📱 How to Install GrapheneOS on Google Pixel 9a (Works on All Pixel 9 Series)

IT & Systems
, , , ,
1

:mobile_phone: How to Install GrapheneOS on Google Pixel 9a (Works on All Pixel 9 Series)

Take back your privacy without sacrificing functionality

:locked::shield::prohibited::bar_chart:

I recently installed GrapheneOS on my Pixel 9a, and the privacy improvements over stock Android are significant. This guide walks you through the entire installation process. While I’m using the Pixel 9a as the example, this process works identically for all Pixel 9 series phones (Pixel 9, 9 Pro, 9 Pro XL, and 9 Pro Fold).

Before we jump in, let’s talk about why you’d want to do this.

:magnifying_glass_tilted_left: Why GrapheneOS Over Stock Android or iOS?

Let’s be clear about what GrapheneOS actually does and doesn’t do. This isn’t marketing hype, this is verifiable fact based on the official documentation at Features overview | GrapheneOS.

Privacy Benefits (Factual, Verifiable)

What GrapheneOS eliminates by default:

  • No Google Play Services integrated into the OS (you can optionally install them as sandboxed apps)

  • No Google apps or services running by default

  • No telemetry or data collection from the OS itself

  • No persistent device identifiers leaked to apps

  • No location data sent to Google for network-based location

What stock Android/iOS do by default:

  • Stock Android: Google Play Services has privileged system access and collects usage data, location history, and app activity

  • iOS: Apple services collect usage analytics, Siri requests, location data, and App Store activity

  • Both: Regular OS updates that may change privacy policies or add new data collection

Hard truth about carrier tracking:

GrapheneOS protects your privacy from apps and services, but your phone carrier can still track your location through cell tower connections. That’s unavoidable with any phone using cellular service. GrapheneOS doesn’t fix that, but it does eliminate the additional tracking layers from Google, Apple, app developers, and advertisers.

Security Improvements (Verifiable at Features overview | GrapheneOS)

  • Hardened memory allocator that prevents common exploit techniques

  • Sandboxed Google Play (if you install it) with no special system privileges

  • Hardware memory tagging on supported devices

  • Network permission toggle (disable internet access per-app)

  • Sensors permission toggle (block accelerometer, gyroscope, etc.)

  • Storage Scopes and Contact Scopes (granular permission control)

  • Auto-reboot feature (puts device back to encrypted state after set time)

What About Google Services?

Important clarification: You can install Google Play Services on GrapheneOS through their sandboxed implementation. This is NOT a workaround or Terms of Service violation, it’s an officially supported feature documented at Usage guide | GrapheneOS.

The catch: You still need a Google account and phone number to use Google Play Services. GrapheneOS doesn’t bypass that requirement, it just runs Play Services as a regular sandboxed app instead of giving it privileged system access.

Many apps work fine without Google Play Services. Some don’t. You decide which apps you need and whether you want to install sandboxed Play for them.

:bullseye: What This Guide Covers

This guide covers:

  • Installation using the official GrapheneOS web installer

  • What to expect during the process

  • Basic verification that it worked

This guide does NOT cover:

  • Alternative app stores (F-Droid, Aurora, etc.) - that’s a future post

  • Detailed configuration and hardening - that’s a future post

  • Installing sandboxed Google Play - covered in GrapheneOS documentation

I’m only sharing what I’ve personally verified and tested.

:warning: Prerequisites (READ THIS FIRST)

What You Need

Hardware:

  • Google Pixel 9a (or any Pixel 9 series phone)

  • USB-C cable (use the one that came with your phone)

  • Computer with at least 2GB RAM and 32GB free storage

  • Direct USB port (avoid hubs, use rear ports on desktops)

Important: Carrier-locked phones may not allow bootloader unlocking. Buy unlocked directly from Google if possible.

Software:

  • Windows 10/11, macOS (Sonoma or newer), or Linux (Ubuntu, Debian, Arch)

  • Updated web browser: Chrome, Edge, Brave, or Chromium

  • Do NOT use Incognito/Private browsing mode

  • Do NOT use Flatpak or Snap browser versions

Before You Start:

  1. BACKUP EVERYTHING. This process wipes your phone completely.

  2. Charge your phone to at least 80%

  3. Update to the latest stock Android version

  4. Have 1-2 hours available (actual install is 30 minutes, but budget extra time)

What Gets Wiped

Installing GrapheneOS will erase:

  • All apps and app data

  • All photos and videos (unless backed up)

  • All contacts (unless synced to Google/other service)

  • All messages and call history

  • All accounts and passwords stored on device

  • Everything. Seriously. Back up what matters.

