How to Install CachyOS: Step-by-Step Guide

CachyOS installs in about ten minutes once the USB stick boots. On our test machine Calamares took 9 minutes 37 seconds from Install Now to the finish screen. The new system came up with the Limine bootloader, a snapshot of the fresh install and the UFW firewall already on. Older guides that tell you to enable firewalld and wire up snapshots by hand no longer match the current ISO.

Original content from computingforgeeks.com - post 167588

This guide covers how to install CachyOS on a UEFI laptop, desktop or VM, from verifying the ISO and writing the stick to every Calamares screen and the first-boot checks. Every step below was run on the CachyOS 260809 desktop ISO (kernel 7.2.11) in a UEFI virtual machine in October 2026.

Check what you need first

CachyOS uses an online installer, so it pulls the packages you select from the mirrors during the install instead of copying them off the stick. That makes the network the one requirement people underestimate, and it is why the CachyOS wiki asks for a stable, reasonably fast connection on top of the hardware basics:

• UEFI firmware where you can turn Secure Boot off
• 3 GB of RAM and 30 GB of disk at minimum, 8 GB and 50 GB on an SSD recommended
• Recommended: an x86-64-v3 capable CPU, which the optimized repositories target
• A USB stick of 8 GB or more that you can wipe
• Wired Ethernet or Wi-Fi that will stay up for the whole install

Our test VM had 4 cores, 6 GB of RAM and a blank 40 GB disk, which is a floor for following along. Plasma used about 1.1 GB of RAM after login and the fresh system took 7.8 GB of disk. A laptop you plan to game or compile on wants the recommended numbers or more. The ISO itself is 3.19 GB, which fits on a 4 GB stick, but the wiki asks for 8 GB, and a cheap 8 GB stick costs less than the time a failing one wastes. If you need a new one, our USB flash drive picks list the drives we’d buy, with the specs that matter for a boot stick. Back up anything on the target disk before you start, because the install path below erases it.

Download and verify the CachyOS ISO

CachyOS publishes a new desktop ISO every month or two and names it after its build date, so the file name changes with every release. The download page always links the current build, and the commands below read the build number from that page so you never paste a stale file name. Run them on the Linux machine you’ll use to write the stick:

CACHY_BUILD=$(curl -sL https://cachyos.org/download/ | grep -oE "ISO/desktop/[0-9]{6}/" | head -1 | cut -d/ -f3)
echo "${CACHY_BUILD}"
ISO="cachyos-desktop-linux-${CACHY_BUILD}.iso"
BASE="https://cdn77.cachyos.org/ISO/desktop/${CACHY_BUILD}"

You should see a six-digit build such as 260809. An empty line means the page layout changed, in which case copy the link from the download page by hand. Next, pull the ISO with its checksum and detached signature from the same directory:

wget "${BASE}/${ISO}" "${BASE}/${ISO}.sha256" "${BASE}/${ISO}.sig"

Check the checksum first. A truncated download still boots sometimes and then fails halfway through the install, which is a far worse place to find out:

sha256sum -c "${ISO}.sha256"

A good download prints a single OK line:

cachyos-desktop-linux-260809.iso: OK

The checksum only proves the file matches the mirror. The signature proves the file came from CachyOS, so import their signing key and verify it the way the CachyOS download wiki describes:

gpg --keyserver hkps://keys.openpgp.org --recv-key F3B607488DB35A47
gpg --verify "${ISO}.sig" "${ISO}"

Look for Good signature from "CachyOS <[email protected]>" and a primary key fingerprint ending in F3B6 0748 8DB3 5A47. The warning that the key is not certified is normal for a key you just fetched and haven’t signed yourself; a BAD signature line is not, and means you delete the file and download again:

gpg: Signature made Sun Aug  9 16:30:06 2026 UTC
gpg:                using RSA key 882DCFE48E2051D48E2562ABF3B607488DB35A47
gpg: Good signature from "CachyOS <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 882D CFE4 8E20 51D4 8E25  62AB F3B6 0748 8DB3 5A47

Both checks passed on our download, which came off the cdn77 mirror in just over three minutes (15:29:22 to 15:32:26 UTC by the download log).

