Things to Do After Installing Pop!_OS 24.04 LTS (COSMIC)

A fresh Pop!_OS 24.04 install is about six hundred packages behind on the day it boots. Our clean install from the current Intel/AMD ISO had 636 upgrades waiting, pulled 3.2 GB, moved to a newer kernel line, and then stopped on a fwupd.conf question that left four packages half-configured because nobody answered it. So the order of the things to do after installing Pop!_OS 24.04 matters as much as the list.

Original content from computingforgeeks.com - post 179782

This guide walks you through the post-install setup we run on a new COSMIC desktop. It covers updates, the NVIDIA ISO versus a later driver switch, COSMIC tiling and settings, Flathub, firmware, codecs, the firewall and the recovery partition. Every command below was run on a clean Pop!_OS 24.04 LTS install in a UEFI virtual machine in October 2026, and the NVIDIA steps were simulated because that machine has no NVIDIA card.

Check What the Installer Created

The Clean Install option on a UEFI machine writes four partitions, and one of them is a full copy of the installer that you’ll want later. You do not get a choice of hostname either: the installer never asks, so every machine comes up as pop-os. Look at the layout before you change anything, because it tells you whether the recovery partition exists at all (legacy BIOS installs don’t get one):

lsblk -o NAME,SIZE,FSTYPE,PARTLABEL,MOUNTPOINTS /dev/vda

On our 40 GB disk the installer made a 1 GiB EFI partition, a 4 GiB FAT32 partition labelled recovery, ext4 for root and 4 GiB of swap. Your disk will be nvme0n1 or sda rather than vda:

NAME           SIZE FSTYPE PARTLABEL MOUNTPOINTS
vda             40G
├─vda1        1022M vfat             /boot/efi
├─vda2           4G vfat   recovery  /recovery
├─vda3          31G ext4             /
└─vda4           4G swap
  └─cryptswap    4G swap             [SWAP]

Two details here are easy to miss. The swap partition is encrypted with a random key on every boot (/dev/urandom in /etc/crypttab), which is good for privacy but means you can’t hibernate to it and resume. Pop also adds a 4.8 GB zram swap device on top of it. The recovery partition already holds 2.8 GB of the 4 GB, which matters when you refresh it later:

Don’t reach for fdisk to dig further, because Pop!_OS 24.04 does not ship it (sudo: fdisk: command not found). parted is installed and lsblk covers most questions. If several Pop machines share a network, give this one a real name now so they do not all answer as pop-os:

sudo hostnamectl hostname pop01

The change is immediate and survives a reboot, and hostnamectl printed Static hostname: pop01 straight after.

Update Pop!_OS 24.04 From the Terminal

Run the first update from a terminal, not from COSMIC Store, and stay at the keyboard while it runs. All the package sources point at apt.pop-os.org, including a Pop mirror of the Ubuntu archive, so the Ubuntu and Pop updates arrive together. Refresh the index first:

sudo apt update

Six sources answer, all on Pop’s own servers. The index refresh took 7.7 seconds on our install:

Hit:1 http://apt.pop-os.org/proprietary noble InRelease
Hit:2 http://apt.pop-os.org/release noble InRelease
Hit:3 http://apt.pop-os.org/ubuntu noble InRelease
Hit:4 http://apt.pop-os.org/ubuntu noble-security InRelease
Hit:5 http://apt.pop-os.org/ubuntu noble-updates InRelease
Hit:6 http://apt.pop-os.org/ubuntu noble-backports InRelease

COSMIC Store showed the same backlog differently. Its Updates page listed “System Packages, 724 packages” plus separate cards for COSMIC Files, Media Player, Store and System Monitor, while apt counted 636 upgradable packages. Either route installs the same set, but the Store hides the conffile question below behind a progress bar:

Now run the full upgrade. We use full-upgrade on this first pass because it installs the 109 new packages (new kernel packages and new COSMIC apps among them) and is allowed to remove packages if a dependency change needs it, which upgrade never does.

sudo apt full-upgrade

Read the summary line before you answer Y, because it is the size of the job. On our install you needed 3.2 GB of downloads and about 1.5 GB of extra disk.

636 upgraded, 109 newly installed, 0 to remove and 0 not upgraded.
Need to get 3,211 MB of archives.
After this operation, 1,537 MB of additional disk space will be used.

