Install

Installing on a Pixel 8 Pro from a computer with fastboot. The steps follow the GrapheneOS command line install guide, adapted to our builds. If something here differs from that guide and isn't about our signing key, their guide is likely right; read it alongside this page.

Before you start

• Supported device: Pixel 8 Pro (codename husky) only. Don't flash these images on any other model.
• The phone must allow OEM unlocking. Some carrier-sold phones don't; if the switch below is greyed out, you can't install.
• A computer with a current version of Google's Android SDK Platform-Tools (fastboot, adb) and a good USB cable. On Linux you may need the udev rules for Android devices; on Windows, Google's USB driver. The GrapheneOS guide covers both.
• Back up anything you want to keep. It will all be erased.

1. Download and verify

Releases are published at github.com/os-ivan-gg/releases, one release per build, tagged with the build number. Each holds the install zip, husky-install-<build>.zip, and a checksum file, SHA256SUMS-<build>. The release notes list the same SHA-256 values.

The release tagged updates holds the files the phone's built-in updater reads. You don't need it to install.

Verify the SHA-256 of the install zip against the release notes and the SHA256SUMS-<build> file before flashing:

# Linux
sha256sum husky-install-*.zip
# macOS
shasum -a 256 husky-install-*.zip
# Windows (PowerShell)
Get-FileHash husky-install-*.zip -Algorithm SHA256

If the checksum doesn't match, delete the file and download it again. Don't flash a file that doesn't match.

2. Enable OEM unlocking

1. In the phone's current OS, open Settings → About phone and tap Build number seven times to enable Developer options.
2. Open Settings → System → Developer options and turn on OEM unlocking. The phone may need an internet connection for the switch to become available.

3. Unlock the bootloader

1. Boot into the bootloader: turn the phone off, then hold volume down while pressing power. Or, with USB debugging on, run adb reboot bootloader.
2. Connect it to the computer and check that it is seen:

   fastboot devices

3. Unlock:

   fastboot flashing unlock

   Confirm on the phone with the volume keys and the power button. This wipes the phone.

4. Flash the factory images

Extract the install zip and run the flash script from inside its folder, with the phone still in the bootloader and connected:

unzip husky-install-<build number>.zip
cd husky-install-<build number>
./flash-all.sh          # Linux, macOS
flash-all.bat           # Windows

Wait until it finishes and the phone is back in the bootloader. Don't unplug the phone while it runs.

Flash our key (avb_custom_key)

Then, still in the bootloader and from the same folder, flash our public key. The install zip includes it as avb_pkmd.bin:

fastboot erase avb_custom_key
fastboot flash avb_custom_key avb_pkmd.bin

The flash script may already do this; that is still to be confirmed on the first install, so run the commands anyway. Flashing the same key twice is harmless.

About our keys

Builds are signed with our own keys, generated on 2026-10-13. Their certificates use CN=os.ivan.gg. These are not GrapheneOS's keys: official GrapheneOS releases and updates won't install over our builds, and ours won't install over theirs without a wipe. A locked phone only boots a build whose key is in avb_custom_key.

The signing keys are kept with an offline backup by the maintainer.

5. Lock the bootloader

Locking turns on full verified boot and stops anyone from flashing the phone over USB. Don't skip it: see why an unlocked bootloader is unsafe.

fastboot flashing lock

Confirm on the phone with the volume keys and the power button. This wipes the phone again.

6. First boot

On a locked phone running our build, the Pixel shows a yellow notice at boot saying it runs a different operating system, with the fingerprint of the key. That notice is normal for any OS signed with its own key, GrapheneOS included, and can't be removed. Check the fingerprint against ours:

Verified boot key fingerprint (SHA-256 of avb_pkmd.bin):

65894abf 95040084 e7f27ff8 cb8e0d29
1b04abc2 66103fb8 8cef5e0c 8c8bf161

Once the phone has booted and you've checked it, go back to Developer options and turn OEM unlocking off. Leave it on until then.

Setting up

• Setup offers the protected space right after the screen lock step. You can skip it and set it up later from Settings.
• The everyday profile and the protected space both use PINs, of at least 6 digits.
• All PINs share one length: the length of the everyday PIN you choose at setup. The protected space PIN, the duress PIN and the reboot PIN must have the same number of digits. Changing later to a longer PIN means setting the phone up again, so pick the length you want to keep.
• The protected space PIN must differ from the everyday PIN. The duress and reboot PINs must differ from both.
• The duress PIN is optional. The duress and reboot PINs are managed only inside the protected space, not from the everyday profile.
• PIN auto-confirm (unlock without pressing enter) is off by default. You can turn it on in the everyday profile's Settings → Screen lock.
• Fingerprint unlock works for the everyday profile only.
• Calls work in the protected space. Text messages arrive in the everyday profile only.
• Android's own private space can't be used beside the protected space. Setup won't create a protected space while a private space exists.
• In the everyday profile the Vanadium browser is labelled "Browser".
• The boot animation shows "os.ivan.gg" until the first setup is done, then the plain Android logo.

Updates

• The built-in updater reads the rolling release tagged updates, which holds husky-ota_update-<build>.zip and the channel file husky-stable. Updates are signed with the same release key and checked on the phone before installing.
• New GrapheneOS releases are tracked automatically: our changes are rebased and rebuilt on each new GrapheneOS stable release. Publishing a release is still done by hand, and each release says which GrapheneOS release it is based on.

Going back

To leave os.ivan.gg, follow the install guide of the OS you want (for example GrapheneOS) from the unlock step. That wipes the phone. If you go back to the stock OS, run fastboot erase avb_custom_key before locking the bootloader.