diff --git a/package/cla-sysrepo/cla-appliance.service.in b/package/cla-sysrepo/cla-appliance.service.in
index b01a7a1..15bd3ae 100644
--- a/package/cla-sysrepo/cla-appliance.service.in
+++ b/package/cla-sysrepo/cla-appliance.service.in
@@ -1,9 +1,9 @@
 [Unit]
 Description=CzechLight __MODEL__ driver
-After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service
 Before=rauc-mark-good.service velia-hardware-g1.service velia-hardware-g2.service
 PartOf=netopeer2.service
-Requires=cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+Requires=cfg-restore-sysrepo.service czechlight-migrate.service
 StartLimitIntervalSec=0
 ConditionKernelCommandLine=|czechlight=__MODEL__
 ConditionKernelCommandLine=|czechlight=__MODEL__-g2
diff --git a/package/czechlight-cfg-fs/czechlight-cfg-fs.mk b/package/czechlight-cfg-fs/czechlight-cfg-fs.mk
index e816275..aebcf4b 100644
--- a/package/czechlight-cfg-fs/czechlight-cfg-fs.mk
+++ b/package/czechlight-cfg-fs/czechlight-cfg-fs.mk
@@ -14,16 +14,11 @@
 
 define CZECHLIGHT_CFG_FS_BUILD_CMDS
 	$(TARGET_CC) $(CZECHLIGHT_CFG_FS_PKGDIR)/czechlight-random-seed.c -o $(@D)/czechlight-random-seed
-
-	$(HOST_DIR)/usr/bin/yanglint -t config \
-		$(TARGET_DIR)/usr/share/yang/modules/netopeer2/ietf-netconf-acm@2018-02-14.yang \
-		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/nacm.json
 endef
 
 CZECHLIGHT_CFG_FS_SYSTEMD_FOR_MULTIUSER = \
 	czechlight-install-yang.service \
-	czechlight-migrate.service \
-	nacm-restore.service
+	czechlight-migrate.service
 
 $(ifeq ($(CZECHLIGHT_CFG_FS_PERSIST_SYSREPO),y))
 	CZECHLIGHT_CFG_FS_SYSTEMD_FOR_MULTIUSER += \
@@ -47,9 +42,6 @@
 		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/impl-cfg-save-sysrepo \
 		$(@D)/czechlight-random-seed
 
-	$(INSTALL) -D -m 0644 -t $(TARGET_DIR)/usr/share/yang-data/ \
-		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/nacm.json
-
 	$(INSTALL) -D -m 0755 -t $(TARGET_DIR)/usr/libexec/czechlight-cfg-fs \
 		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/czechlight-install-yang.sh \
 		$(BR2_EXTERNAL_CZECHLIGHT_PATH)/package/czechlight-cfg-fs/czechlight-migrate.sh \
diff --git a/package/czechlight-cfg-fs/czechlight-migration-list.sh b/package/czechlight-cfg-fs/czechlight-migration-list.sh
index 6754752..7f8517c 100644
--- a/package/czechlight-cfg-fs/czechlight-migration-list.sh
+++ b/package/czechlight-cfg-fs/czechlight-migration-list.sh
@@ -2,4 +2,5 @@
     '0001_initial-data.sh'
     '0002_default_startup_configuration_for_ietf-interfaces.sh'
     '0003_shelve_alarms.sh'
+    '0004_nacm.sh'
 )
diff --git a/package/czechlight-cfg-fs/nacm.json b/package/czechlight-cfg-fs/migrations/0004_nacm.json
similarity index 100%
rename from package/czechlight-cfg-fs/nacm.json
rename to package/czechlight-cfg-fs/migrations/0004_nacm.json
diff --git a/package/czechlight-cfg-fs/migrations/0004_nacm.sh b/package/czechlight-cfg-fs/migrations/0004_nacm.sh
new file mode 100644
index 0000000..3d7a899
--- /dev/null
+++ b/package/czechlight-cfg-fs/migrations/0004_nacm.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Import CzechLight-specific NACM rules for DWDM modules
+# ------------------------------------------------------
+# Before this we restored these NACM rules from our "factory-default" on every boot, overwriting whatever was in the ietf-netconf-acm module.
+# Since config v4, the users are free to modify NACM rules as they wish.
+
+sysrepocfg -d startup -m ietf-netconf-acm -f json --import="${MIGRATIONS_DIRECTORY}/0004_nacm.json"
diff --git a/package/czechlight-cfg-fs/nacm-restore.service b/package/czechlight-cfg-fs/nacm-restore.service
deleted file mode 100644
index 4f5e5b9..0000000
--- a/package/czechlight-cfg-fs/nacm-restore.service
+++ /dev/null
@@ -1,15 +0,0 @@
-[Unit]
-Description=Restore NACM rules
-After=netopeer2-install-yang.service czechlight-migrate.service cfg.mount
-Requires=netopeer2-install-yang.service czechlight-migrate.service cfg.mount
-Before=netopeer2-setup.service netopeer2.service sysrepo-persistent-cfg.service
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=/bin/sysrepocfg -d startup -m ietf-netconf-acm -f json --import=/usr/share/yang-data/nacm.json
-ExecStart=/bin/sysrepocfg -C startup
-Group=sysrepo
-
-[Install]
-WantedBy=multi-user.target
diff --git a/package/reset-sysrepo/reset-sysrepo.mk b/package/reset-sysrepo/reset-sysrepo.mk
index 2fbd9ec..9aecbd5 100644
--- a/package/reset-sysrepo/reset-sysrepo.mk
+++ b/package/reset-sysrepo/reset-sysrepo.mk
@@ -24,7 +24,6 @@
 		sysrepo-ietf-alarms.service \
 		sysrepo-persistent-cfg.service \
 		sysrepo-plugind.service \
-		nacm-restore.service \
 		velia-firewall.service \
 		velia-health.service \
 		velia-system.service \
diff --git a/package/rousette/rousette.service b/package/rousette/rousette.service
index ba9efbb..b149d6c 100644
--- a/package/rousette/rousette.service
+++ b/package/rousette/rousette.service
@@ -1,8 +1,8 @@
 [Unit]
 Description=RESTCONFish server
-After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service
 PartOf=netopeer2.service
-Requires=cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+Requires=cfg-restore-sysrepo.service czechlight-migrate.service
 