Near the end, dpkg stops on /etc/fwupd/fwupd.conf. The installed file (OnlyTrusted=true, AllowEmulation=false and a list of disabled test plugins) no longer matches what the package last shipped, so dpkg treats it as modified and asks. Answer N, the default, to keep the installed file. The kernel step also prints kernelstub.Installer : INFO Backing up old kernel, which is how the boot menu gets its fallback entry.

Error: “end of file on stdin at conffile prompt”

We ran the upgrade unattended with -y, nobody answered that question, and this is what came back after 47 minutes (four of them lost to an idle suspend, see the settings section):

*** fwupd.conf (Y/I/N/O/D/Z) [default=N] ? dpkg: error processing package fwupd (--configure):
 end of file on stdin at conffile prompt
...
Errors were encountered while processing:
 fwupd
 libfwupdplugin5
 pop-server
 pop-desktop
E: Sub-process /usr/bin/dpkg returned an error code (1)

Leaving it like that is not harmless, because pop-desktop is the metapackage that pulls in the rest of the desktop and it stays unconfigured. Finish the configuration and keep the existing fwupd.conf:

sudo DEBIAN_FRONTEND=noninteractive dpkg --configure -a --force-confold

After that and a reboot, apt list --upgradable was empty and the Updates page in the Store showed only one Flatpak runtime. Check the kernel you booted into:

uname -r

The ISO booted 6.16.3-76061603-generic, and after the upgrade you should see a newer build like this one.

7.2.6-76070206-generic

Most COSMIC packages moved from the 0.1.0 builds on the ISO to the 1.11 release in the same pass (the compositor package keeps its own 0.1 numbering), so a desktop that looks rough on first login may simply be the old one. pop-upgrade release check returned nothing new, which means 24.04 is still the release on offer.

Pick the NVIDIA ISO or Install the Driver Later

The desktop distro System76 builds comes as two x86 ISOs on its download page, and the only difference that matters to you after install is whether the NVIDIA driver is already there. The release API returns both builds with sizes and checksums, which is the quickest way to see what is current:

curl -s https://api.pop-os.org/builds/24.04/intel

The Intel/AMD image was build 20 when we checked, and swapping intel for nvidia in the URL returned build 28.

{"version":"24.04","url":"https://iso.pop-os.org/24.04/amd64/intel/20/pop-os_24.04_amd64_intel_20.iso","urgent":"true","size":2955067392,"sha_sum":"a0ef3842ab710db4f4407cf3499560b59dddbbcd59bee17beab7b0e99dc22b4c","channel":"intel","build":"20"}

ISO	Build checked	Size	Use it for
Intel/AMD	20	2.96 GB	Intel or AMD graphics, and NVIDIA 10-series or older
NVIDIA	28	3.93 GB	NVIDIA 16-series and newer, driver preinstalled

If you installed from the Intel/AMD ISO and later add an NVIDIA card, or you picked the wrong image, you do not need to reinstall. One metapackage does the switch, and its dependency list shows which driver it will choose:

apt-cache depends system76-driver-nvidia

Apt tries the alternatives top to bottom, so the 595 branch wins whenever it is installable.

system76-driver-nvidia
 |Depends: nvidia-driver-595
 |Depends: nvidia-driver-580-open
 |Depends: nvidia-driver-580
 |Depends: nvidia-driver-570-open
 |Depends: nvidia-driver-570
 |Depends: nvidia-driver-550
  Depends: nvidia-driver-470
  Depends: system76-driver
  Depends: ubuntu-drivers-common
  Recommends: amd-ppt-bin

Pop’s release repository is pinned at priority 1001, so its rebuilt driver (595.104.02-1pop1) beats the Ubuntu build 595.99.02 from the restricted pocket even though both are visible. A dry run with apt-get install -s showed 90 new packages, which is more than the driver alone:

• the 595 driver libraries in 64-bit and 32-bit builds
• nvidia-kernel-source-595, built by DKMS on each kernel update
• system76-driver and the System76 firmware daemon
• firmware-manager-notify for firmware update prompts

The 32-bit libraries are what Steam and older games load, so don’t strip them out to save space. Owners of GTX 900 and 10-series cards should not take the 595 default, because NVIDIA ended Maxwell and Pascal support after the 580 branch; install nvidia-driver-580 from the same repository instead. On a newer card, install the metapackage and reboot.

sudo apt install system76-driver-nvidia

After the reboot, nvidia-smi should list the card and the driver version. If it does not, check Secure Boot first: the upgrade log printed Binary update-secureboot-policy not found, modules won't be signed, and an unsigned DKMS module will not load with Secure Boot on. The System76 install guide already tells you to turn Secure Boot off for Pop!_OS.

