How to Update and Upgrade Proxmox VE Safely

Why Keeping Proxmox VE Updated Matters

Running an outdated Proxmox VE installation exposes your infrastructure to security vulnerabilities, missed bug fixes, and compatibility issues with newer guest operating systems. Regular updates patch kernel vulnerabilities, fix QEMU and LXC bugs, and bring improvements to the web interface and storage subsystems. A disciplined update routine is one of the most impactful things you can do for the health of your environment.

Routine Updates with apt

Proxmox VE is built on Debian, so its package management works exactly like any Debian-based system. The standard update workflow refreshes the package index and then upgrades all installed packages:

# Refresh the package index
apt update

# Review what will be upgraded
apt list --upgradable

# Apply all available upgrades
apt dist-upgrade -y

Always use dist-upgrade rather than upgrade. The dist-upgrade command handles dependency changes intelligently, which is important because Proxmox kernel and core package updates frequently add or remove dependencies. A plain upgrade may hold back critical packages.

After a kernel update, you need to reboot the node for the new kernel to take effect:

# Check if a reboot is required
ls /var/run/reboot-required 2>/dev/null && echo "Reboot needed" || echo "No reboot needed"

# Check running vs installed kernel
uname -r
dpkg -l | grep pve-kernel | grep -v headers

Snapshot Before Every Upgrade

Before applying any updates, especially major ones, take a snapshot or backup of your system. If you are running Proxmox on ZFS, you can snapshot the root filesystem directly:

# Create a pre-upgrade ZFS snapshot
zfs snapshot rpool/ROOT/pve-1@pre-upgrade-$(date +%Y%m%d)

# List existing snapshots to confirm
zfs list -t snapshot -r rpool/ROOT

If your root filesystem is ext4 or XFS on LVM, use LVM snapshots instead:

# Create an LVM snapshot of the root volume
lvcreate -L 10G -s -n root-snap /dev/pve/root

# To roll back if something goes wrong
lvconvert --merge /dev/pve/root-snap

For virtual machines running on the node, take VM snapshots through the Proxmox interface or command line before proceeding:

# Snapshot all running VMs before upgrade
for vmid in $(qm list | awk 'NR>1 {print $1}'); do
    qm snapshot "$vmid" pre-upgrade --description "Before system upgrade $(date +%Y-%m-%d)"
done

Major Version Upgrades

Major version upgrades (for example, Proxmox VE 8.x to 9.x) require more planning than routine updates. Proxmox provides a built-in upgrade checklist tool that verifies your system is ready:

# Run the upgrade readiness checker
pve8to9 --full

# Common checks it performs:
# - Verify no running HA services that block upgrade
# - Check for deprecated configurations
# - Validate storage and network settings
# - Verify Ceph compatibility (if applicable)

Once the checker passes, the general procedure is to update your repository sources to point to the new release, then run the full upgrade:

# Update sources to new release (example: bookworm to next)
sed -i 's/bookworm/trixie/g' /etc/apt/sources.list
sed -i 's/bookworm/trixie/g' /etc/apt/sources.list.d/*.list

# Refresh and perform the major upgrade
apt update
apt dist-upgrade -y

# Reboot into the new kernel
reboot

After rebooting, verify the upgrade completed successfully:

# Confirm the new Proxmox version
pveversion -v

# Check for any lingering issues
systemctl --failed

Rolling Cluster Updates

In a Proxmox cluster, never update all nodes simultaneously. Use a rolling update strategy to maintain availability throughout the process:

1. Migrate workloads off the target node using live migration
2. Update the node using the steps above
3. Reboot the node if a kernel update was applied
4. Verify the node rejoins the cluster cleanly
5. Repeat for the next node

# Step 1: Migrate all VMs off node "pve2" to "pve1"
for vmid in $(pvesh get /nodes/pve2/qemu --output-format json | jq -r '.[].vmid'); do
    qm migrate "$vmid" pve1 --online
done

# Step 2: SSH into pve2 and run updates
apt update && apt dist-upgrade -y

# Step 3: Reboot if needed
reboot

# Step 4: Verify cluster status after node returns
pvecm status
pvecm nodes

Wait for each node to fully rejoin the cluster and show a healthy status before proceeding to the next one. Check that corosync quorum is maintained throughout:

# Verify quorum is intact
pvecm expected 1
corosync-quorumtool -s

Post-Update Checklist

After completing updates on all nodes, run through a quick verification checklist:

• All nodes show as online in the cluster view
• Storage pools are connected and healthy
• VM and container networking functions correctly
• Backup jobs are still scheduled and functional
• HA services are running on their expected nodes

Keeping Proxmox VE current does not have to be stressful. With snapshots as your safety net, a rolling update approach for clusters, and a post-update checklist, you can stay current without risking downtime. Tools like ProxmoxR make it easy to monitor node status and verify that all services are healthy after an update, right from your mobile device.