Write the ISO to a USB stick

CachyOS ships a hybrid ISO image, so you write it to the whole stick as raw bytes rather than copying files onto it. On Linux, dd does that with no extra software, but it will just as happily overwrite your system disk if you give it the wrong device name. Unplug other USB drives, plug the stick in and list the block devices with the transport column:

lsblk -o NAME,SIZE,RM,TRAN,MODEL

Our builder had two USB-attached disks at that moment, sda and sdb, which is exactly the situation where a guess goes wrong. External USB drives show TRAN usb too, so match the SIZE and MODEL to the stick you are about to wipe:

NAME     SIZE RM TRAN   MODEL
sda        8G  1 usb    QEMU HARDDISK
sdb        8G  1 usb    QEMU HARDDISK
sr0        4M  1 ata    QEMU DVD-ROM
vda       40G  0 virtio 
├─vda1  38.9G  0 virtio 
├─vda13 1023M  0 virtio 
├─vda14    4M  0 virtio 
└─vda15  106M  0 virtio 

Put the device in a variable so every later command hits the same disk. Replace sdX with the NAME of your stick from lsblk; on many laptops sda is the system SSD, so never copy a name from a guide:

export USB_DEV=/dev/sdX

Re-check the device, unmount every partition on it, and write the image. Desktops mount a stick as soon as you plug it in, and dd onto a mounted device can leave a corrupt write. “not mounted” messages are harmless; “target is busy” means something still has the stick open, so close it and unmount again. The dd only runs if the device really is on the USB bus. If the guard fails it prints nothing and writes nothing, so a line that returns at once with no progress output means USB_DEV needs another look:

lsblk -o NAME,SIZE,RM,TRAN,MODEL,MOUNTPOINTS "${USB_DEV}"
sudo umount "${USB_DEV}"?*
[ "$(lsblk -dno TRAN "${USB_DEV}")" = usb ] && sudo dd if="${ISO}" of="${USB_DEV}" bs=4M status=progress conv=fsync

The conv=fsync flag makes dd flush the data to the stick before it exits. On our latest run of that exact block the progress counter passed 3.1 GB at 8 seconds, but the command only returned once the cache was flushed, at 18.1 seconds. Our stick was a virtual disk on fast storage, so expect a few minutes on a real USB 3 stick:

760+1 records in
760+1 records out
3188850688 bytes (3.2 GB, 3.0 GiB) copied, 18.0875 s, 176 MB/s

Then read the image back so you can trust the stick completely. Flushing the device’s cached pages first makes the readback come from the stick rather than from RAM, and the two hashes must be identical:

sudo blockdev --flushbufs "${USB_DEV}"
sudo head -c "$(stat -c %s "${ISO}")" "${USB_DEV}" | sha256sum
cat "${ISO}.sha256"
sudo eject "${USB_DEV}"

Ours matched on every run (959f6577...e33c on both lines). If you’re on macOS or want a graphical tool, our bootable USB guide for macOS and Linux covers balenaEtcher, Ventoy and the macOS dd variant. The CachyOS wiki also lists Ventoy, and the Ventoy multi-boot setup lets one stick carry several installers, but for this guide we booted the dd-written stick and did not test CachyOS from Ventoy.

Turn off Secure Boot in the firmware

The CachyOS live ISO does not boot with Secure Boot on. The installation wiki says Secure Boot and CSM must be disabled for a UEFI install. Our VM proved the point. With Microsoft keys enrolled, the firmware refused the stick with Access Denied and then reported “No bootable option or device was found”, and after clearing the keys the same stick booted straight to the CachyOS menu.

Every vendor labels the menus differently, but the sequence is the same on the machines we’ve set up:

1. Press the setup key at power-on (F2, F10, F12, Del or Esc on most machines)
2. Find Secure Boot under the Security or Boot tab and set it to Disabled
3. Turn off CSM or Legacy boot if it is enabled
4. Save, reboot and pick the USB stick from the one-time boot menu

Your vendor’s manual has the exact key. On ASUS boards, the CachyOS wiki notes that setting OS Type to Other OS is what disables Secure Boot.

Turning it off is not permanent. CachyOS supports Secure Boot on the installed system with sbctl and your own keys, and the wiki has separate steps for Limine, systemd-boot and GRUB. We didn’t run the sbctl enrolment in this test, so follow the wiki for that part.

Boot the CachyOS live environment

On UEFI the stick boots into a GRUB menu titled with the ISO build. The default CachyOS entry uses the current linux-cachyos kernel and is the one to pick on most hardware. CachyOS LTS Kernel is the fallback if the live session hangs, and Legacy Hardware (GPU nomodeset) is for graphics cards that show a black screen once the kernel takes over:

After five seconds the menu boots the default entry. The live session logs in automatically to KDE Plasma and opens CachyOS Hello, which is where the installer lives:

Connect to the network before you go further, either with a cable or through the Wi-Fi icon in the system tray. The installer ranks mirrors and downloads every package during the install, so a connection that drops halfway leaves you with a failed install and a reboot back into the live ISO.