:clipboard: Installation Process

Step 1: Enable OEM Unlocking

On your Pixel 9a running stock Android:

  1. Go to Settings > About phone

  2. Tap Build number 7 times to enable Developer Options

  3. Go to Settings > System > Developer options

  4. Toggle on OEM unlocking

  • This requires internet connection for verification

  • If it’s grayed out, your device may be carrier locked

Step 2: Set Up Your Computer

Linux users only:

  • Arch: Install android-udev package

  • Debian/Ubuntu: Install android-sdk-platform-tools-common package

  • Stop fwupd if running: sudo systemctl stop fwupd.service

Windows users:

  • Windows 10/11 includes the driver by default

  • If needed, Windows Update will detect it as optional update when phone is connected

Step 3: Boot Into Bootloader

  1. Power off your Pixel 9a completely

  2. Hold Volume Down button

  3. While holding Volume Down, press Power button

  4. Keep holding Volume Down until you see “Fastboot Mode” with red warning triangle

  5. Do NOT press power to select “Start” - stay in Fastboot Mode

Step 4: Run the Web Installer

  1. Go to Web installer | Install | GrapheneOS in your browser

  2. Connect your phone to computer with USB-C cable

  3. Click “Unlock bootloader” button in the web installer

  4. On your phone: Use volume buttons to select “Unlock” and power button to confirm

  • This wipes all data on the phone
  1. Click “Download release” button
  • This downloads ~2GB, be patient
  1. Click “Flash release” button

  • Phone will automatically flash firmware, reboot, and install GrapheneOS

  • Do NOT touch the phone during this process

  1. Click “Lock bootloader” button

  • Use volume buttons to select “Lock” and power button to confirm

  • This wipes data again (security feature)

  1. Phone will reboot into GrapheneOS

The entire flashing process takes about 15-30 minutes. Let it finish completely.

:white_check_mark: Verification

Visual Verification

When you boot GrapheneOS for the first time:

  1. You’ll see a yellow warning screen showing the verified boot key hash

  2. For Pixel 9a, the hash should be: 0508de44ee00bfb49ece32c418af1896391abde0f05b64f41bc9a2dfb589445b

  3. Verify this matches the official hash at Web installer | Install | GrapheneOS

Using Auditor App

For stronger verification:

  1. Install Auditor app from GrapheneOS app store on your newly installed phone

  2. Install Auditor on a second Android device (or use https://attestation.app/)

  3. Follow the tutorial at Tutorial | attestation.app

  4. This verifies the hardware, firmware, and OS are genuine

:rocket: First Boot and Setup

During initial setup:

  1. Set your language and region

  2. Connect to Wi-Fi (or skip and use mobile data)

  3. Set screen lock (PIN, password, or pattern)

  • GrapheneOS supports up to 128 character passwords

  • Use a strong passphrase if you’re serious about security

  1. Important: On the final setup screen, leave “Disable OEM unlocking” CHECKED
  • This prevents bootloader from being unlocked without your permission

GrapheneOS will ask much less of you than stock Android. No Google account required, no services to opt into, just the basics.

:mobile_phone: What’s Different After Installation

Apps Included by Default

GrapheneOS includes:

  • Vanadium browser (hardened Chromium)

  • GrapheneOS Camera app

  • PDF Viewer

  • Auditor (for device verification)

  • Apps app (GrapheneOS app store)

That’s it. Everything else you install yourself.

The Apps App

GrapheneOS includes an app called “Apps” (yes, really). This is their app store and currently only has:

  • GrapheneOS first-party apps

  • Sandboxed Google Play (if you choose to install it)

For other apps, you’ll need to install other app stores. That’s a topic for a future post.

:gear: Key Privacy/Security Settings to Know

After installation, check out:

Settings > Security & privacy:

  • Auto reboot (automatically reboots locked phone after set time)

  • Internet permission (disable network access per-app)

  • Sensors permission (block accelerometer, gyroscope per-app)

Settings > Apps:

  • Per-app permissions are much more granular than stock Android

  • Storage Scopes (choose which files/folders apps can access)

  • Contact Scopes (choose which contacts apps can see)

I’ll cover detailed configuration in a future post.

:counterclockwise_arrows_button: Going Back to Stock Android

If you want to revert to stock Android:

  1. Follow Google’s instructions at Android Flash Tool

  2. Boot to fastboot mode and unlock bootloader

  3. Run: fastboot erase avb_custom_key to remove GrapheneOS verified boot key

  4. Follow Google’s web flashing tool

:red_question_mark: Common Questions

Q: Can I use banking apps?

A: Some work, some don’t. It depends on whether they require Google Play Services and whether they detect the unlocked bootloader during installation (it gets locked afterward). Test the apps you need.

Q: Will I get GrapheneOS updates?

A: Yes, automatic over-the-air updates just like stock Android. GrapheneOS typically releases updates within days of Google’s security patches.

Q: Can I install Google apps?

A: Yes, through sandboxed Google Play. See Usage guide | GrapheneOS

Q: Is this legal?

A: Yes. You own your phone, you can install whatever OS you want.

Q: Will this break my phone?

A: No. You can always flash back to stock Android. The hardware is unchanged.

:link: Official Resources

:speech_balloon: Your Turn

Have you tried GrapheneOS? Thinking about making the switch? Questions about the installation process?

Drop a comment below. I’m happy to help troubleshoot or clarify anything.