diff --git a/package/czechlight-cfg-fs/czechlight-cfg-fs.mk b/package/czechlight-cfg-fs/czechlight-cfg-fs.mk
index e816275..aebcf4b 100644
--- a/package/czechlight-cfg-fs/czechlight-cfg-fs.mk
+++ b/package/czechlight-cfg-fs/czechlight-cfg-fs.mk
@@ -14,16 +14,11 @@
 
 define CZECHLIGHT_CFG_FS_BUILD_CMDS
 	$(TARGET_CC) $(CZECHLIGHT_CFG_FS_PKGDIR)/czechlight-random-seed.c -o $(@D)/czechlight-random-seed
-
-	$(HOST_DIR)/usr/bin/yanglint -t config \
-		$(TARGET_DIR)/usr/share/yang/modules/netopeer2/ietf-netconf-acm@2018-02-14.yang \
-		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/nacm.json
 endef
 
 CZECHLIGHT_CFG_FS_SYSTEMD_FOR_MULTIUSER = \
 	czechlight-install-yang.service \
-	czechlight-migrate.service \
-	nacm-restore.service
+	czechlight-migrate.service
 
 $(ifeq ($(CZECHLIGHT_CFG_FS_PERSIST_SYSREPO),y))
 	CZECHLIGHT_CFG_FS_SYSTEMD_FOR_MULTIUSER += \
@@ -47,9 +42,6 @@
 		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/impl-cfg-save-sysrepo \
 		$(@D)/czechlight-random-seed
 
-	$(INSTALL) -D -m 0644 -t $(TARGET_DIR)/usr/share/yang-data/ \
-		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/nacm.json
-
 	$(INSTALL) -D -m 0755 -t $(TARGET_DIR)/usr/libexec/czechlight-cfg-fs \
 		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/czechlight-install-yang.sh \
 		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/czechlight-migrate.sh \
diff --git a/package/czechlight-cfg-fs/czechlight-migration-list.sh b/package/czechlight-cfg-fs/czechlight-migration-list.sh
index 6754752..7f8517c 100644
--- a/package/czechlight-cfg-fs/czechlight-migration-list.sh
+++ b/package/czechlight-cfg-fs/czechlight-migration-list.sh
@@ -2,4 +2,5 @@
     '0001_initial-data.sh'
     '0002_default_startup_configuration_for_ietf-interfaces.sh'
     '0003_shelve_alarms.sh'
+    '0004_nacm.sh'
 )
diff --git a/package/czechlight-cfg-fs/nacm.json b/package/czechlight-cfg-fs/migrations/0004_nacm.json
similarity index 100%
rename from package/czechlight-cfg-fs/nacm.json
rename to package/czechlight-cfg-fs/migrations/0004_nacm.json
diff --git a/package/czechlight-cfg-fs/migrations/0004_nacm.sh b/package/czechlight-cfg-fs/migrations/0004_nacm.sh
new file mode 100644
index 0000000..3d7a899
--- /dev/null
+++ b/package/czechlight-cfg-fs/migrations/0004_nacm.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Import CzechLight-specific NACM rules for DWDM modules
+# ------------------------------------------------------
+# Before this we restored these NACM rules from our "factory-default" on every boot, overwriting whatever was in the ietf-netconf-acm module.
+# Since config v4, the users are free to modify NACM rules as they wish.
+
+sysrepocfg -d startup -m ietf-netconf-acm -f json --import="${MIGRATIONS_DIRECTORY}/0004_nacm.json"
diff --git a/package/czechlight-cfg-fs/nacm-restore.service b/package/czechlight-cfg-fs/nacm-restore.service
deleted file mode 100644
index 4f5e5b9..0000000
--- a/package/czechlight-cfg-fs/nacm-restore.service
+++ /dev/null
@@ -1,15 +0,0 @@
-[Unit]
-Description=Restore NACM rules
-After=netopeer2-install-yang.service czechlight-migrate.service cfg.mount
-Requires=netopeer2-install-yang.service czechlight-migrate.service cfg.mount
-Before=netopeer2-setup.service netopeer2.service sysrepo-persistent-cfg.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=/bin/sysrepocfg -d startup -m ietf-netconf-acm -f json --import=/usr/share/yang-data/nacm.json
-ExecStart=/bin/sysrepocfg -C startup
-Group=sysrepo
-
-[Install]
-WantedBy=multi-user.target