A fresh Proxmox VE install does two things that confuse newcomers. It pops up a dialog at every login saying you have no valid subscription, and the first time you run apt update it fails with a 401 error. Neither means anything is broken. They’re both side effects of the server being pointed at the enterprise package repository, which needs a paid key.
Proxmox is free and fully functional without that subscription. The fix is to switch the server to the no-subscription repository so it can pull updates, and — if the login popup genuinely bothers you — to understand what it is before deciding whether to touch it.
This guide covers the difference between the two repositories, how to disable the enterprise one and add the no-subscription one from both the GUI and the command line, why the 401 happens, and the careful way to think about removing the nag dialog without breaking your ability to update. Steps target Proxmox VE 8.x on its Debian 12 base.
Enterprise vs no-subscription: what’s the difference
Proxmox ships its updates through two main repositories, and the only one enabled on a new install is the one most home and lab users can’t access.
Proxmox VE package repositories
| pve-enterprise | Default on a fresh install. Requires a paid subscription key. Packages get the most testing before release — the stable channel for production with support. |
|---|---|
| pve-no-subscription | Free, no key needed. Same software, packages released a little earlier with less testing. The normal choice for labs and many small deployments. |
| pvetest | Bleeding edge. New features and fixes land here first, least tested. For testing only — don't run it on anything you care about. |
The important thing: the no-subscription repo isn’t a crippled or pirated version. It’s the same Proxmox, maintained by the same people. The enterprise repo’s value is the extra testing and the support contract behind it. For a homelab, a single host, or a small setup where you can absorb a little more update risk, no-subscription is the expected path.
Why apt update throws a 401
When you run apt update on an untouched install, you’ll see something like this:
Err:1 https://enterprise.proxmox.com/debian/pve bookworm InRelease
401 Unauthorized [IP: ...]
E: Failed to fetch https://enterprise.proxmox.com/debian/pve/dists/bookworm/InRelease 401 Unauthorized
E: The repository '...' is not signed.That 401 Unauthorized is the enterprise server rejecting the request because there’s no subscription key attached to it. apt treats a repo it can’t reach as a hard failure and stops, which is why updates appear completely broken on a new box. Nothing is actually wrong with the server — it’s asking the wrong place for packages. Point it at the no-subscription repo and the error goes away.
Fix it in the GUI (the easy way)
Proxmox VE 8.x has a repository manager built into the web interface, and it’s the safest way to make this change because it won’t let you create a malformed entry.
- In the web GUI, select your node in the left tree (not Datacenter — the node below it).
- Go to Updates → Repositories.
- Find the row for
pve-enterprise, select it, and click Disable. - If there’s a
cephenterprise repository listed, disable that one too. - Click Add, choose No-Subscription from the dropdown, and confirm.
The panel shows each repository’s status with a colored indicator, so you can see at a glance that enterprise is now disabled and no-subscription is active. Click Refresh (or run apt update from a shell) and the 401 is gone.
Fix it from the command line
If you prefer a shell, or you’re scripting a fresh install, the same change is a few commands. The enterprise repos live in their own files under /etc/apt/sources.list.d/.
First, disable the enterprise repository by commenting out its line:
# comment out the PVE enterprise repo
sed -i 's/^deb/# deb/' /etc/apt/sources.list.d/pve-enterprise.listIf a Ceph enterprise repo file exists, do the same to it:
# only if this file exists on your system
sed -i 's/^deb/# deb/' /etc/apt/sources.list.d/ceph.listNow add the no-subscription repository. On Proxmox VE 8.x (Debian 12, codename bookworm):
echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription" \
> /etc/apt/sources.list.d/pve-no-subscription.listRefresh the package lists and upgrade:
apt update && apt full-upgrade -yThe 401 should be gone and packages should download from the no-subscription repo. If the kernel was updated, reboot to load it.
About the login nag — and why to be careful removing it
This is the part people actually search for, so let’s be straight about it. The subscription notice is rendered by a JavaScript file that ships with the proxmox-widget-toolkit package. You can edit that file to stop the popup appearing, and plenty of community scripts do exactly that.
Two things to understand before you do:
- It’s unsupported and temporary. Every time
proxmox-widget-toolkitupdates — which happens regularly — the file is replaced and the nag comes back. You’d be re-applying the edit after upgrades, possibly forever. - A bad edit can break the web GUI. The notice lives in the same file as a lot of other interface code. A careless find-and-replace that doesn’t match the current version’s code can leave you with a blank or broken panel, and now you’re fixing the GUI instead of dismissing a popup.
If you decide it’s worth it anyway, the safest approach is an edit that fails safe and survives in a controlled way. A common pattern is a small dpkg post-invoke hook that re-applies a precise patch after each update, written so that if the patch doesn’t match, the original file is left untouched rather than mangled.
A reasonable middle ground that many admins settle on: switch the repo so updates work, leave the popup in place, and just click OK. It costs one click per login session and there’s nothing to maintain or re-patch.
Quick checklist
After switching repositories
- pve-enterprise repository disabled (and ceph enterprise, if present)
- pve-no-subscription repository added with the correct Debian codename
- apt update runs cleanly with no 401 error
- apt full-upgrade completed and the host rebooted if the kernel changed
- Decided whether the login nag is worth touching (usually: leave it)
- A backup routine in place before applying big upgrades
Wrapping up
The subscription notice and the apt 401 are the same story told two ways: a new install points at a repository you can’t use without paying. Disable the enterprise repo, add the no-subscription repo with the right codename for your Debian base, and the server updates normally. That’s the whole fix, and it’s fully supported.
The login popup is cosmetic. You can remove it, but the methods are unsupported, get overwritten on the next toolkit update, and carry a small risk of breaking the GUI — so weigh that one click against the upkeep before diving in. If you’re setting up a host from scratch, the repository switch is part of installing Proxmox VE on bare metal, and once updates are flowing it’s worth getting backups in place before you run a big upgrade. If you’re still deciding how to lay out storage, LVM vs LVM-Thin vs ZFS covers the options. For more walkthroughs, browse the Proxmox guides.
