Your device has arrived. It is hardened, encrypted, and running GrapheneOS — but it is not yet configured. The first boot is where you set the foundation. A deliberate, minimal setup now prevents messy security compromises later. Rush this step and you spend weeks undoing bad decisions. Take thirty minutes, follow the sequence, and your device starts clean.
Most security failures on mobile devices trace back to the first hour. Users restore old backups full of bloatware and stale permissions. They connect to unknown networks. They install every app they can think of before reviewing a single setting. The result is a device that looks new but carries every bad habit from the old one.
GrapheneOS gives you a genuine fresh start — separate from stock Android in ways that matter. But the operating system cannot protect you from your own impatience. A good first boot is minimal, deliberate, and boring. That is exactly what you want.
When you power on a Pixel running GrapheneOS, you will see a warning screen stating the device is running a different operating system. This is normal. Every Pixel that runs a non-stock OS displays this message. It does not mean your device is compromised, tampered with, or broken. The screen appears because the bootloader verifies the OS image and finds GrapheneOS instead of Google's factory image. Press the power button to continue booting.
If your device was provisioned by Privacy Devices, the bootloader has been re-locked after installation. This means the verified boot chain is intact — GrapheneOS is the verified, expected operating system on your device.
Your first real decision. Choose a PIN, password, or pattern to protect the device. For most users, a random 6-digit PIN is the right balance.
On Pixel hardware, a 6-digit PIN is more meaningful than it sounds. The Titan M2 secure element enforces exponential throttling on failed attempts. After several wrong guesses, delays escalate rapidly — making brute-force attacks against even a 6-digit PIN computationally impractical. A random PIN means no birthdays, no repeated digits, no sequences. Write it down and store it securely offline until you have committed it to memory.
Avoid biometrics as your sole unlock method. Fingerprint unlock is a convenience layer, not a security boundary. Set the PIN first, then optionally add fingerprint access afterward.
You need internet access to check for updates and install apps. Be selective about how you connect.
Use a trusted Wi-Fi network you control, or your own mobile data connection. Do not connect to public Wi-Fi, hotel networks, or shared hotspots during initial setup. If you must use mobile data, insert your SIM or configure your eSIM before proceeding (see the SIM and eSIM Setup guide for details).
GrapheneOS randomises your MAC address per network by default, which is good practice — but connecting to a hostile network during setup still exposes you to unnecessary risk before your device is fully configured.
Before installing anything else, go to Settings > System > System update. Let the device check for and install any available updates. GrapheneOS releases security patches frequently. Your device may have been provisioned days or weeks ago, and patches issued since then need to be applied.
The update system uses A/B partitions — it downloads and installs in the background, then applies on the next reboot. Let the update complete and reboot when prompted.
This is critical. Do not blindly restore a Google backup, a cloud sync, or a full device transfer from your previous phone. Restoring everything defeats the purpose of starting clean. Old backups carry stale app permissions, tracking-heavy applications, accounts you no longer use, and configurations that conflict with a privacy-focused setup.
Start from zero. Install only what you need. If there is specific data you must transfer — contacts, photos, documents — move it manually via encrypted transfer or a USB cable after your device is fully configured.
Resist the urge to install everything at once. Begin with the essentials:
Install these from the App Store (GrapheneOS's F-Droid-compatible app source) or via direct APK from the developer's official site. Do not install sandboxed Google Play yet unless you have a specific, immediate need for it.
GrapheneOS supports multiple user profiles — isolated workspaces with separate apps, data, and encryption keys. Planning your profile structure now saves significant reorganisation later. A practical starting point:
You do not need to create all of these now, but decide on the structure before you start installing apps in the wrong places. See the Profiles and Compartmentalisation guide for full instructions.
Work through these settings before you start daily use:
A hardened operating system is not a magic shield. GrapheneOS provides strong defaults and meaningful isolation, but it cannot override poor decisions made during setup. If you restore a tracking-heavy backup, connect to compromised networks, and install every app you have ever used, you have an expensive phone running good software badly.
The first boot is your single best opportunity to start with discipline. Everything that follows builds on the choices you make in this first half hour.
A good first boot is quiet. Update the OS, set a strong PIN, connect to a trusted network, install only what you need, plan your profiles, and review your settings. No rushing, no bulk restores, no unnecessary apps. Thirty minutes of deliberate setup creates a device that is clean, compartmentalised, and ready for daily use without the security debt that comes from cutting corners.
Just received your device? Follow this guide and you are set.