How I Stopped Debian from Installing KDE Plasma During a System Upgrade

Why KDE Plasma Appeared During Upgrade

When Debian 12 “Bookworm” landed in early 2025, the default desktop stack for the desktop task was GNOME. A lot of folks, myself included, still had KDE Plasma sitting around from a previous release or a custom install. During a normal apt full-upgrade, the package manager pulls in the newest kde-plasma-desktop meta‑package because it’s part of the kde-standard task, which is automatically enabled by the tasksel configuration that ships with Debian. The result? A silent, automatic installation of a sizeable KDE stack even if you never intended to use it.

That’s a problem for two reasons:

Disk space – KDE drags in dozens of libraries, fonts, and utilities. On a minimal server or thin‑client box, that’s a waste of precious storage.
Security surface – Every extra package is a potential vector for vulnerabilities. If you’re running a hardened system, you want to keep the attack surface as small as possible.

The fix is to tell APT that you do not want any KDE packages to be considered during upgrades. APT pinning is the most reliable way to do this, because it works at the package level and survives apt-get dist-upgrade or apt full‑upgrade. Below is a step‑by‑step guide that shows how to pin KDE Plasma and its dependencies, verify the pinning, and test an upgrade without pulling in the unwanted desktop stack.

Understanding APT Pinning

APT pinning assigns a priority to packages from different sources. The priority is an integer; higher values win. The default priority for packages from the main archive is 500. Packages that are held (via apt-mark hold) have a priority of 1000, which prevents them from being upgraded unless you explicitly unhold them.

The syntax lives in /etc/apt/preferences (or files in /etc/apt/preferences.d/). A simple entry looks like:

Package: libfoo
Pin: release a=bookworm
Pin-Priority: 1000

This forces libfoo to stay at the version currently installed, even if a newer one is available in the archive.

For KDE, we want to lower the priority of all KDE packages so that they are never chosen as upgrade candidates. The trick is to match the package names with a wildcard and set a priority lower than the default (e.g., 400). Packages that match the pattern will be ignored unless a higher‑priority source is available.

Preparing the System

Before you start pinning, back up the current APT configuration and your list of installed packages. This gives you a safety net if the pinning causes a dependency break.

# Backup preferences
sudo cp /etc/apt/preferences /etc/apt/preferences.bak
sudo cp -r /etc/apt/preferences.d /etc/apt/preferences.d.bak

# Record the current package list
dpkg --get-selections > /tmp/installed-packages-$(date +%F).txt

Next, make sure the system is fully updated and that no KDE packages are currently installed. If you already have KDE, you can remove it before pinning to avoid a conflict:

sudo apt purge '^kde-.*' '^plasma-.*' '^sddm$'
sudo apt autoremove

The regular expression above removes any package whose name starts with kde- or plasma-, and also removes the SDDM display manager, which is the default for KDE.

Pinning KDE Packages

Create a new file in /etc/apt/preferences.d/ called kde-pin. The file should contain a single rule that lowers the priority of all KDE packages:

sudo tee /etc/apt/preferences.d/kde-pin > /dev/null <<'EOF'
# Prevent KDE Plasma and related packages from being installed during upgrades
Package: kde-*
Pin: release a=bookworm
Pin-Priority: 400

Package: plasma-*
Pin: release a=bookworm
Pin-Priority: 400

# KDE libraries that are not prefixed with kde- or plasma- but are part of the stack
Package: libplasma*
Pin: release a=bookworm
Pin-Priority: 400

# SDDM, the default KDE display manager
Package: sddm
Pin: release a=bookworm
Pin-Priority: 400
EOF

Why 400?
The default priority for the main archive is 500. Setting 400 means APT will only install these packages if no other source offers a higher priority. If you later decide to install KDE, you can raise the priority back to 500 or remove the pin file.

If you prefer to pin only the meta‑packages and let the user install individual KDE libraries on demand, adjust the patterns accordingly. The key is that the wildcard must match the exact names that APT would otherwise consider.

Verifying the Pinning

After creating the pin file, run:

apt-cache policy kde-plasma-desktop

You should see something like:

kde-plasma-desktop:
  Installed: (none)
  Candidate: (none)
  Version table:
     5.27.0-1 500
        500 http://deb.debian.org/debian bookworm/main amd64 Packages

Because the candidate is (none), APT will not propose installing kde-plasma-desktop. The 500 line is shown for reference but is ignored due to the lower priority.

To double‑check that the pin is applied to all KDE packages, list all pinned packages:

apt-cache policy | grep -E 'kde-|plasma-|libplasma' | grep -v 'Installed:'

If any line shows a priority of 400, the pin is active.

Testing the Upgrade

Now that the pin is in place, perform a simulated upgrade to see what APT would do:

sudo apt update
sudo apt -s full-upgrade

The -s flag tells APT to simulate the upgrade without actually installing anything. Scan the output for any mention of KDE packages. If none appear, the pin is working.

If you still see KDE packages, double‑check the package names. Some KDE components have names that do not start with kde- or plasma-. For example, plasma-workspace or kde-applets might slip through. Add extra rules to the pin file if you spot any.

Once you’re happy, run the real upgrade:

sudo apt full-upgrade

You should see a clean list of non‑KDE packages being upgraded, with no KDE meta‑packages popping up.

When You Do Want KDE

If you decide you do need KDE later, just remove the pin file:

sudo

linux open-source

How I Stopped Debian from Installing KDE Plasma During a System Upgrade – A Practical APT Pinning Example