You just finished installing Proxmox VE, logged into the web interface for the first time, and there it is: a gray pop-up telling you "No valid subscription." Maybe you clicked it away and moved on. Then you tried to run apt update over SSH and got a wall of red text ending in 401 Unauthorized. Neither of these means your install is broken.
Both come from the same root cause, and both have a five-minute fix. This is one of the first things almost every new Proxmox user runs into, right after the excitement of getting the installer to boot in the first place, so let's sort it out properly.
What You Will Learn
- Why Proxmox VE ships pointed at a repository you can't use for free
- The exact
401 Unauthorizederror this causes duringapt update - How to switch to the free, fully supported no-subscription repository from the GUI and from the shell
- What to do about the Ceph enterprise repository if you've set up Ceph storage
- An honest look at the unofficial trick people use to remove the pop-up itself
What Is This Feature?
If you've never dealt with Debian or Ubuntu before, a quick primer helps here. A repository is just a server somewhere that hosts installable packages — think of it as an address that apt, the package manager, checks whenever you ask it to install or update software. Your system can have several repositories configured at once, and it checks every single one of them on every apt update.
Proxmox VE pulls its software packages from repositories, the same way Ubuntu or Debian does. By default, every fresh install is configured to check the Enterprise repository, a package source that requires a paid subscription key to authenticate against. Nobody sets this up during the installer, so on a brand-new box it's enabled but has no credentials attached to it.
That mismatch is exactly what triggers both symptoms. The web GUI checks your subscription status on login and shows the nag pop-up when it finds none. Meanwhile, apt tries to contact enterprise.proxmox.com for updates, gets asked for a login it doesn't have, and fails with a 401 error instead of quietly skipping it.
None of this touches your VMs, your containers, or any feature of Proxmox itself. It's purely about where package updates come from. There's a separate, completely free repository called pve-no-subscription that every homelab user and a good chunk of small businesses run permanently, with no functional downside.
It's worth being honest about why Proxmox ships it this way instead of just defaulting to the free repo. The company behind Proxmox makes its money from subscriptions and support contracts, not from selling the software itself — it's open source, after all. Pointing fresh installs at the enterprise repo first is a reasonable way to surface that option to people who might actually want it, even if it trips up almost everyone the first time they see it.
Why Would You Use It?
Switching to the no-subscription repository is one of the first things you should do after any fresh Proxmox install, whether you ever plan to buy a subscription or not. Without it, apt update either fails outright or silently skips the broken source, which means you can end up missing security patches without realizing it.
Even if you do eventually buy a subscription for a production cluster, you'd still want this fixed correctly on day one rather than clicking past red error text every time you SSH in. And if you're never buying one — which describes most homelab setups just fine — this is simply how you're supposed to run Proxmox on the free tier.
Prerequisites
You'll need root or sudo access to the Proxmox VE host, either through the web GUI's built-in shell or over SSH. This works identically whether you're on Proxmox VE 8.x (Debian 12 "Bookworm") or 9.x (Debian 13 "Trixie") — the only difference is the file format apt uses under the hood, which is covered below. No downtime and no reboot are required for any of this.
Step-by-Step Tutorial
Step 1: Confirm this is actually your problem
Open a shell on the node — either Datacenter → your node → Shell in the web GUI, or SSH in directly — and run:
apt updateIf you see something like Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/bookworm/InRelease 401 Unauthorized, you've got the enterprise repository enabled without a key. That's the normal state for a fresh install, so don't panic.
Step 2: Check which Proxmox VE version you're actually running
The file paths and formats differ between major versions, so it's worth confirming this before you start editing anything. Run:
pveversionAnything starting with pve-manager/8. is Proxmox VE 8.x, built on Debian 12 "Bookworm," and uses the older one-line-per-repo file format. Anything starting with pve-manager/9. is Proxmox VE 9.x, built on Debian 13 "Trixie," and uses the newer deb822 format with .sources files. Both are covered below, so just note which one applies to you.
Step 3: Fix it from the GUI (the easiest way)
Recent Proxmox VE releases include a proper Repositories panel, which is by far the safest option if you're not comfortable editing config files yet. Go to Node → Repositories. You'll see the Enterprise repository listed, almost certainly showing a status of "No subscription."
Click on it and hit Disable. Then click Add, choose No-Subscription from the list, and confirm. That's it — two clicks, no terminal required, and Proxmox writes the correct file for your exact version automatically.
Step 4: Fix it manually on Proxmox VE 8.x
If you'd rather do it by hand, or you're scripting a fresh install, the file to edit on Bookworm-based Proxmox VE 8.x is /etc/apt/sources.list.d/pve-enterprise.list. Comment out the existing line by putting a # in front of it:
#deb https://enterprise.proxmox.com/debian/pve bookworm pve-enterpriseThen create (or edit) /etc/apt/sources.list.d/pve-no-subscription.list with:
deb http://download.proxmox.com/debian/pve bookworm pve-no-subscriptionStep 5: Fix it manually on Proxmox VE 9.x
Proxmox VE 9 moved to the newer deb822 source format, so the files look a little different. You're now looking at /etc/apt/sources.list.d/pve-enterprise.sources. Instead of commenting out a line, add Enabled: false at the bottom of that block, or just delete the file if you're confident you won't need it back.
