99-block-debian13.pref`:

```
Package: *
Pin: release n=trixie
Pin-Priority: -1

Package: *
Pin: release n=trixie-security
Pin-Priority: -1

Package: *
Pin: release n=trixie-updates
Pin-Priority: -1
```

With this file and the old `stable` lines, the simulation planned **0 upgrades, 0 new packages and 0 removals**, and libexpat1 stayed at its Debian 12 version. Then run `apt update` and the three checks above again.

**3. Back up before any big update.** Our [tested FreePBX restore guide](/guides/restore-a-freepbx-backup/) shows what a backup leaves out (custom config files, recordings) and how to check it.

## How we tested

On 18 October 2026 on our FreePBX lab server: Debian 12.15, FreePBX 17.0.33.2, Asterisk 22.11.0, PHP 8.2.34, installed with the official installer (SCRIPTVER 1.15). The package lists for the `stable` scenario were fetched into a separate folder and every run used `apt-get -s` with alternative source and preference files, so the server’s own APT configuration was never changed; we compared it before and after the installer option to confirm. The installer’s source-fixing function was also run, unchanged, against a test copy of a sources file. Debian’s `stable` was Debian 13.7 at the time.

Not tested: the real upgrade (only APT’s plan), commercial modules and the Sysadmin module, FreePBX systems built from the ISO, and FreePBX 18.

Related: [upgrade FreePBX 16 to 17](/guides/upgrade-freepbx-16-to-17/), [install FreePBX 17 on Debian 12](/guides/install-freepbx-17-debian-12/), [Asterisk versions and EOL dates](/guides/asterisk-versions-eol-upgrade/).

## Frequently asked questions

### Can I run FreePBX 17 on Debian 13?

Not supported. FreePBX 17 targets Debian 12, and Debian 13 has no PHP 8.2. A 2025 post on the FreePBX forum said FreePBX 18 will target Debian 13; as of October 2026 there was no firm date.

### Is unattended-upgrades safe on a FreePBX server?

Only with bookworm sources. With `stable` lines, automatic upgrades would pull Debian 13 security packages even with the installer’s pin, as the simulation above shows.

### My server already pulled some Debian 13 packages. What now?

Stop updating, take a full FreePBX backup plus a copy of `/etc/asterisk`, and plan a clean Debian 12 rebuild and restore rather than mixing versions further. Downgrading packages in place is possible but error-prone; we have not tested it.