Run the Calamares installer

Click Launch installer in CachyOS Hello. The installer is Calamares with CachyOS’s own pages, and the step bar along the bottom shows the whole route: Welcome, Location, Keyboard, Bootloader, Partitions, Desktop, Packages, Users, Summary, Install and Finish. Nothing touches the disk until you confirm on the Summary page, so you can go back and change any answer before that.

Welcome, location and keyboard

Welcome sets the installer language and the default system language. Pick yours and click Next:

Location uses geo-IP to drop a pin on the map, and it guessed Nairobi correctly for our lab. The Region and Zone dropdowns override it, and the two Change… buttons set the system language and the number and date format separately, which matters if you want English menus with local date formats:

Keyboard model defaults to Generic 105-key PC, which suits almost every laptop and desktop keyboard. Pick the layout and type a few characters into the test field, especially symbols like @ and #, because a wrong layout is the usual reason a password stops working at the first login:

Click Next once the test field shows exactly what you typed.

Bootloader

CachyOS offers GRUB, rEFInd, rEFInd + AI SDK, systemd-boot and Limine, and the current ISO preselects Limine. Keep it. Limine is the only option here that CachyOS wires to Btrfs snapshots without extra work: its limine-snapper-sync service adds a Snapshots menu at boot, which you’ll see working later in this guide:

GRUB, rEFInd and systemd-boot still have a place, and the CachyOS boot manager comparison lays out the trade-offs. GRUB gets snapshot entries through grub-btrfs-support and can unlock an encrypted /boot. systemd-boot is the simplest UEFI loader but has no native snapshot booting, because the kernels live on the boot partition. Each loader also wants a different EFI partition size, which is why the next page sized ours at 4 GB. We installed with Limine only, so the GRUB, rEFInd and systemd-boot paths are untested here.

Partitions

This is the screen that decides what gets erased. Pick the internal disk from Select storage device and check the size, because the USB stick shows up in the same list. Erase disk wipes the whole device and builds a fresh GPT layout; Manual partitioning is for dual-boot and custom layouts:

With Limine selected, Erase disk planned a 4 GiB FAT32 partition mounted at /boot and gave the remaining 36 GiB of our 40 GiB disk to Btrfs. Keep btrfs in the filesystem dropdown, since the snapshot setup depends on it. The dropdown also offers xfs, ext4, f2fs and zfs:

Two caveats from the wiki before you pick. It says manual partitioning is strongly preferred and that Install alongside and Replace partition are “not 100% reliable”, so for a dual-boot machine, plan the partitions yourself. We used Erase disk because the whole disk was going to CachyOS. The Encrypt system box adds LUKS full-disk encryption with a passphrase at every boot; it’s the right call on a laptop that leaves the house, but we left it off in this run, so that path is untested here.

Desktop and packages

Desktop lists 18 desktops and window managers plus No Desktop for a command-line install. Plasma is preselected and it’s what CachyOS Hello and the rest of this guide assume, so pick it unless you already run something else, such as Hyprland or Niri, from your own dotfiles:

Packages is a tree of optional groups. CachyOS Packages, CachyOS shell configuration, Base-devel + Common packages, your desktop, and Firefox with its language pack are ticked by default. That means base-devel, which you need to build AUR packages, now comes along without you ticking it. Lower down sit Printing-Support, extra HP printer and scanner packages, and Accessibility Tools, so tick printing only if you print:

We kept the defaults and added nothing else, which is the package set the rest of this guide assumes. Anything you skip here installs later with pacman in a few seconds.

Users

Fill in your full name, a login name, the computer name and a password. The hostname is what your shell prompt and your network show, so give it a real name such as cachy01 or thinkpad-t14. Use the same password for the administrator account is ticked by default, which gives root the same password as your user; untick it if you want them separate:

Next stays greyed out until every field validates. On ours it showed “Password is too short” next to the empty password fields, then every field turned green once both matched.

