Graphics Drivers

devserver has an MSI GeForce RTX 3050 LP 6G OC, which is an NVIDIA card, and this chapter gets it working properly. NVIDIA drivers are the one place where a Debian install regularly needs extra work: the good driver is not part of Debian's free software, it has to be compiled against your kernel, and Secure Boot adds a further step. None of it is hard once you know the order, and it is also the chapter where the habit from Chapter 3 (check first, change second) pays off most.

Your Card

The RTX 3050 LP 6G OC is a low-profile, single-slot card built on NVIDIA's Ampere architecture, with 6 GB of GDDR6 memory. MSI lists it as a 70 W card that takes all its power from the PCIe slot, with no separate power connector. That settles the two worries from Chapter 1. It is designed for exactly the kind of low, small-form-factor case you have, and it should not need a bigger power supply or an extra power lead. You should still check that the box includes a bracket that matches your case, and make sure the card is seated firmly.

Two Drivers to Choose From

A development desktop can run happily on nouveau, and if you only need a working screen, that is a fair choice. But you have a 3050 for a reason, and you may one day want CUDA or machine-learning tools, so this chapter installs the proprietary driver. Debian 13 packages the 550 series (550.163.01), which supports Maxwell-generation cards up to Ada and Hopper, so your Ampere card is covered.

Step 1: Check Before You Change

Confirm that Linux can see the card, and find out what it is using now. Also find out whether Secure Boot is on, because that decides whether you need Step 5.

In the lspci -k output, look for the line Kernel driver in use:. Right now it is probably nouveau. If lspci shows no NVIDIA device at all, stop: reseat the card, check the BIOS/UEFI setting that chooses the primary display (it may be set to the integrated graphics), and try again. The rest of the chapter assumes the card is detected. mokutil --sb-state prints either SecureBoot enabled or SecureBoot disabled.

Step 2: Enable the non-free Component

Chapter 2 left non-free off on purpose. Now there is a reason to turn it on. Open /etc/apt/sources.list.d/debian.sources and add contrib and non-free to the Components: line of both stanzas, so each reads:

You can make the edit by hand with sudo nano (or sudo vim), or make a backup and let sed change both lines at once:

Afterwards, apt policy nvidia-driver should show a Candidate version. Before this step apt could not find the package at all, because it lives in non-free. That is the Chapter 3 check in action.

Step 3: Install the Driver

Choose the proprietary flavour, not the open one

Debian also offers an open flavour of the module (nvidia-open-kernel-dkms) for newer cards, and your Ampere card would be supported. But the Debian wiki reports that the open flavour of the 550 driver stopped compiling as of kernel 6.12.100, and recommends the proprietary flavour. That is why this chapter installs nvidia-kernel-dkms.

Step 4: Wayland Settings

GNOME on Debian 13 runs on Wayland by default. For NVIDIA cards to work well with Wayland, the driver's nvidia-drm module needs a setting called modeset switched on. Check whether it already is, after the first reboot:

Y means it is on and you need do nothing. If it prints N, the Debian wiki recommends creating /etc/modprobe.d/nvidia-wayland.conf with these two lines:

Then run sudo update-initramfs -u and reboot, so the setting is applied early in start-up.

Step 5: Secure Boot and the Machine Owner Key

If mokutil --sb-state said SecureBoot disabled, skip this section. If it said enabled, read on, because the firmware will refuse to load a kernel module that is not signed by a trusted key. Debian signs its own kernel and modules, but a DKMS module is compiled on your machine, so Debian cannot sign it. Instead, DKMS signs it with a key of your own, called a Machine Owner Key (MOK), and you tell the firmware to trust that key once.

DKMS generates the key automatically the first time it builds a module, so the driver install in Step 3 has already created it. Enrol it like this:

On the reboot, a blue MOK Manager screen appears before Debian starts. Follow its on-screen instructions to enrol the key and enter the one-time password you just chose. This step can only be done at the machine's own keyboard at boot time, which is deliberate: it stops malware running inside Debian from approving its own key. Afterwards you can confirm the key is trusted:

Step 6: Verify

dkms status should list an nvidia entry for your kernel with the word installed. nvidia-smi prints a table showing the card's name, the driver version and its memory. If it prints the table, the driver is loaded and talking to the card. If it says it could not communicate with the driver, the module is not loaded: go back to dkms status, and to the Secure Boot step.

Keeping It Working After Kernel Updates

This is the part people forget. A driver that worked yesterday can fail after tomorrow's kernel update. DKMS rebuilds the module for each new kernel, but that build can fail if the driver's source is not yet compatible with the new kernel.

A simple routine avoids nasty surprises. After any apt full-upgrade that installs a new kernel, and before you reboot, check that the module was built for it:

If the new kernel has no installed nvidia entry, do not reboot into it yet. The old kernel is still installed and will still work; keep using it until an updated driver arrives.

If Something Goes Wrong

Hands-On Exercises