Graphene OS on Pixel phone - how to install secure Android

What will we need?

Hardware

Google Pixel phone (https://grapheneos.org/faq#supported-devices)

Software

Windows, Android or Linux

Procedure - advanced installation via CLI from Linux

1) Open a terminal and check the fastboot version

fastboot --version 

You need at least version 35.0.1. If you don't have it, on Ubuntu you can install Google Android Platform Tools

sudo apt-get install google-android-platform-tools-installer

and now on Ubuntu 25.10 we have fastboot 35.0.2

2) Turn off the firewall on Ubuntu

sudo systemctl stop fwupd.service

sudo apt install android-sdk-platform-tools-common

3) Turn off the phone (Power button + Volume Up for Pixel 9a) and boot into the bootloader. Turn the phone on and hold Volume Down. Unplug/plug the USB back in and unlock the bootloader from the terminal

:~$fastboot flashing unlock 

OKAY [  0.050s] 
Finished. Total time: 0.050s

On the phone, switch to "Unlock the bootloader" and confirm with the Power button.

4) Verify that you have an openssh client

sudo apt install openssh-client

Download the factory key:

curl -O https://releases.grapheneos.org/allowed_signers

% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current 

                                Dload  Upload   Total   Spent    Left  Speed 

100   104  100   104    0     0    144      0 --:--:-- --:--:-- --:--:--   144



 

Download the image for your Pixel model at https://grapheneos.org/releases

Now verify the installation. For example, for the Pixel 9a image from 20260128, do this (adjust as needed):

ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s tegu-install-2026012800.zip.sig tegu-install-2026012800.zip

Finally, extract the image:

bsdtar xvf tegu-install-2026012800.zip

go into the created folder and flash GrapheneOS onto the phone, wait a few minutes...

cd tegu-install-2026012800/
bash flash-all.sh

Wait a few minutes... once it's finished, lock the bootloader back up:

fastboot flashing lock

and confirm the lock on the phone. The phone will restart and voilà......you have GrapheneOS