 [Service]
 Type=simple
diff --git a/package/sysrepo-ietf-alarms/sysrepo-ietf-alarms.service b/package/sysrepo-ietf-alarms/sysrepo-ietf-alarms.service
index 0bb5884..27e2359 100644
--- a/package/sysrepo-ietf-alarms/sysrepo-ietf-alarms.service
+++ b/package/sysrepo-ietf-alarms/sysrepo-ietf-alarms.service
@@ -1,9 +1,9 @@
 [Unit]
 Description=IETF-alarms management via sysrepo
-After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service
 Before=rauc-mark-good.service
 PartOf=netopeer2.service
-Requires=cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+Requires=cfg-restore-sysrepo.service czechlight-migrate.service
 ConditionKernelCommandLine=czechlight
 
 [Service]
diff --git a/package/velia/velia-firewall.service b/package/velia/velia-firewall.service
index e5dd1d6..3fc8839 100644
--- a/package/velia/velia-firewall.service
+++ b/package/velia/velia-firewall.service
@@ -1,9 +1,9 @@
 [Unit]
 Description=Firewall management via sysrepo
-After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service
 Before=rauc-mark-good.service
 PartOf=netopeer2.service
-Requires=cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+Requires=cfg-restore-sysrepo.service czechlight-migrate.service
 ConditionKernelCommandLine=czechlight
 
 [Service]
diff --git a/package/velia/velia-hardware-g1.service b/package/velia/velia-hardware-g1.service
index cb0cd30..0efa671 100644
--- a/package/velia/velia-hardware-g1.service
+++ b/package/velia/velia-hardware-g1.service
@@ -1,9 +1,9 @@
 [Unit]
 Description=Tracking hardware metrics
-After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service
 Before=rauc-mark-good.service
 PartOf=netopeer2.service
-Requires=cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+Requires=cfg-restore-sysrepo.service czechlight-migrate.service
 ConditionKernelCommandLine=|czechlight=sdn-inline
 ConditionKernelCommandLine=|czechlight=sdn-roadm-add-drop
 ConditionKernelCommandLine=|czechlight=sdn-roadm-coherent-a-d
diff --git a/package/velia/velia-hardware-g2.service b/package/velia/velia-hardware-g2.service
index 8a58eab..1186979 100644
--- a/package/velia/velia-hardware-g2.service
+++ b/package/velia/velia-hardware-g2.service
@@ -1,9 +1,9 @@
 [Unit]
 Description=Tracking hardware metrics
-After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service
 Before=rauc-mark-good.service
 PartOf=netopeer2.service
-Requires=cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+Requires=cfg-restore-sysrepo.service czechlight-migrate.service
 ConditionKernelCommandLine=|czechlight=sdn-inline-g2
 ConditionKernelCommandLine=|czechlight=sdn-roadm-add-drop-g2
 ConditionKernelCommandLine=|czechlight=sdn-roadm-coherent-a-d-g2
diff --git a/package/velia/velia-health.service b/package/velia/velia-health.service
index d755099..f2cd48e 100644
--- a/package/velia/velia-health.service
+++ b/package/velia/velia-health.service
@@ -1,7 +1,7 @@
 [Unit]
 Description=Health tracking of the whole system
-Requires=multi-user.target cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service sysrepo-ietf-alarms.service
-After=multi-user.target cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service sysrepo-ietf-alarms.service
+Requires=multi-user.target cfg-restore-sysrepo.service czechlight-migrate.service sysrepo-ietf-alarms.service
+After=multi-user.target cfg-restore-sysrepo.service czechlight-migrate.service sysrepo-ietf-alarms.service
 ConditionKernelCommandLine=czechlight
 
 [Service]
diff --git a/package/velia/velia-system.service b/package/velia/velia-system.service
index 113be5c..2fd6a7e 100644
--- a/package/velia/velia-system.service
+++ b/package/velia/velia-system.service
@@ -1,9 +1,9 @@
 [Unit]
 Description=System management via sysrepo
-After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+After=syslog.target network.target cfg-restore-sysrepo.service czechlight-migrate.service
 Before=rauc-mark-good.service
 PartOf=netopeer2.service
-Requires=cfg-restore-sysrepo.service czechlight-migrate.service nacm-restore.service
+Requires=cfg-restore-sysrepo.service czechlight-migrate.service
 ConditionKernelCommandLine=czechlight
 
 [Service]