Laptops with both an integrated GPU and an NVIDIA GPU switch modes with system76-power, which runs as a daemon on every install. COSMIC has no switch for it in Settings and is built to stay in hybrid mode, where you right-click an app in the dock or app library to start it on the discrete GPU (System76 documents this in its graphics switching guide). Query the current mode:

system76-power graphics

On a desktop or a single-GPU machine it refuses rather than guessing, which is also what our VM printed:

Graphics switching is not supported on this device, because
this device is either a desktop or doesn't have both an iGPU and dGPU.

Don’t bother with prime-select from Ubuntu guides, since it is not installed on Pop!_OS and system76-power does that job here.

Turn On COSMIC Tiling With Super+Y

COSMIC tiling is off by default, and it works per workspace, so you can tile one workspace and leave the next one floating. Press Super+Y to turn it on for the current workspace, and the same keys turn it off again. The defaults file shipped with COSMIC lists the whole tiling family, which is quicker than hunting through Settings:

grep -nE "Tiling|Stacking|Floating|Orientation|Swap|Maximize|Terminal|Launcher|AppLibrary|WorkspaceOverview|HomeFolder|WebBrowser" /usr/share/cosmic/com.system76.CosmicSettings.Shortcuts/v1/defaults

Super+G is the one you’ll use most once tiling is on, because it pops a single window (a calculator, a file dialog) out of the grid without turning tiling off:

83:    (modifiers: [Super], key: "o"): ToggleOrientation,
84:    (modifiers: [Super], key: "s"): ToggleStacking,
85:    (modifiers: [Super], key: "y"): ToggleTiling,
86:    (modifiers: [Super], key: "g"): ToggleWindowFloating,
87:    (modifiers: [Super], key: "x"): SwapWindow,
89:    (modifiers: [Super], key: "m"): Maximize,
100:    (modifiers: [Super], key: "b"): System(WebBrowser),
101:    (modifiers: [Super], key: "f"): System(HomeFolder),
103:    (modifiers: [Super], key: "t"): System(Terminal),
105:    (modifiers: [Super], key: "a"): System(AppLibrary),
106:    (modifiers: [Super], key: "w"): System(WorkspaceOverview),
107:    (modifiers: [Super], key: "slash"): System(Launcher),
108:    (modifiers: [Super]): System(Launcher),

With two terminals open (Super+T twice), Super+Y split the screen down the middle and drew the active-window hint around the focused one:

The only compositor setting written under ~/.config/cosmic/com.system76.CosmicComp/v1/ on our install was autotile_behavior, set to PerWorkspace, and toggling Super+Y changed no file in that directory. If you script your dotfiles, that’s the file to carry. The panel’s tiling applet also has a “Tile current workspace” switch if you’d rather click. To rebind any of these, go to Settings, Input devices, Keyboard, Keyboard shortcuts, and leave the defaults file above alone because package updates own it.

Change the COSMIC Settings That Bite Later

COSMIC Initial Setup runs at first login and covers the cosmetic choices: theme (COSMIC Dark or Light, plus Comet, Cream, Mocha and Nebula variants), a “Top Panel & Bottom Dock” or “Bottom Panel” layout, workspaces and the launcher. Those are easy to change later in Settings, Desktop. The settings that actually cost us time were elsewhere:

• Power & battery: automatic suspend after 30 minutes (15 on battery)
• Power & battery: screen off after 15 minutes
• Window management: Super alone opens the launcher
• Window management: focus follows cursor off, 250 ms delay when on

The suspend default is the one to fix first on a desktop. Our machine went to sleep 30 minutes into the long upgrade because nobody touched the keyboard, the SSH session we were watching from dropped, and the run only continued after a keypress woke it. On resume the journal also logged a failed pop-default-settings_bluetooth-suspend hook. If you leave long jobs running, raise Automatic suspend in Power & battery to something longer than your longest backup or build, or turn it off on a desktop.

Window management is where people coming from GNOME or i3 adjust the Super key and focus behaviour. The “Show active window hint” toggle controls the coloured border you saw in the tiling screenshot:

If you’re weighing COSMIC against GNOME, the same desktop also runs on Fedora. Our COSMIC on Fedora guide covers the Spin and the dnf group, and the Ubuntu 26.04 desktop checklist is the GNOME side of the same decision.

