Just finished an in-place upgrade to Qubes OS 4.3.0 and overall—this release is fantastic. Everything feels tighter, cleaner, and more refined. Huge props to the Qubes team.
One important cleanup caveat from the upgrade process that’s easy to miss.
Before running the full dom0 upgrade, I upgraded all my templates first (Fedora 41 → 42, Debian 12 → 13). After everything completed, I went to clean up and delete the old fedora-41-xfce template. Even though all AppVMs and child templates had already been migrated, Qubes refused to let me delete it, saying it was still in use.
So I dug in.
From dom0, I ran:
qvm-ls | grep dvm
That’s when I found the issue—default-mgmt-dvm was still using fedora-41-xfce as its template.
What’s worth calling out here is that everything looked fine in the GUI. I had already switched templates over, checked Qube Manager, and nothing obvious was flagging Fedora 41 as still being in use. The dependency that was blocking deletion didn’t really surface until I checked it directly from the dom0 command line.
I confirmed it with:
qvm-prefs default-mgmt-dvm template
Sure enough, it was still pointing at Fedora 41—despite everything else being migrated.
The fix was straightforward and in dom0:
qvm-prefs default-mgmt-dvm template fedora-42-xfce
After that, I rebooted (important), then rechecked:
qvm-ls | grep dvm
qvm-ls | egrep 'fedora-41|debian-12'
Everything was clean.
At that point, the old Fedora 41 and Debian 12 templates deleted without any issues.
Final sanity checks:
cat /etc/qubes-release
qvm-check --all
Fully on Qubes OS 4.3.0, no dangling dependencies, no hidden blockers.
Not a bug—just a very Qubes-specific edge case that’s easy to miss if you don’t explicitly inspect DVM template bindings from dom0.
Hope this helps someone else avoid a “why the hell won’t this old template delete?” moment.
And yeah—dear god, this upgrade is glorious. Absolute banger of a release.
On to the Whonix 17 → 18 upgrade now, then she's ready to rock!
View quoted note →
#IKITAO #OPSEC #INFOSEC #QubesOS