Summary and install

Summary is the last read before anything is written. Check the timezone and keyboard, then read the partition plan line by line. Ours showed a new GPT table on /dev/sda, a 4096 MiB FAT32 partition for /boot and a 36861 MiB Btrfs root:

Click Install, then Install Now on the warning that the change cannot be undone. Calamares worked through 47 jobs on our run, and the progress line tells you which one is running. The longest was the desktop package install at 3 minutes 31 seconds, then pacstrap of the base system at 2 minutes 44 seconds and mirror ranking at 1 minute 19 seconds:

A few of those jobs explain what you’ll find on first boot, so they’re worth knowing:

• pacstrap: installs the base system, Limine and snapper from the mirrors
• packages: installs your desktop and the groups you ticked
• chwd: detects the hardware and applies driver profiles (a QEMU profile on our VM)
• Enable the UFW Firewall as default and allow outgoing but deny incoming
• Creating Btrfs installation snapshot
• Removing installer files from target system

Our install finished 9 minutes 37 seconds after Install Now. The All done screen has a Restart now checkbox that starts unticked, so tick it and click Done, or click Done and reboot from the menu:

Pull the USB stick out when the machine powers down, so the firmware boots the internal disk instead of the live ISO again.

Boot into CachyOS for the first time

The installed system starts in Limine, which shows a CachyOS folder with the linux-cachyos kernel and the linux-cachyos-lts fallback the installer added for you. It boots the first entry after a short countdown, and our VM reached the graphical target 23 seconds after power-on according to systemd-analyze:

Login happens in Plasma Login Manager, not SDDM, so ignore older guides that tell you to edit SDDM files. Type the password you set in Calamares:

CachyOS Hello opens again after login. On the installed system it adds Apps/Tweaks, Install Apps and Troubleshooting, and you can stop it from starting every time with the Launch at start switch:

Open Konsole from the application menu (Ctrl+Alt+T is the Plasma default shortcut) and confirm what got installed. The default shell for new users is fish, so the prompt looks different from bash. The commands from here on work in either shell; the download and USB blocks earlier use bash syntax, so run those in bash. fastfetch is preinstalled:

fastfetch

We captured ours from a root session in the VM through the QEMU guest agent, running fastfetch as our user, and the screenshot shows that exact command. That is also why Shell and Terminal read runuser and qemu-ga, where your Konsole shows your real shell and terminal. It reported 1,196 pacman packages after the paru and Flatpak step further down, KDE Plasma, a Btrfs root at 22% of the 36 GB and the CachyOS kernel:

The kernel string ends in -cachyos and /etc/os-release says ID=cachyos with ID_LIKE=arch. That last line is why Arch packages, the Arch Wiki and the AUR all apply to this system.

Check the firewall and snapshots

Two things that used to be homework are now done by the installer. UFW is installed, enabled and active with incoming traffic denied, and firewalld is not installed at all, so don’t follow advice to enable it. Check the firewall:

sudo ufw status verbose

Defaults read deny incoming, allow outgoing, and the only open rule is KDE Connect on ports 1714 to 1764, which lets your phone pair with the desktop:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
1714:1764/udp (KDE Connect) ALLOW IN    Anywhere
1714:1764/tcp (KDE Connect) ALLOW IN    Anywhere
1714:1764/udp (KDE Connect (v6)) ALLOW IN    Anywhere (v6)
1714:1764/tcp (KDE Connect (v6)) ALLOW IN    Anywhere (v6)             

If you never pair a phone, you can drop that rule later with ufw; we left it in place. Snapshots come next. The installer created a snapper config for the root subvolume, installed snap-pac so every pacman transaction gets a pre and post snapshot, and took one marked important called Fresh CachyOS Installation:

sudo snapper list

Snapshot 6 is the clean state you can always return to. Numbers 1 to 5 came from the installer’s own package work, and 7 and 8 from the paru and Flatpak install in the next section. We ran these checks in the same root session, so the screenshot shows them without sudo:

Snapper’s default config covers only /, so your files in /home live on a separate subvolume and are not rolled back with the system. That is the behaviour you want for an update gone wrong, but it is not a backup of your documents.

Rate the mirrors and run the first update

CachyOS ships cachyos-rate-mirrors, which tests the Arch and CachyOS mirror lists from your location and rewrites them fastest first. Run it before your first big update, because the installer’s ranking was done from the live session and may not suit the network the machine actually lives on:

sudo cachyos-rate-mirrors

It detected our country as KE, ranked the Arch list and then the CachyOS list, and finished in 1 minute 14 seconds. Then update:

sudo pacman -Syu

On a fresh install the answer is usually nothing to do, and ours said exactly that. The online installer downloads current packages at install time, so unlike an offline install there is no backlog from the ISO build date:

:: Synchronizing package databases...
 cachyos-v3 downloading...
 cachyos-extra-v3 downloading...
 cachyos-core-v3 downloading...
 cachyos downloading...
 core downloading...
 extra downloading...
 multilib downloading...
:: Starting full system upgrade...
 there is nothing to do

Notice the -v3 repositories at the top of that list. The installer checked our CPU, found x86-64-v3 support but no AVX-512, and enabled the v3 builds, which is the CachyOS performance feature you get without doing anything.