Install Desktop Apps From Flathub

Flathub is already configured on Pop!_OS 24.04, so there is no remote-add step, but it’s configured per user rather than system-wide. That changes where apps land and who can see them. List the remotes with their details:

flatpak remotes --show-details

Both remotes, Flathub and Pop’s own COSMIC repository, show user in the installation column:

cosmic	COSMIC	https://apt.pop-os.org/cosmic/	-	-	-	1	user	COSMIC Flatpak Repository	COSMIC Flatpak Repository	https://pop-os.org/	-
flathub	Flathub	https://dl.flathub.org/repo/	-	-	-	1	user	Central repository of Flatpak applications	Central repository of Flatpak applications	https://flathub.org/	https://dl.flathub.org/repo/logo.svg

Install an app the usual way. VLC took 1 minute 26 seconds on a fresh system because the first install also pulls the shared runtime:

flatpak install -y flathub org.videolan.VLC

Then confirm which installation it went into, because that decides who else on the machine can launch it.

flatpak list --app --columns=name,application,version,installation

Look at the last column. It reads user, so the app lives under your home directory.

VLC	org.videolan.VLC	3.0.23	user

On a single-user laptop that’s fine. On a family or lab machine with several accounts, every user gets their own copy of each app and runtime, so add Flathub system-wide as well:

sudo flatpak remote-add --if-not-exists --system flathub https://dl.flathub.org/repo/flathub.flatpakrepo

flatpak remotes --columns=name,options then lists flathub twice, once as system and once as user, and flatpak install --system flathub <app-id> puts an app where every account can launch it. COSMIC Store reads the same remotes, so anything you install from the terminal shows up there too, and the Updates page there is where Flatpak updates appear from then on.

Update Firmware With fwupd

fwupd is installed and its refresh timer is enabled, so hardware whose vendor publishes to the LVFS gets BIOS and peripheral firmware the same way it would on Ubuntu. Refresh the metadata and ask what can be updated:

fwupdmgr refresh

Then list the pending updates, which is the step that tells you whether anything on your board has a newer firmware.

fwupdmgr get-updates

Our VM has nothing to flash, so refresh reported “0 local devices supported” and get-updates said “No updatable devices”. It also warned “UEFI capsule updates not available or enabled in firmware setup”, which on real hardware means BIOS updates through fwupd will not apply until capsule updates are enabled in the firmware setup screen. Run sudo fwupdmgr update when get-updates lists something.

System76 machines are the exception. Their firmware comes through the System76 tools, and on 24.04 that’s the Firmware Manager app rather than a page in COSMIC Settings. Neither firmware-manager nor system76-firmware was installed on our clean install, although both are in the Pop repository, and installing system76-driver-nvidia pulls in firmware-manager-notify and the firmware daemon as dependencies. System76 documents the terminal route, system76-firmware-cli schedule, in its firmware guide. We did not run it, because it needs System76 hardware.

Install the Restricted Media Codecs

A default Pop!_OS install plays more formats than stock Ubuntu does, but not everything. The fresh install had the good and bad GStreamer plugin sets, OpenH264 and the mpg123 MP3 decoder. It was missing the libav decoders that handle AAC audio and most H.264 files from phones and cameras, so you’d see that gap the first time you open a video someone sent you. Install the Ubuntu restricted bundle plus the bad plugins, as the System76 codec guide recommends.

sudo apt install ubuntu-restricted-extras gstreamer1.0-plugins-bad

It added 44 packages in 21 seconds and removed one, libavcodec60, which libavcodec-extra60 replaces. Run it in a terminal you’re watching, because the Microsoft fonts installer stops for a licence prompt. These are the packages that matter for playback:

• gstreamer1.0-libav for AAC and H.264 decoding
• gstreamer1.0-plugins-ugly for the x264 encoder
• libavcodec-extra for the extra FFmpeg codecs
• ttf-mscorefonts-installer for the Microsoft core fonts

Check that GStreamer now sees the decoders.

gst-inspect-1.0 | grep -iE 'avdec_h264|avdec_aac|mpg123|x264'

Every avdec_* line below is new since the install.

libav:  avdec_aac: libav AAC (Advanced Audio Coding) decoder
libav:  avdec_aac_fixed: libav AAC (Advanced Audio Coding) decoder
libav:  avdec_aac_latm: libav AAC LATM (Advanced Audio Coding LATM syntax) decoder
libav:  avdec_h264: libav H.264 / AVC / MPEG-4 AVC / MPEG-4 part 10 decoder
mpg123:  mpg123audiodec: mpg123 mp3 decoder
typefindfunctions: video/x-h264: h264, x264, 264
x264:  x264enc: x264 H.264 Encoder

