systemd 261 Ships Final With a Software-TPM Fallback and Promotes sysupdate Out of Experimental Status
The final systemd 261 release adds systemd-tpm2-swtpm, a software TPM fallback for hardware without a TPM chip, and graduates systemd-sysupdate and a new networkd DHCP-relay backend.
Overview
The systemd project has published the final release of systemd 261, tagged v261 on 19 June 2026. Beyond the headline features that arrived with the first release candidate, the shipping version adds a service that runs a software-based Trusted Platform Module on systems without a hardware TPM, moves the operating-system image updater out of experimental status, and gives the network manager a new DHCP relay backend.
The Machine Herald previously reported on systemd 261-rc1, which introduced the systemd-sysinstall textual OS installer, an Instance Metadata Service subsystem for reading cloud metadata, and integration with the Linux kernel’s Live Update Orchestration and Kexec Handover machinery. Those features remain in the final build; the items below are the additions and graduations that distinguish the shipping release.
What We Know
A software TPM fallback
The most prominent new addition is a service that supplies TPM functionality in software when no physical chip is present. According to the systemd v261 changelog, “A new service systemd-tpm2-swtpm.service has been added that can run the IBM “swtpm” as a software TPM, for use as an (optional) automatic fallback for systems that lack a physical TPM but where TPM functionality should be made available nonetheless.” Help Net Security similarly reported that the new systemd-tpm2-swtpm.service can run IBM’s swtpm as a software implementation for systems lacking physical hardware, gated behind a kernel command line option.
sysupdate leaves experimental status
systemd’s tool for applying atomic updates to operating-system images and partitions is no longer flagged as experimental. The changelog states that “systemd-sysupdate is now installed in /usr/bin/ alongside the other user-facing tools, as it is no longer considered experimental.” Help Net Security likewise reported that systemd-sysupdate left experimental status and moved to /usr/bin/.
A DHCP relay backend in networkd
The release also extends systemd-networkd’s DHCP handling. According to the changelog, “systemd-networkd gained a new sd-dhcp-relay backend for DHCP relay agent support.” The same source notes that the change deprecates several existing [DHCPServer] settings, namely BindToInterface=, RelayTarget=, RelayAgentCircuitId=, and RelayAgentRemoteId=, replacing them with a DHCPRelay= option in the [Network] section and a new [DHCPRelay] configuration section.
Carried over from the release candidate
The features that defined the release candidate ship unchanged in the final build. Per the changelog, “A new component systemd-sysinstall has been added that implements a simple, modern textual installer for an OS,” and “An IMDS subsystem has been added. Specifically, there’s now systemd-imdsd which provides a local Varlink IPC API that makes IMDS services accessible to local programs.” The changelog also confirms that “PID1 now supports the kernel’s Live Update Orchestration (LUO) / Kexec Handover (KHO) systems when present and enabled.”
What We Don’t Know
The changelog documents the components shipped but does not quantify adoption: it is not yet clear how quickly distributions will package systemd 261 or enable the software-TPM fallback by default, given that the changelog describes systemd-tpm2-swtpm.service as an optional fallback rather than an always-on service. The release notes do not state a timeline for downstream availability in major distributions.