Install an AUR helper and Flatpak

Older CachyOS installs came with paru. Ours did not: pacman -Q paru returned “package ‘paru’ was not found”, and Flatpak was missing too. Both are in the CachyOS repositories, so one command installs them:

sudo pacman -S paru flatpak

We ran it with --noconfirm --needed, so you’ll get a Y/n prompt we didn’t, and the snapshot names below include those flags. Pacman finished the transaction in 26 seconds, and the last lines show snap-pac taking its post snapshot, which is what you’ll see after every pacman run from now on:

(7/8) Reloading system bus configuration...
(8/8) Performing snapper post snapshots for the following configurations...
==> root: 8

Add Flathub so the flatpak command can install desktop apps from it. The graphical store on CachyOS is Shelly, its own package manager with repository and AUR search, and per the August 2026 release notes its Flatpak support comes from the optional shelly-flatpak-backend package, which we did not install:

sudo flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

Now reboot once and watch the Limine menu. The CachyOS folder has a new Snapshots entry, and opening it lists the three bootable snapshots: the fresh install (6) and the pre and post snapshots of the paru install (7 and 8):

This is your recovery path when an update breaks the desktop. Boot the snapshot from before that update, check the system works, then restore it, either from the restore prompt Limine shows when you boot a snapshot or with Btrfs Assistant. We booted the menu but did not run a restore in this test, so read the CachyOS snapshot guide before you need it.

Open the CachyOS kernel manager

CachyOS Kernel Manager in the app menu installs and removes kernel variants with checkboxes. Our install had linux-cachyos and linux-cachyos-lts ticked, and the list offers bore, eevdf, bmq, hardened, gcc and deckify builds, most in a plain and an LTO-optimized flavour:

Leave the default kernel alone on day one. Keep the LTS kernel installed, because it’s the entry you boot from Limine when a new kernel misbehaves on your hardware. The sched-ext button and the variants are worth a look once you have a reason, and the kernel manager and tuning guide in this series covers when each one pays off.

From here the system is ready to use. The post-install CachyOS checklist covers apps, theming and the gaming setup. If you’d rather build a plain Arch system and pick every package yourself, archinstall on Arch Linux is the closer fit, and if the same machine also needs a Windows installer stick, the Windows 11 USB guide covers that.

Fix CachyOS install boot problems

We hit one boot failure during this test, and it is the one most readers meet first. The second entry is a laptop problem we did not reproduce.

BdsDxe: failed to load Boot0001 … Access Denied

OVMF printed these lines when it refused the stick, word for word from the console:

BdsDxe: loading Boot0001 "UEFI QEMU QEMU HARDDISK " from PciRoot(0x0)/Pci(0x1E,0x0)/Pci(0x4,0x0)/Pci(0x2,0x0)/Scsi(0x0,0x1)
BdsDxe: failed to load Boot0001 "UEFI QEMU QEMU HARDDISK " from PciRoot(0x0)/Pci(0x1E,0x0)/Pci(0x4,0x0)/Pci(0x2,0x0)/Scsi(0x0,0x1): Access Denied
BdsDxe: failed to load Boot0002 "UEFI QEMU QEMU HARDDISK  2" from PciRoot(0x0)/Pci(0x1E,0x0)/Pci(0x4,0x0)/Pci(0x1,0x0)/Scsi(0x0,0x0): Not Found
BdsDxe: No bootable option or device was found.
BdsDxe: Press any key to enter the Boot Manager Menu.

That is the firmware rejecting an unsigned bootloader because Secure Boot is on, and our VM had Microsoft keys enrolled. A physical machine’s firmware words the refusal differently, and some simply skip the stick and boot the internal disk. Turn Secure Boot off as described above and boot the stick again. Ours went straight to the CachyOS GRUB menu once the keys were cleared.

If the stick boots on another machine but not this one, Secure Boot or CSM is still on. If it boots nowhere, run the readback check from the USB section: a hash that doesn’t match the published checksum means a bad write, so write it again before you blame the firmware.

Internal NVMe drive missing from the Partitions step

We did not reproduce this one in the lab, but it is a common laptop trap. Many laptops ship with the storage controller in RAID, Intel RST or VMD mode, and the live kernel then may not show the NVMe drive, so Calamares lists only the USB stick. Switch the storage mode to AHCI in the firmware setup. Be careful on a machine that also runs Windows: changing the mode after Windows is installed can stop Windows from booting, so back up and check Microsoft’s guidance for your machine before you flip it.