Don’t count on the Microsoft fonts from the same bundle. ttf-mscorefonts-installer needs its licence accepted, and on our non-interactive run it logged user did not accept the mscorefonts-eula license. Even after we pre-seeded the right debconf answer and re-ran the font downloader, fc-match Arial still returned Liberation Sans. Liberation is metric-compatible with Arial, so documents keep their layout, but check fc-match yourself if a site or document insists on the real fonts.

Turn On the Firewall

ufw is installed and its systemd unit is enabled, yet sudo ufw status on the fresh install said Status: inactive, so nothing filters inbound traffic. The fresh install only listened on loopback for CUPS and DNS, plus Avahi on UDP 5353, but that changes the moment you install SSH, Syncthing or a dev server. Enable it:

sudo ufw enable

Over SSH it first asks “Command may disrupt existing ssh connections. Proceed with operation (y|n)?”, so allow port 22 before you answer if that’s how you’re connected. Once it’s on, ufw confirms the change survives a reboot:

Firewall is active and enabled on system startup

Check the defaults it applied.

sudo ufw status verbose

Incoming is denied and outgoing allowed, which is what a laptop on public Wi-Fi wants:

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

Add rules per service as you install things, for example sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp for SSH from your LAN only. The rest of the hardening on our Linux Mint post-install list carries over too, since both distros sit on the same Ubuntu 24.04 base.

Refresh the Pop!_OS Recovery Partition

The recovery partition is a bootable copy of the installer, so a Pop!_OS machine that will not start can be repaired or reinstalled without hunting for a USB stick. It only helps if you know how to reach it, if it is not badly out of date, and if the boot menu still lists it after you refresh it. Hold or tap Space while the machine starts and systemd-boot shows its menu:

After the first kernel update a fourth entry, the old kernel, joins Pop!_OS recovery, Pop!_OS and Reboot Into Firmware Interface, which gives you two fallbacks before you need the recovery image. You can see the same entries from a running system:

sudo bootctl list

Look at the options line. The recovery entry boots a live casper image from the recovery partition, which it finds by PARTUUID.

         type: Boot Loader Specification Type #1 (.conf)
        title: Pop!_OS recovery (default)
           id: Recovery-375C-15E6.conf
       source: /boot/efi//loader/entries/Recovery-375C-15E6.conf
        linux: /boot/efi//EFI/Recovery-375C-15E6/vmlinuz.efi
       initrd: /boot/efi//EFI/Recovery-375C-15E6/initrd.gz
      options: boot=casper hostname=recovery userfullname=Recovery username=recovery live-media-path=/casper-375C-15E6 live-media=/dev/disk/by-partuuid/1b9acc8f-55e0-42f5-9e54-e206c7213bfa noprompt

Ignore the “(default)” label on that entry. /boot/efi/loader/loader.conf says default Pop_OS-current, and the machine booted Pop!_OS normally every time in our tests. The label stayed on the recovery entry even after every fix later in this section, so don’t read it as a sign that something failed. Next, ask pop-upgrade what the partition holds:

pop-upgrade recovery check

On a partition written by the installer it reports the release but no build number:

checking if pop-upgrade requires an update
version: 24.04
build: 0

The files in /recovery are dated from the ISO build, a year older than the system you just upgraded, so a recovery boot today would start an old kernel and an old installer. Refresh it from the release API:

sudo pop-upgrade recovery upgrade from-release

It downloaded 3,362 MiB, checked the files, synced them onto the partition and finished in 6 minutes 17 seconds:

checking if pop-upgrade requires an update
Recovery event: fetching recovery files
Recovery event: verifying checksums of fetched files
Recovery event: syncing recovery files with recovery partition
Recovery event: recovery partition upgrade completed
Recovery upgrade status: recovery partition refueled and ready to go

Afterwards pop-upgrade recovery check reported build: 28 and the partition sat at 3.3 GB used with 744 MB free. That is the same build number as the NVIDIA ISO, but not the same image. The release API has a third channel, generic, and its 24.04 entry is build 28 at 3,526,164,480 bytes, which is the 3,362 MiB the refresh downloaded (the NVIDIA build 28 is 3,934,945,280 bytes). Query it the same way if you want to see what the refresh will fetch:

curl -s https://api.pop-os.org/builds/24.04/generic

The URL in the reply points at a generic ISO path:

{"version":"24.04","url":"https://iso.pop-os.org/24.04/amd64/generic/28/pop-os_24.04_amd64_generic_28.iso","urgent":"false","size":3526164480,"sha_sum":"8d78e500fc95da765a91cddcf2ab7ba71ce4e7997e4f008456d4d872ee8f8221","channel":"generic","build":"28"}

The command also takes an optional version and architecture (from-release [VERSION] [ARCH]) if you want to pin what it downloads.

