diff --git a/debian-13-upgrade.md b/debian-13-upgrade.md
index 5fa88ae..4d191dc 100644
--- a/debian-13-upgrade.md
+++ b/debian-13-upgrade.md
@@ -1,6 +1,7 @@
 # Plan: upgrade cogitator-01 from Debian 12 (bookworm) to 13 (trixie)
 
-Status: draft, started 2026-10-31. Nothing here has been run yet.
+Status: done 2026-11-01. The server runs Debian 13.7, kernel 6.12.113.
+The notes below are kept for reference; see "How it went" at the end.
 
 Why: Debian 12 has been LTS-only since June 2026, so fewer packages get
 security fixes. Debian 13 is the current stable release.
@@ -97,3 +98,42 @@ disk over time).
 - Does the netcup plan include snapshots, and how big a snapshot can it
   take? (The server uses 246 GB.)
 - When is a good maintenance window?
+
+## How it went (2026-11-01)
+
+Checked first against the trixie release notes (upgrading and issues
+chapters). Findings that changed the plan:
+
+- **Don't block service restarts** (no `policy-rc.d`). OpenSSH 9.8+ splits
+  sshd into a listener and `sshd-session`; the old listener refuses new
+  connections until it's restarted, which would have locked us out before
+  the reboot. The script restarted `ssh` after the upgrade instead.
+- Interface names: not a risk here. The kernel has `net.ifnames=0`, so the
+  NIC stays `eth0`; the address is static and cloud-init's network config
+  is disabled. Keep `net.ifnames=0` in `/etc/default/grub` (the new
+  `grub.ucf-dist` doesn't have it).
+- BIOS GRUB on `/dev/vda`: ran `grub-install /dev/vda && update-grub`
+  before rebooting.
+
+Steps run: netcup snapshot, S3 backups (Paperless, GoToSocial), bookworm
+fully updated, `/etc` and dpkg state saved to `/root/pre-trixie/`, the
+upgrade run as a `systemd-run` unit (log `/root/trixie-upgrade.log`), one
+reboot. Downtime about 35 minutes.
+
+Results: all 40 containers back; ufw rules, Tailscale, key-only SSH intact;
+public ports still 22, 80, 443, 222; all sites answer; unattended-upgrades
+follows trixie; full-site `bin/deploy --check` has no failures.
+
+Afterwards:
+- Purged `software-properties-common` (not in trixie; it had pulled in
+  PackageKit) and 59 old bookworm libraries.
+- `/tmp` is now tmpfs. The upgrade added `/etc/tmpfiles.d/tmp.conf`, which
+  keeps the old no-cleanup behaviour.
+- systemd's SSH-over-VSOCK generator logged a harmless error on the
+  console; it's now turned off by the common role.
+
+Still to do:
+- Remove the old 6.1.0-54 kernel once Debian 13 has run fine for a while
+  (`apt purge linux-image-6.1.0-54-amd64`).
+- Delete the netcup snapshot once things are stable.
+- Optional: `apt modernize-sources` to move `sources.list` to deb822.
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index c9fc7fa..fdc9ea9 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -41,3 +41,13 @@
       X11Forwarding no
     validate: /usr/sbin/sshd -t -f %s
   notify: reload ssh
+
+# systemd 257 (Debian 13) adds a generator that offers SSH over VSOCK. netcup
+# VMs have no VSOCK device, so it only logs "Failed to query local AF_VSOCK
+# CID" to the console. Normal SSH doesn't use it.
+- name: Turn off systemd's SSH-over-VSOCK generator
+  ansible.builtin.file:
+    src: /dev/null
+    dest: /etc/systemd/system-generators/systemd-ssh-generator
+    state: link
+    force: true