The question that brings most people here is some version of "where do I download a clean Rust server?" — usually asked right after a forum-downloaded server pack turned out to contain someone's idea of bonus content, or after a plugin update left an install in a state nobody could explain. The answer that ends the question permanently: you download it from Steam, like Facepunch intended, and you don't need an account, a forum registration, or anyone's repack to do it.

"Clean" isn't paranoia, it's a workflow. Plugin developers diff their modded tree against pristine files to see what Oxide actually patched. Server owners restore to stock before debugging "is it my plugins or the game". And anyone who has ever run ls in a forum repack and found a stray .exe understands the rest. The Steam CDN copy is the reference everything else is measured against — and DepotDownloader hands it to you with checksums verified on every chunk.

02The one command

The Rust dedicated server is its own app — 258550 — with a free license. That means fully anonymous download, no -username, no Steam account at all:

$ ./DepotDownloader -app 258550 -os linux -dir ./rust-server

Swap -os linux for -os windows if that's your host — and note you can pull either one from anywhere: I routinely download the Linux server on a Windows desktop before shipping it to a VPS. Expect several gigabytes. When it finishes, ./rust-server contains exactly what Facepunch published, with every chunk hash verified in transit — start it with RustDedicated and your usual launch parameters, same as a SteamCMD install.

Yes, SteamCMD does this too — it's Valve's official tool and there's nothing wrong with it. The reasons I reach for DepotDownloader on server boxes: no interactive login dance to script around, resumable downloads that survive flaky VPS networking, chunk-level delta updates into an existing directory, and one flag (-manifest) that SteamCMD simply doesn't have — which is the entire rollback section below.

03Staging & aux branches

Facepunch develops in the open: next month's update lives on public test branches before it ships. The server has them too, and they're a -branch flag away:

$ ./DepotDownloader -app 258550 -os linux -branch staging -dir ./rust-staging

staging tracks the upcoming monthly update — plugin developers live here in the week before wipe day, fixing their hooks against what's coming instead of scrambling after it lands. aux01 (and occasionally further aux branches) carry Facepunch's experimental work; check SteamDB's depot page to see what's currently live and what each branch's manifest dates look like. A staging server only talks to staging clients, so pair it with the client's matching branch if you're testing with real players.

04Rolling back a broken update

The monthly rhythm every Rust admin knows: forced wipe lands on the first Thursday, the server updates, and for a few hours your plugin stack is a casualty list while Oxide/uMod and plugin authors catch up. Most of the time you ride it out. But when you genuinely need yesterday's server back — a community event tonight, a plugin you can't live without — this is the move SteamCMD can't make:

Open SteamDB → app 258550 → Depots, click into the depot for your OS, open its Manifests tab.
Copy the manifest ID dated just before the update that hurt you.
Download that exact build:

$ ./DepotDownloader -app 258550 -depot <id from steamdb> -manifest <yesterday's id> -dir ./rust-prev

Because you only ever need the previous build, this lives comfortably inside the "recent manifests" window that still works in 2026 — server rollbacks are the use case Valve's restrictions barely touched. One real catch instead: your clients can't follow you back. Players' Steam clients auto-update to current, and a rolled-back server won't accept current clients. Rollback buys you a frozen-in-time server for a controlled group, not a public server dodging an update. For public servers the honest play is still "wait for Oxide".

Archive habit worth stealing Some admins I know pull -manifest-only listings on every wipe day and keep the previous month's full build zipped. Costs a few minutes and some disk; pays for itself the first time an update goes sideways and SteamDB is down or the manifest window has moved on.

05Wipe-day updates, automated

Re-running the same command into the same directory is the update mechanism — the delta machinery compares manifests and fetches only changed chunks, which on a monthly Rust patch is a fraction of the full size. A minimal wipe-day script:

#!/bin/bash — update-rust.sh: stop, update, restart
systemctl stop rust-server
/opt/depotdownloader/DepotDownloader -app 258550 -os linux -dir /srv/rust \
  && systemctl start rust-server

The && matters: a failed download exits nonzero and leaves the server stopped rather than launching a half-updated install. Wire it to a timer around Facepunch's usual first-Thursday release window, or trigger it from any of the update-watching bots the Rust admin community runs. Keep Oxide's installer as a second step in the same script if you run modded — game files first, framework on top, always in that order.

06Un-modding an install: `-validate` as a reset button

Here's a property of -validate that's a feature and a footgun in the same flag. It re-hashes every file against the manifest and re-downloads anything that doesn't match. On an Oxide install, "doesn't match" includes everything Oxide patched — so:

$ ./DepotDownloader -app 258550 -os linux -dir /srv/rust -validate

Cuts both ways Run that against a modded server and you get a factory reset of the game files: Oxide's patched binaries revert to stock (your plugin and config folders survive — they're not in the manifest — but the framework needs reinstalling). Perfect when that's what you wanted — "give me a clean baseline" — and a nasty surprise mid-season when you only meant to check disk integrity. Know which one you're asking for before you press enter.

The same trick answers the diff question from the intro: validate a copy of your modded tree into cleanliness, then diff -rq it against the live one, and you have a complete list of what your mod stack actually touches.

07Where to go from here

The same pattern — free license, anonymous pull, -os to taste — covers most dedicated servers on Steam: TF2 (232250), the classic Source and HLDS family, and plenty of indie titles; the dedicated servers hub has the AppID table and the generic recipe. The flags you'll want next live in the CLI reference; if a download dies with a 401 on an older manifest, the status page explains whose fault that is (not yours). The clean client counterpart of this guide — same philosophy, plus EAC and license caveats — lives at Rust: the clean client.