← All Guides

Wi-Fi, Updates and Patching

Keeping your device patched is the single highest-value security habit you can maintain. GrapheneOS makes this straightforward with automatic background updates, an A/B partition scheme that minimises downtime, and sensible Wi-Fi privacy defaults. This guide covers how the update system works, how to configure Wi-Fi and DNS settings for privacy, and why consistent patching matters more than almost any other setting on your device.

Why it matters

Security vulnerabilities are discovered continuously. Every week, researchers and attackers find new ways to exploit mobile operating systems, drivers, firmware, and applications. Patches close these gaps. An unpatched device is not just theoretically vulnerable — it is running code with known, documented, publicly available weaknesses.

GrapheneOS inherits Android's monthly security patches and adds its own hardening updates. The project typically delivers patches within days of upstream release, often faster than Google pushes them to stock Pixel devices. But none of this matters if you delay applying them. A hardened operating system running three-month-old patches is less secure than a stock device running current ones.

Patching is not glamorous. It is not a feature you show someone. It is the single most reliable way to maintain the security posture your device was built to provide.

How GrapheneOS updates work

GrapheneOS uses an A/B partition scheme for system updates. Here is what that means in practice:

Your device has two system partitions — slot A and slot B. At any given time, one is active (running the current OS) and the other is inactive. When an update is available, GrapheneOS downloads it and installs it to the inactive partition, entirely in the background. You can continue using your phone normally during this process. The update does not interrupt your work.

Once the update is fully installed on the inactive partition, it is ready to apply. On your next reboot, the device switches to the updated partition. If anything goes wrong during the update (rare, but possible), the device falls back to the previous partition automatically. This failsafe design means updates carry very low risk.

Checking for and installing updates

1. Go to Settings > System > System update.
2. The device checks for updates automatically in the background, but you can also tap "Check for updates" to force an immediate check.
3. If an update is available, it will begin downloading automatically.
4. Once downloaded and installed to the inactive partition, you will see a prompt to reboot.
5. Reboot to apply the update. The reboot takes slightly longer than normal as the device finalises the partition switch.

After rebooting, return to Settings > System > System update to confirm the update was applied successfully. The screen will show your current patch level.

Auto-reboot and update application

GrapheneOS includes a configurable auto-reboot timer. When the device has been locked and idle for a set period, it reboots automatically. This serves two purposes:

1. It applies any pending updates that are waiting for a reboot.
2. It re-encrypts the device, clearing sensitive data from memory (returning the device to a Before First Unlock state).

To configure auto-reboot:

1. Go to Settings > Security > Auto reboot.
2. Set the idle timeout. Common choices are 12 hours, 24 hours, or 72 hours depending on your use pattern.
3. The auto-reboot only triggers when the device is locked. It will not reboot while you are actively using it.

A shorter auto-reboot timer means updates are applied faster and your device spends less time in a decrypted-at-rest state. For most users, 24 to 72 hours is a practical balance.

Wi-Fi privacy

GrapheneOS applies meaningful privacy protections to Wi-Fi connectivity by default:

MAC Address Randomisation: Your device generates a random MAC address for each Wi-Fi network it connects to. This prevents networks from tracking your device across visits using a persistent hardware identifier. This is enabled by default and applies per-network — each saved network sees a different randomised MAC address.

To verify or adjust this:

1. Go to Settings > Network & internet > Internet.
2. Tap the gear icon next to a saved network.
3. Look for "MAC address type" — it should say "Randomized MAC."
4. If you need a specific, consistent MAC for a particular network (such as a network with MAC-based access control), you can change this setting per-network. For all other networks, leave it randomised.

Wi-Fi Scanning: Be aware that your device may scan for known Wi-Fi networks in the background, which can reveal information about networks you have previously connected to. You can disable Wi-Fi scanning when not needed by turning off Wi-Fi entirely, or by going to Settings > Location > Wi-Fi scanning and disabling it.

