TL;DR

PVE 9 (Debian 13 trixie, deb822 format):

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

cat > /etc/apt/sources.list.d/proxmox.sources <<'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF

# Disable enterprise (without a subscription it returns 401 on every apt update)
grep -q '^Enabled:' /etc/apt/sources.list.d/pve-enterprise.sources \
  || echo 'Enabled: false' >> /etc/apt/sources.list.d/pve-enterprise.sources

apt update && apt full-upgrade

PVE 8 (Debian 12 bookworm, one-line format):

1
2
3
4
5

echo 'deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription' \
  > /etc/apt/sources.list.d/pve-no-subscription.list
sed -i 's/^deb /# deb /' /etc/apt/sources.list.d/pve-enterprise.list

apt update && apt full-upgrade

If the host runs Ceph, the Ceph enterprise repo has to be disabled too and swapped for its no-subscription (below).

What each repository does

RepoPurposeWithout a subscription
pve-enterpriseStable packages, the most tested. Needs a subscription keyapt update returns 401 Unauthorized
pve-no-subscriptionPublic. Same packages, a bit earlier and with less testingWorks
pve-testBleeding edge, for testingWorks

Proxmox is clear about it: pve-no-subscription is for testing and non-production use; in production they want you to pay for a subscription and use enterprise. For a lab or a homelab it is the normal repo.

The enterprise 401 does not break anything by itself, but every apt update ends in an error and the other repos are left half refreshed. Disabling it is the fix; there is no need to delete it.

PVE 9: .sources files (deb822)

Since PVE 9 the installer already writes /etc/apt/sources.list.d/pve-enterprise.sources in deb822 format. A .sources file is a block of keys:

1
2
3
4
5
6
7

# /etc/apt/sources.list.d/pve-enterprise.sources
Types: deb
URIs: https://enterprise.proxmox.com/debian/pve
Suites: trixie
Components: pve-enterprise
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
Enabled: false

Enabled: false keeps it written but inactive. The no-subscription block is the one in the TL;DR; the test one is the same with Components: pve-test.

If you carry .list files from an upgrade off PVE 8, apt 3 converts them for you:

1

apt modernize-sources

It rewrites each .list as .sources and leaves the original as .list.bak.

PVE 8: .list files

1
2
3
4
5

# /etc/apt/sources.list.d/pve-enterprise.list
# deb https://enterprise.proxmox.com/debian/pve bookworm pve-enterprise

# /etc/apt/sources.list.d/pve-no-subscription.list
deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription

Commenting the enterprise line with # is the deb822 Enabled: false equivalent.

Ceph

The installer also leaves the Ceph enterprise repo. Same treatment; the repo name carries the Ceph release the cluster runs (ceph -v):

PVE 9:

1
2
3
4
5
6

# /etc/apt/sources.list.d/ceph.sources
Types: deb
URIs: http://download.proxmox.com/debian/ceph-tentacle
Suites: trixie
Components: no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

Swap ceph-tentacle for ceph-squid if you are still on Squid. If the original file had Components: enterprise, replace the whole file with this one.

PVE 8:

1
2
3

# /etc/apt/sources.list.d/ceph.list
# deb https://enterprise.proxmox.com/debian/ceph-squid bookworm enterprise
deb http://download.proxmox.com/debian/ceph-squid bookworm no-subscription

On bookworm there are ceph-quincy, ceph-reef, and ceph-squid; use the one matching your cluster, not the newest.

Proxmox Backup Server

Identical pattern with pbs in the URI and pbs-no-subscription as the component:

1
2
3
4
5
6

# /etc/apt/sources.list.d/proxmox.sources (PBS 4, trixie)
Types: deb
URIs: http://download.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

And Enabled: false in pbs-enterprise.sources.

Traps

  • Do not mix suites. bookworm on PVE 8, trixie on PVE 9. One line with the wrong suite breaks the next full-upgrade.
  • The keyring is already there. /usr/share/keyrings/proxmox-archive-keyring.gpg ships with any ISO install. You only need to download it when installing Proxmox on top of a clean Debian (the official guide for that path covers it).
  • Signed-By is mandatory in deb822; without that line apt ignores the repo with a warning.
  • If apt fails with pve-apt-hook: not found, that is not a repo problem: separate post.
  • The GUI’s “no valid subscription” notice is independent of the repos and is not fixed here; a Community subscription removes it and gives you the enterprise repo as a bonus.

Reference: Package Repositories on the Proxmox wiki.