Then make sure /etc/apt/sources.list.d/pve-no-subscription.sources exists and contains:
Types: deb
URIs: http://download.proxmox.com/debian/pve
Suites: trixie
Components: pve-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpgStep 6: Handle the Ceph repository too, if you have one
If you've set up Ceph storage on this node, it has its own separate enterprise repository, and it causes the exact same 401 error. Check Node → Repositories for a Ceph entry, or manually look for /etc/apt/sources.list.d/ceph.list (PVE 8.x) or ceph.sources (PVE 9.x). Swap it to the no-subscription Ceph repository the same way you did in Step 4 or 5 — Proxmox names it clearly once you're looking at the Repositories tab. If you're not running Ceph, skip this step entirely; there's nothing to fix.
Step 7: Refresh and confirm
Run apt update one more time. You should get a clean package list with no 401 errors, and possibly a note about upgradable packages. From here on, use apt update && apt dist-upgrade to actually apply updates — plain apt upgrade can leave held-back packages behind on Proxmox because of how kernel and PVE-manager dependencies interact.
Commands Explained
| Command | What it does |
|---|---|
apt update | Refreshes the local list of available packages from every configured repository |
apt dist-upgrade | Installs available updates, including ones that need to add or remove packages — the correct upgrade command for Proxmox |
pvesubscription get | Shows whether this node currently has a subscription key applied |
cat /etc/apt/sources.list.d/pve-enterprise.list | Lets you check the exact contents of the enterprise repo file on PVE 8.x before editing it |
Common Errors
401 Unauthorized on enterprise.proxmox.com — the one this whole guide is about. No subscription key is attached to a repository that requires one.
"Release file for ... is not valid yet" — this is unrelated to subscriptions and almost always means your host's clock is wrong. Check timedatectl before assuming it's a repository problem.
Updates work fine but the pop-up keeps appearing — that's expected. Fixing the repository stops the apt errors; it does nothing to the GUI nag screen, which checks your account status independently every time you log in.
Same 401 error, but only for Ceph packages — you fixed the main PVE repository but missed the separate Ceph enterprise repo described in Step 5.
Troubleshooting
If apt update still fails after switching repositories, double-check that you actually disabled the enterprise file rather than just adding the no-subscription one alongside it. Having both enabled at once still triggers the 401, because apt tries every configured source regardless of whether you meant to use it.
Run apt-cache policy pve-manager to see exactly which repositories apt currently thinks are active for that package. It's a quick way to spot a leftover enterprise entry you missed.
If you're on a fresh 9.x install and nothing in sources.list.d looks like what's described above, check for a single combined file instead — some ISO builds ship everything in one proxmox.sources file rather than split by repository. The fix is the same; you're just editing one file instead of two.
Permission errors while editing the files usually mean you're not actually root. Proxmox's shell logs you in as root by default, but if you SSH in as a regular user, prefix your edits with sudo or switch to root with su - first.
Occasionally people find the GUI's Repositories panel simply missing, usually on very old installs that were upgraded in place multiple times. In that case the manual file-editing steps are your only option, and they work exactly the same regardless of whether the GUI panel exists.
Best Practices
Do this right after your first login, before you start creating VMs. It takes less time than making coffee, and it means every update you run afterward actually works instead of quietly failing in the background.
Don't run the enterprise and no-subscription repositories at the same time. It doesn't give you "extra" packages, it just guarantees the 401 error keeps showing up in your logs.
If you do end up buying a subscription later, for a client's production cluster or your own business use, that's the moment to flip back to the enterprise repo, not before. There's no reason to run it unpaid.
If you manage more than one Proxmox node, fix all of them the same way in one sitting rather than one at a time as you happen to notice the error. It's easy to forget a second or third node until an update fails on it months later.
Keep a note of which repository each node is on if you're running a mixed environment — some nodes on the free repo, others on a paid subscription for client work. It sounds obvious until you're troubleshooting an update issue at 11 p.m. and can't remember which box is which.
Frequently Asked Questions
Does this break anything or void a warranty?
No. The no-subscription repository ships the exact same Proxmox VE codebase, just without the extra round of enterprise testing and without paid support access.
Will I miss security updates on the free repository?
No. Both repositories receive the same security fixes. The enterprise repo just gets them slightly later after additional internal testing.
Can I get rid of the pop-up itself, not just the apt errors?
There's a well-known community trick that patches a JavaScript file in the web UI to suppress the pop-up. It's purely cosmetic, entirely unofficial, and gets reverted the next time the pve-manager package updates unless you also add an apt hook to reapply it. Most people just stop noticing the pop-up after a while and don't bother.
Do I need to do this again after every Proxmox update?
No. Once the repository files are correct, they stay that way through normal updates. You'd only need to touch this again after a full reinstall.
What if I only see one repository file instead of two?
Some installer builds combine everything into a single proxmox.sources or pve-install-repo.list file. Open it, find the enterprise line or block, and disable just that part — the underlying fix is identical either way.
Is this the same fix for Proxmox Backup Server?
Conceptually yes — PBS has its own separate enterprise and no-subscription repositories with the same naming pattern, but they're managed independently from PVE. If you're running both on the same hardware, you'll need to fix each product's repositories separately.
Why does Proxmox point new installs at a repo I can't use for free?
It's really just how the installer is configured by default, not a restriction on the free tier. Every feature works identically either way — you're only choosing which package source gets checked for updates.
Conclusion
The "No valid subscription" pop-up and the 401 errors during apt update are two symptoms of the same default configuration, and neither one means your Proxmox install is damaged. Switch to the no-subscription repository through the GUI's Repositories tab, or edit the source files by hand if you'd rather, and your updates will start working normally within a couple of minutes. It's a five-minute task that every new Proxmox user ends up doing once, and now you know exactly where to click.