Private DNS configuration

DNS queries — the lookups that translate domain names to IP addresses — are sent in plaintext by default on most systems. This means your ISP, network operator, or anyone monitoring traffic can see which domains you visit. Private DNS encrypts these queries.

To configure Private DNS on GrapheneOS:

1. Go to Settings > Network & internet > Private DNS.
2. Select "Private DNS provider hostname."
3. Enter the hostname of your preferred encrypted DNS provider:
   • Cloudflare: one.one.one.one
   • Quad9: dns.quad9.net
   • Mullvad: dns.mullvad.net
4. Tap Save.

Your DNS queries are now encrypted using DNS over TLS. This applies to all network connections — Wi-Fi and mobile data.

If you are using a VPN, your VPN provider likely handles DNS resolution within the tunnel. In that case, Private DNS configuration may be redundant, but it provides a fallback if the VPN disconnects or for connections outside the tunnel. Check your VPN provider's recommendations.

Why patching matters more than you think

Consider the security features GrapheneOS provides: hardened memory allocator, exploit mitigations, sandboxed Google Play, strict permission controls. All of these are implemented in code. Code has bugs. Bugs get found. When a vulnerability is discovered in any component — the Linux kernel, the Android framework, Pixel firmware, or GrapheneOS-specific code — a patch is the only fix.

No configuration setting, no app, no usage habit compensates for running known-vulnerable code. An attacker does not need to defeat your privacy settings if they can exploit a patched-three-months-ago vulnerability in the Bluetooth stack because you have not rebooted since January.

Patching is not optional maintenance. It is the foundation on which every other security measure stands.

Best practices

• Check for updates at least weekly, even though automatic checks run in the background. Verify that updates are downloading and applying successfully.
• Reboot your device regularly. Even if auto-reboot is configured, a manual reboot ensures pending updates are applied and sensitive data is cleared from memory.
• Keep auto-reboot set to 72 hours or less. Longer intervals leave pending updates unapplied and the device in a decrypted state for extended periods.
• Use Private DNS on every network. There is no practical downside and it eliminates plaintext DNS leakage.
• Do not disable Wi-Fi MAC randomisation unless a specific network requires a fixed MAC address for access control.
• If an update notification appears, do not dismiss it for days. Let the download complete and reboot at your next convenient opportunity.

Common mistakes

• Postponing updates for weeks because "it is working fine." Working fine and being secure are different states.
• Disabling auto-reboot to avoid the inconvenience of re-entering your PIN. The brief inconvenience is the cost of re-encrypting your device and applying updates.
• Forgetting to configure Private DNS after initial setup. The default is "Automatic" which may or may not use encrypted DNS depending on your network.
• Assuming that using a VPN eliminates the need for Private DNS. VPN connections can drop. Private DNS is a reliable baseline.
• Connecting to unknown Wi-Fi networks and assuming MAC randomisation is sufficient protection. A randomised MAC prevents hardware tracking but does not protect against hostile network operators monitoring your traffic.

Reality check

Updates can occasionally introduce bugs or break specific functionality. This is rare on GrapheneOS — the project has a strong track record of stable releases — but it can happen. If an update causes an issue, it is almost always resolved in the next release. Delaying all updates out of fear of breakage is statistically far riskier than applying them promptly.

If an update fails to install, reboot the device and try again. Check your internet connection. If the problem persists after multiple attempts, visit the GrapheneOS community channels for guidance. Do not ignore a stuck update — it means your device is not receiving security patches.

Wi-Fi privacy features reduce tracking but do not make you anonymous on a network. Your traffic content, connection timing, and data volume are still visible to the network operator unless encrypted by a VPN or other transport-layer protection.

Conclusion

The update system on GrapheneOS is well-designed and low-friction. Updates install in the background, apply on reboot, and fail safely if something goes wrong. Pair this with a short auto-reboot timer, Private DNS, and default MAC randomisation, and your device maintains a strong security and privacy baseline with minimal effort. The only requirement is that you do not get in the way — let updates install, reboot when prompted, and treat patching as the non-negotiable habit it is.