I’m looking to buy a ThinkPad specifically for Qubes OS, and everywhere I look, people still recommend the T480. It seems like it’s been the go-to recommendation for years because of its excellent compatibility.
I’m wondering if that’s still true in 2026, or if there’s a newer ThinkPad that’s just as well supported.
For those of you running Qubes, what are you using these days? Is the T480 still the safest bet, or have models like the T14, X13, or P Series become just as reliable?
I’m also curious what the newest ThinkPad is that can run Qubes with little to no hardware tweaking. I don’t mind doing the normal installation, but I’d rather avoid spending hours troubleshooting audio, Wi Fi, graphics, suspend, or other hardware issues after installing it.
If you were buying a ThinkPad for Qubes OS today, which model would you choose? I’m hoping to get the newest ThinkPad possible while still having an experience that’s as close to install it and use it as possible.
I’d really appreciate hearing about your experiences and recommendations. Thanks!
If you’re not looking strictly for Thinkpads and just good laptops (tho if it’s the former I’d be interested in hearing why), check out laptops from NovaCustom and Nitrokey.
Thanks for taking the time to explain all of that. I really appreciate it. The TPM issue definitely gives me something to think about.
At this point, it seems like every ThinkPad has some kind of tradeoff or issue depending on your threat model. No wonder people keep recommending NovaCustom and Nitrokey laptops instead.
I was hoping to find a good used business laptop with newer hardware and save some money while still getting excellent Qubes compatibility. My budget is around $300 to $400, so spending over $1,000 on a NovaCustom just isn’t realistic for me.
Out of curiosity, if you were buying a laptop for Qubes today, what would you recommend? It doesn’t have to be a ThinkPad. Do you have a top 10 list of laptops that you think work well with Qubes? I’d love to hear what you’d suggest, especially if there are some newer models that don’t require a lot of tweaking.
The only problem is they’re more than I’m looking to spend. I probably should have mentioned this in my original post, but my budget is around $300 to $400, although I’d be willing to spend up to $500 if it meant getting something that was a much better fit for Qubes.
I was hoping I could find a good used business laptop with newer hardware and get the best value for my money.
I’m not set on a ThinkPad, either. I just see them recommended so often that I figured they were the safest choice. If there are other laptops in the $300 to $500 range that you think are just as good, or even better, I’d really like to hear your recommendations.
$500 if it meant getting something that was a much better fit for Qubes
How many VMs do you usually run?
My laptop costs more than my car (but its a REALLY shitty old car LOL). I thought doing proper Qubes (15 VMs or so) would start at like 2k usd if you want that to feel smooth.
I found that auto-pausing (qvm-pause) VMs that are not focused in i3wm decreses required hardware (kinda).
Not too many, honestly. I know one of the main ideas behind Qubes is running everything in separate VMs, and to do that efficiently you really want a good amount of RAM. Unfortunately, RAM isn’t exactly cheap these days.
I already have 32GB of DDR4 3200 MHz that I can use, so I’m hoping that’ll be enough to give me some breathing room. But to answer your question, I don’t plan on running a ton of VMs at the same time. Just enough to keep things properly isolated without going overboard.
What are your thoughts on the ThinkPad T14 Gen 2? I’m looking at the regular T14 Gen 2 i7, not the T14s, since I want the version with upgradeable RAM. I already have an extra 32 GB DDR4 stick, so being able to reuse it is a big plus for me.
Since you pointed out the security limitations and tradeoffs with the T480, would the T14 Gen 2 have similar issues, or is it a better platform overall for running Qubes?
Why would you use a T480 today? I mean, it’s quite outdated on CPU performance, which - unfortunately - is crucial for using Qubes OS due to the lack of GPU support. I mean, it depends on what you’re planning to use the laptop for, but I’d definitely keep that in mind.
I don’t think you should infer what laptop to buy from what others would buy, because others’ preferences may be different to yours.
I am curious. Can anyone offer a comparison between CoreBoot + Heads versus T480 plus Anti-Evil Maid with ‘detached LUKS header on a USB.’
Can we clearly state which Firmware/Boot vulnerabilities, require physical access to a laptop?
Versus
Which Firmware/Boot vulnerabilities can be installed on my laptop remotely?
I think of the X-230 with Coreboot and Heads, as it no longer gets CPU/Motherboard updates, how many of those am I actually vulnerable from? Maybe that is a bit beyond this thread, but the question seems related. Yes, I know the Lenovo X-230 only has 16 GB.
I have thought, that if I really wanted to be overly secure, having 16 GB, and only having two Qubes, (beyond dom0 and USB, sys-net) means I have limited the potential of one Qube gaining info from another. Yes, by design Qubes OS should always block anything from transmitting from one Qube to another, I do not specifically allow.
I get what you’re saying. The reason I’ve been asking around is because I’ve been wanting to hear different opinions from people who actually use Qubes OS every day.
I used to have a ThinkPad T470 with an i5, and while it worked, it definitely had its limitations. Unfortunately, the laptop stopped working, so now I’m looking for a replacement. As I started researching, I kept seeing people recommend ThinkPads, especially the T480. A lot of people say it’s one of the best used laptops for Qubes OS, especially the non-S version since you can upgrade the RAM.
After reading more comments though, I keep seeing people recommend laptops from Librem and Nova instead. The problem is I already have a good desktop that I’m putting together, so I really don’t want to spend another $1,500 on a laptop. I’d rather buy a good used, mid-range laptop that runs Qubes OS well and gives me a solid experience without breaking the bank.
Hopefully that explains where I’m coming from. I’m not trying to come across as rude or argue with anyone. I’m just trying to understand why so many people recommend the T480 if, as you mentioned, the performance is starting to show its age. That’s why I was curious what laptop people would buy today for Qubes OS if your budget was somewhere in the middle, not necessarily a ThinkPad.
Product recommendations are easy to casually declare for any armchair expert because they focus on normalized consumer decisions, but fail to acknowledge ongoing OPSEC practices and trust attack surfaces. In Privacy Guides or Reddit, obtaining information on how to maintain anonymity, privacy, and/or security is out of scope for window shopping, similar to how opaque supply chains and inherent manufacturer trust is ignored as potential attack vectors. The difference you are experiencing is that throwaway sockpuppet accounts are not responsible for any of their product recommendations, whereas Qubes OS Forum contributors, especially from me, are at least willing to note limitations with each product without pretending to treat any of them as invincible from every threat model.
I am really happy with my Thinkpad P16s with Zen4 CPU, 4K OLED, 64G RAM, ethernet, and actual buttons on the touchpad. It was marked down to $1.8k when I bought it a year and a half ago, shot up over $3.3k instantly after, and is now wholly unavailable. Its only flaws are its soldered-in Broadcom wifi module (requiring me to use a USB wifi dongle instead), its lone M.2 SSD socket, its lone spare USB-C port, and soldered-in RAM. Nowadays it seems hard to find anything with 64GB, 4K OLED, and AMD from anybody anywhere at any price.
When I first installed Qubes on it, unplugging the power cord would make it reboot instantly, but that got fixed at some point, via either Xen 4.19 or a BIOS update. In the meantime I discovered that if I kept a USB extender dongle plugged in, I could plug and unplug power fed in through that.
I wonder now whether a miniPCI adapter in its WWAN socket, and a miniPCI wifi module in that, would fit, and work, allowing me to abandon the dongle.