The recovery entry vanished from the boot menu

This is the part nobody warns you about. After the refresh, /boot/efi/loader/entries/ held only the two Pop!_OS kernel entries, the boot menu no longer offered recovery, and bootctl list showed the old entry as recovery-375c-15e6.conf (reported/absent). sudo pop-upgrade recovery default-boot exited with status 1 and no error message. The kernel and initrd were still on the ESP under /EFI/Recovery-375C-15E6/, so only the loader entry was missing. Check yours after every refresh:

sudo ls /boot/efi/loader/entries/

The easy way to be ready for this is to copy the entry before you refresh. The ESP is readable only by root, so a plain sudo cp with a wildcard fails with cannot stat '/boot/efi/loader/entries/Recovery-*.conf', because your own shell can’t expand the pattern. Let a root shell expand it:

sudo sh -c 'cp /boot/efi/loader/entries/Recovery-*.conf /root/'

After the refresh, put it back the same way, and bootctl list shows the recovery entry again:

sudo sh -c 'cp /root/Recovery-*.conf /boot/efi/loader/entries/'

If you refreshed without a copy, rebuild the entry from two values on your own system. The ID after Recovery- is the filesystem UUID of the recovery partition:

lsblk -no UUID /dev/disk/by-partlabel/recovery

Ours printed 375C-15E6. The PARTUUID that the options line needs sits in recovery.conf, which only root can read:

sudo grep RECOVERY_UUID /recovery/recovery.conf

That returned RECOVERY_UUID=PARTUUID=1b9acc8f-55e0-42f5-9e54-e206c7213bfa here. Pop!_OS ships nano but not full vim, so create the entry with nano, naming the file after your own UUID:

sudo nano /boot/efi/loader/entries/Recovery-375C-15E6.conf

These four lines brought the entry back on our install. Replace both IDs with yours:

title Pop!_OS recovery
linux /EFI/Recovery-375C-15E6/vmlinuz.efi
initrd /EFI/Recovery-375C-15E6/initrd.gz
options boot=casper hostname=recovery userfullname=Recovery username=recovery live-media-path=/casper-375C-15E6 live-media=/dev/disk/by-partuuid/1b9acc8f-55e0-42f5-9e54-e206c7213bfa noprompt

With the file in place, bootctl list picked it up and pop-upgrade recovery default-boot returned 0 again. Running default-boot is optional: it is a good way to prove the refreshed image boots, but you have to undo it afterwards. We ran it, and the next boot went straight into the recovery image, which starts the Pop!_OS 24.04 installer:

That proves the refreshed image works, but default-boot leaves recovery as the default: loader.conf read default Recovery-375C-15E6, and a plain reset booted recovery a second time. Hold Space, pick the normal Pop!_OS entry, and once you’re back on the desktop check the file:

sudo cat /boot/efi/loader/loader.conf

It must read default Pop_OS-current, which is what kernelstub writes and what pop-upgrade expects to find. If it still names the recovery entry, put it back:

sudo sed -i 's/^default .*/default Pop_OS-current/' /boot/efi/loader/loader.conf

Use that rather than bootctl set-default. The EFI variable that set-default writes takes priority over loader.conf, and pop-upgrade recovery default-boot writes loader.conf rather than that variable, so a stray variable quietly breaks default-boot and a later refresh. If you already set one, clear it with sudo bootctl set-default "". With the variable cleared and loader.conf on Pop_OS-current, a reset with no keys pressed came back to the installed desktop on our machine.

The other subcommand worth knowing is pop-upgrade release refresh, which its help text describes as “refresh the existing OS (requires recovery partition)”, and the System76 recovery guide covers that path. Refresh the recovery partition when a new ISO build ships and check the boot entries straight afterwards. A recovery image that’s a year old, or one the boot menu can’t reach, is no help on the day the main install won’t start.