Raspberry Pi OS: updates and security for always-on Pis

Updated November 2026

Run sudo apt update and sudo apt full-upgrade regularly, update the bootloader EEPROM on a Pi 4, 400 or 5, and turn on unattended-upgrades (automatic updates) so fixes arrive without you. As of November 2026 the current Raspberry Pi OS is based on Debian 13 “trixie”. Never forward SSH or VNC from your router to a Pi that still allows password logins.

Which release you run

Raspberry Pi OS releases as of November 2026
Image	Debian base	Latest image	Security status
Raspberry Pi OS (64-bit and 32-bit)	Debian 13 “trixie”	October 6, 2026 (kernel 6.18)	Current; gets all security fixes
Raspberry Pi OS (Legacy)	Debian 12 “bookworm”	October 6, 2026 (kernel 6.12)	Still published “with security updates”; no end date announced
Older releases (bullseye and earlier)	Debian 11 or older	–	Debian LTS for bullseye ended August 31, 2026; reinstall

Raspberry Pi does not publish fixed end-of-life dates. Its security documentation says “only the most recent major release of Raspberry Pi OS is updated with all the latest security fixes”, and recommends moving to each new major release. The first trixie-based release came out on October 1, 2025. Check what a Pi runs:

cat /etc/os-release
uname -m
cat /proc/device-tree/model

VERSION_CODENAME shows trixie or bookworm. uname -m prints aarch64 on the 64-bit OS. The 64-bit OS takes most packages from Debian's own archive; the 32-bit OS uses the Raspbian archive (raspbian.raspberrypi.com), a rebuild of Debian for older Pi processors. Both also use Raspberry Pi's own archive (archive.raspberrypi.com) for the kernel, firmware and desktop.

Apply updates now

sudo apt update
sudo apt full-upgrade

Raspberry Pi recommends full-upgrade instead of upgrade because Raspberry Pi OS changes package dependencies more often than Debian. It can remove packages when needed, so read its summary before you answer yes. This also updates the Linux kernel and the stable firmware (the raspi-firmware package). Reboot when a kernel or firmware package was in the list:

sudo reboot      # restarts the Pi

To see which running services still use old libraries after an update, install needrestart and list them without restarting anything:

sudo apt install needrestart
sudo needrestart -r l

Do not use rpi-update for patching. It installs pre-release kernel and firmware that “can introduce instability, rendering your system unreliable or unbootable”. Raspberry Pi says to use it only when one of its engineers asks you to. To go back to the stable firmware, run sudo apt install --reinstall raspi-firmware and reboot.

Bootloader EEPROM updates

The Raspberry Pi 4, 400, 5 and Compute Module 4 and later boot from a bootloader stored in an EEPROM chip on the board, not from the SD card. It is updated separately with the rpi-eeprom package, which full-upgrade keeps current. Check and apply:

sudo rpi-eeprom-update        # show current and available versions
sudo rpi-eeprom-update -a     # stage the update
sudo reboot                   # the EEPROM is written during this reboot

This matters for security: the one advisory on Raspberry Pi's security page as of November 2026, CVE-2026-13199, affects the boot firmware of the Raspberry Pi 5 and Compute Module 5 and is fixed in bootloader release pieeprom-2026-05-26. After the reboot, run sudo rpi-eeprom-update again to confirm. The package also includes a rpi-eeprom-update service that runs rpi-eeprom-update -s -a at boot; systemctl is-enabled rpi-eeprom-update shows whether it is on. The release channel is set in /etc/default/rpi-eeprom-update; leave it at FIRMWARE_RELEASE_STATUS="default" unless you need a newer feature from latest.

Automatic updates

A Pi that runs for months unattended should install fixes by itself. Raspberry Pi OS uses Debian's unattended-upgrades:

sudo apt install unattended-upgrades apt-listchanges
sudo dpkg-reconfigure unattended-upgrades

Answer yes to automatic installation of stable updates. The default rules only match Debian's security archive, so on a Pi they miss the kernel and firmware from Raspberry Pi's archive, and on the 32-bit OS they miss every package from Raspbian. Add the right origins in a separate file, /etc/apt/apt.conf.d/52unattended-upgrades-local:

Unattended-Upgrade::Origins-Pattern {
        "origin=Raspberry Pi Foundation,codename=${distro_codename},label=Raspberry Pi Foundation";
        // 32-bit Raspberry Pi OS only:
        "origin=Raspbian,codename=${distro_codename},label=Raspbian";
};

Then test it and check the log:

sudo unattended-upgrade --dry-run --debug
ls /var/log/unattended-upgrades/

Kernel updates still need a reboot. You can let unattended-upgrades reboot at night with Unattended-Upgrade::Automatic-Reboot "true"; and Unattended-Upgrade::Automatic-Reboot-Time "03:00"; in the same file, which restarts the Pi without asking. More options: Automatic updates.

Users and sudo

No default pi user. Since the April 2022 images there is no built-in pi account with a known password; the first-boot wizard (or the settings in Raspberry Pi Imager) makes you create your own. A Pi installed before then may still have pi with the old default password: change it with passwd, or rename the account with the rename-user tool.
Sudo asks for a password. Images from April 13, 2026 disable passwordless sudo by default. Older installs often let the first user run sudo without a password. Look for it with sudo grep -r NOPASSWD /etc/sudoers.d/. Current versions of raspi-config and Control Centre have a switch for it; turn it off.
Give each person their own account, and remove accounts that are no longer used.

SSH: keys only

SSH is off by default. Turn it on in Raspberry Pi Imager's customisation settings, in raspi-config, or in Control Centre. Then set up key login from your computer:

ssh-keygen -t ed25519
ssh-copy-id user@pi-address

Once the key works, turn off password logins on the Pi. Keep your current session open while you test a new one:

echo "PasswordAuthentication no" | sudo tee /etc/ssh/sshd_config.d/10-no-passwords.conf
sudo sshd -t                     # check the configuration
sudo systemctl restart ssh       # restarts the SSH service

Raspberry Pi's documentation also covers AllowUsers to limit who can log in, and Fail2Ban to block repeated failed logins (brute-force attacks). See SSH hardening.

Keep the Pi off the internet

Anything reachable from the internet gets constant automated login attempts, and a small always-on board with a weak password is easy to turn into a botnet node or cryptominer (cryptojacking). Do not forward ports from your router to a Pi. For remote access use a VPN, or Raspberry Pi Connect, a free remote-shell and screen-sharing service that needs no open ports. On the Pi itself, a simple firewall helps; allow SSH before you enable it:

sudo apt install ufw
sudo ufw allow ssh
sudo ufw limit ssh/tcp
sudo ufw enable
sudo ufw status verbose

If someone is already hammering your Pi with logins, see Brute-force attacks.

Security advisories

Raspberry Pi lists its own advisories on its security page, with a “Be notified of security vulnerabilities” form for email alerts. Vulnerabilities are reported to security@raspberrypi.com.
The Raspberry Pi OS CVE list reports known CVEs in the latest image of each variant, as released and after apt full-upgrade.
Raspberry Pi says it tracks Debian's security updates on a regular schedule, so Debian's announcements cover most packages: see Debian.

Moving to a new major release

Raspberry Pi strongly recommends a clean install, not an in-place upgrade, to move between major releases (for example bookworm to trixie). Back up your data and configuration, write a fresh trixie image with Raspberry Pi Imager to a new card or SSD, and restore. Keeping the old card lets you go back if something fails. See Is my OS supported?.