PVE 9 (Debian 13 trixie, deb822 format):

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

cat > /etc/apt/sources.list.d/proxmox.sources <<'EOF'
Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
EOF

# Disable enterprise (without a subscription it returns 401 on every apt update)
grep -q '^Enabled:' /etc/apt/sources.list.d/pve-enterprise.sources \
  || echo 'Enabled: false' >> /etc/apt/sources.list.d/pve-enterprise.sources

apt update && apt full-upgrade

PVE 8 (Debian 12 bookworm, one-line format):

1
2
3
4
5

echo 'deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription' \
  > /etc/apt/sources.list.d/pve-no-subscription.list
sed -i 's/^deb /# deb /' /etc/apt/sources.list.d/pve-enterprise.list

apt update && apt full-upgrade

If the host runs Ceph, the Ceph enterprise repo has to be disabled too and swapped for its no-subscription (below).

What each repository does

Proxmox is clear about it: pve-no-subscription is for testing and non-production use; in production they want you to pay for a subscription and use enterprise. For a lab or a homelab it is the normal repo.

The enterprise 401 does not break anything by itself, but every apt update ends in an error and the other repos are left half refreshed. Disabling it is the fix; there is no need to delete it.

PVE 9: .sources files (deb822)

Since PVE 9 the installer already writes /etc/apt/sources.list.d/pve-enterprise.sources in deb822 format. A .sources file is a block of keys:

1
2
3
4
5
6
7

# /etc/apt/sources.list.d/pve-enterprise.sources
Types: deb
URIs: https://enterprise.proxmox.com/debian/pve
Suites: trixie
Components: pve-enterprise
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
Enabled: false

Enabled: false keeps it written but inactive. The no-subscription block is the one in the TL;DR; the test one is the same with Components: pve-test.

If you carry .list files from an upgrade off PVE 8, apt 3 converts them for you:

1

apt modernize-sources

It rewrites each .list as .sources and leaves the original as .list.bak.

PVE 8: .list files

1
2
3
4
5

# /etc/apt/sources.list.d/pve-enterprise.list
# deb https://enterprise.proxmox.com/debian/pve bookworm pve-enterprise

# /etc/apt/sources.list.d/pve-no-subscription.list
deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription

Commenting the enterprise line with # is the deb822 Enabled: false equivalent.

Ceph

The installer also leaves the Ceph enterprise repo. Same treatment; the repo name carries the Ceph release the cluster runs (ceph -v):

PVE 9:

1
2
3
4
5
6

# /etc/apt/sources.list.d/ceph.sources
Types: deb
URIs: http://download.proxmox.com/debian/ceph-tentacle
Suites: trixie
Components: no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

Swap ceph-tentacle for ceph-squid if you are still on Squid. If the original file had Components: enterprise, replace the whole file with this one.

PVE 8:

1
2
3

# /etc/apt/sources.list.d/ceph.list
# deb https://enterprise.proxmox.com/debian/ceph-squid bookworm enterprise
deb http://download.proxmox.com/debian/ceph-squid bookworm no-subscription

On bookworm there are ceph-quincy, ceph-reef, and ceph-squid; use the one matching your cluster, not the newest.

Proxmox Backup Server

Identical pattern with pbs in the URI and pbs-no-subscription as the component:

1
2
3
4
5
6

# /etc/apt/sources.list.d/proxmox.sources (PBS 4, trixie)
Types: deb
URIs: http://download.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

And Enabled: false in pbs-enterprise.sources.

Traps

• Do not mix suites. bookworm on PVE 8, trixie on PVE 9. One line with the wrong suite breaks the next full-upgrade.
• The keyring is already there. /usr/share/keyrings/proxmox-archive-keyring.gpg ships with any ISO install. You only need to download it when installing Proxmox on top of a clean Debian (the official guide for that path covers it).
• Signed-By is mandatory in deb822; without that line apt ignores the repo with a warning.
• If apt fails with pve-apt-hook: not found, that is not a repo problem: separate post.
• The GUI’s “no valid subscription” notice is independent of the repos and is not fixed here; a Community subscription removes it and gives you the enterprise repo as a bonus.

Reference: Package Repositories on the Proxmox wiki.

1
2
3
4
5

mkdir -p /usr/share/proxmox-ve
touch /usr/share/proxmox-ve/pve-apt-hook
chmod +x /usr/share/proxmox-ve/pve-apt-hook
apt install -f
apt install proxmox-ve

Once proxmox-ve is reinstalled, the real hook replaces the empty one and apt is back to normal.

The error

1
2

/bin/sh: 1: /usr/share/proxmox-ve/pve-apt-hook: not found
E: Failure running script /usr/share/proxmox-ve/pve-apt-hook

It shows up on any apt install, apt upgrade, or apt full-upgrade, and blocks everything, including whatever you try in order to fix it.

Why it happens

The proxmox-ve package installs two things that belong together:

If proxmox-ve went away (a miscalculated apt remove or autoremove, an interrupted dist-upgrade, a half-installed package), the script disappears but the file under /etc/apt/apt.conf.d/ is a conffile and stays. apt keeps trying to run a script that no longer exists and fails before touching anything.

Fix if you want to keep Proxmox

The empty hook only gets apt running; the point is to reinstall proxmox-ve:

1
2
3
4
5
6

mkdir -p /usr/share/proxmox-ve
touch /usr/share/proxmox-ve/pve-apt-hook
chmod +x /usr/share/proxmox-ve/pve-apt-hook

apt install -f            # close broken dependencies first (Proxmox staff recommendation)
apt install proxmox-ve    # brings back the real hook and whatever else is missing

Check that the hook is now the real one and not your empty file:

1
2

dpkg -S /usr/share/proxmox-ve/pve-apt-hook   # proxmox-ve: /usr/share/proxmox-ve/pve-apt-hook
head -1 /usr/share/proxmox-ve/pve-apt-hook   # #!/usr/bin/perl

After that, apt full-upgrade and a reboot to confirm the Proxmox kernel comes up.

Fix if you removed Proxmox on purpose

If the box is going back to plain Debian, the snippet is leftover:

1
2
3

rm /etc/apt/apt.conf.d/10pveapthook
# or, cleaner, purge what is left of the package:
dpkg --purge proxmox-ve

apt remove leaves conffiles behind; purge takes them with it.

Traps

• Do not leave the empty hook in place. It exists so apt cannot remove proxmox-ve or the proxmox-kernel-* package by accident. With the empty file that protection is gone.
• Check what left together with proxmox-ve. If apt removed it, it probably took dependencies along; apt install proxmox-ve brings them back, but read the list before accepting.
• If apt install proxmox-ve cannot find the package, the problem is in the repos: no-subscription repositories.
• Reference: Proxmox forum thread.