diff --git a/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg b/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg
index b51c0351..255e094e 100644
--- a/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg
+++ b/board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg
@@ -218,7 +218,7 @@
       "symmetric-key": [
         {
           "name": "wifi",
-          "infix-keystore:cleartext-symmetric-key": "infixinfix",
+          "infix-keystore:symmetric-key": "infixinfix",
           "infix-keystore:key-format": "infix-crypto-types:wifi-preshared-key-format"
         }
       ]
diff --git a/board/aarch64/raspberrypi-rpi64/README.md b/board/aarch64/raspberrypi-rpi64/README.md
index 14be9f13..5c9dff8c 100644
--- a/board/aarch64/raspberrypi-rpi64/README.md
+++ b/board/aarch64/raspberrypi-rpi64/README.md
@@ -108,7 +108,7 @@ To configure WiFi as a client, first store your WiFi password in the keystore:
 admin@infix:/> configure
 admin@infix:/config/> edit keystore symmetric-key mywifi
 admin@infix:/config/keystore/…/mywifi/> set key-format wifi-preshared-key-format
-admin@infix:/config/keystore/…/mywifi/> set cleartext-symmetric-key YourWiFiPassword
+admin@infix:/config/keystore/…/mywifi/> set symmetric-key YourWiFiPassword
 admin@infix:/config/keystore/…/mywifi/> leave
 ```
 
diff --git a/doc/wifi.md b/doc/wifi.md
index 462be94d..155b484e 100644
--- a/doc/wifi.md
+++ b/doc/wifi.md
@@ -334,13 +334,13 @@ admin@example:/config/hardware/component/radio0/wifi-radio/> leave
 admin@example:/> configure
 admin@example:/config/> edit keystore symmetric-key main-secret
 admin@example:/config/keystore/…/main-secret/> set key-format wifi-preshared-key-format
-admin@example:/config/keystore/…/main-secret/> set cleartext-symmetric-key MyMainPassword
+admin@example:/config/keystore/…/main-secret/> set symmetric-key MyMainPassword
 admin@example:/config/> edit keystore symmetric-key guest-secret
 admin@example:/config/keystore/…/guest-secret/> set key-format wifi-preshared-key-format
-admin@example:/config/keystore/…/guest-secret/> set cleartext-symmetric-key GuestPassword123
+admin@example:/config/keystore/…/guest-secret/> set symmetric-key GuestPassword123
 admin@example:/config/> edit keystore symmetric-key iot-secret
 admin@example:/config/keystore/…/iot-secret/> set key-format wifi-preshared-key-format
-admin@example:/config/keystore/…/iot-secret/> set cleartext-symmetric-key IoTDevices2025
+admin@example:/config/keystore/…/iot-secret/> set symmetric-key IoTDevices2025
 admin@example:/config/keystore/…/iot-secret/> leave
 ```
 
diff --git a/src/confd/share/migrate/1.7/20-keystore-cleartext-key-rename.sh b/src/confd/share/migrate/1.7/20-keystore-cleartext-key-rename.sh
index 2343e5f8..fec54bc5 100755
--- a/src/confd/share/migrate/1.7/20-keystore-cleartext-key-rename.sh
+++ b/src/confd/share/migrate/1.7/20-keystore-cleartext-key-rename.sh
@@ -1,8 +1,5 @@
 #!/bin/sh
-# Migrate keystore symmetric key syntax to new YANG schema (RFC 9643)
-# The 'cleartext-key' leaf has been renamed to 'cleartext-symmetric-key'
-# Old: symmetric-key[]/key-type/cleartext-key
-# New: symmetric-key[]/key-type/cleartext-symmetric-key
+# Rename cleartext-symmetric-key to symmetric-key
 
 file=$1
 temp=${file}.tmp
@@ -14,7 +11,7 @@ if .["ietf-keystore:keystore"]?."symmetric-keys"?."symmetric-key" then
       # Rename cleartext-key to cleartext-symmetric-key
       ."key-type"."cleartext-key" as $key_value |
       ."key-type" |= (del(."cleartext-key") | . + {
-        "cleartext-symmetric-key": $key_value
+        "symmetric-key": $key_value
       })
     else
       .
diff --git a/src/confd/src/hardware.c b/src/confd/src/hardware.c
index 84e46ef2..24de8543 100644
--- a/src/confd/src/hardware.c
+++ b/src/confd/src/hardware.c
@@ -218,7 +218,7 @@ static int wifi_gen_station(const char *ifname, struct lyd_node *station,
 
 	if (secret_name && strcmp(security_mode, "disabled") != 0) {
 		secret_node = lydx_get_xpathf(config,
-			"/keystore/symmetric-keys/symmetric-key[name='%s']/cleartext-symmetric-key",
+			"/keystore/symmetric-keys/symmetric-key[name='%s']/symmetric-key",
 			secret_name);
 		secret = secret_node ? lyd_get_value(secret_node) : NULL;
 	} else {
@@ -355,7 +355,7 @@ static int wifi_gen_bss_section(FILE *hostapd, struct lyd_node *cifs, const char
 		secret_name = lydx_get_cattr(security, "secret");
 		if (secret_name) {
 			secret_node = lydx_get_xpathf(config,
-				"/keystore/symmetric-keys/symmetric-key[name='%s']/cleartext-symmetric-key",
+				"/keystore/symmetric-keys/symmetric-key[name='%s']/symmetric-key",
 				secret_name);
 			if (secret_node)
 				secret = lyd_get_value(secret_node);
@@ -458,7 +458,7 @@ static int wifi_gen_aps_on_radio(const char *radio_name, struct lyd_node *cifs,
 	/* Get secret from keystore if not open network */
 	if (secret_name && strcmp(security_mode, "open") != 0) {
 		secret_node = lydx_get_xpathf(config,
-			"/keystore/symmetric-keys/symmetric-key[name='%s']/cleartext-symmetric-key",
+			"/keystore/symmetric-keys/symmetric-key[name='%s']/symmetric-key",
 			secret_name);
 		if (secret_node) {
 			secret = lyd_get_value(secret_node);
diff --git a/src/confd/yang/confd/infix-keystore.yang b/src/confd/yang/confd/infix-keystore.yang
index fec06fed..f94a362c 100644
--- a/src/confd/yang/confd/infix-keystore.yang
+++ b/src/confd/yang/confd/infix-keystore.yang
@@ -55,7 +55,7 @@ module infix-keystore {
   }
   augment "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:key-type" {
     case cleartext-symmetric-key {
-      leaf cleartext-symmetric-key {
+      leaf symmetric-key {
         type string;
         must "../../key-format != 'infix-ct:wifi-preshared-key-format' or " +
           "(string-length(.) >= 8 and string-length(.) <= 63)" {