diff --git a/package/klish-plugin-sysrepo/klish-plugin-sysrepo.hash b/package/klish-plugin-sysrepo/klish-plugin-sysrepo.hash
index ceb5ac66..86d6e057 100644
--- a/package/klish-plugin-sysrepo/klish-plugin-sysrepo.hash
+++ b/package/klish-plugin-sysrepo/klish-plugin-sysrepo.hash
@@ -1,4 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  515fa2a3c66b41d6ab5ec93d61cdd32097115b2f46e39c522659b84d555eebf5  klish-plugin-sysrepo-cdd3eb51a7f7ee0ed5bd925fa636061d3b1b85fb-br1.tar.gz
-
+sha256  96ab24ea3c0aaf491db18930fca2ef30276d949c17996f3a595d36789ee0187d  klish-plugin-sysrepo-56c5bdd6a851c5472ee9efd654603df89f337795-br1.tar.gz
diff --git a/package/klish-plugin-sysrepo/klish-plugin-sysrepo.mk b/package/klish-plugin-sysrepo/klish-plugin-sysrepo.mk
index c8882bc0..e7359bf3 100644
--- a/package/klish-plugin-sysrepo/klish-plugin-sysrepo.mk
+++ b/package/klish-plugin-sysrepo/klish-plugin-sysrepo.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-KLISH_PLUGIN_SYSREPO_VERSION = cdd3eb51a7f7ee0ed5bd925fa636061d3b1b85fb
+KLISH_PLUGIN_SYSREPO_VERSION = 56c5bdd6a851c5472ee9efd654603df89f337795
 KLISH_PLUGIN_SYSREPO_SITE = https://src.libcode.org/pkun/klish-plugin-sysrepo.git
 KLISH_PLUGIN_SYSREPO_SITE_METHOD = git
 KLISH_PLUGIN_SYSREPO_LICENSE = BSD-3
diff --git a/src/confd/sysrepo-bootstrap.sh b/src/confd/sysrepo-bootstrap.sh
index 70baacb6..901946fb 100755
--- a/src/confd/sysrepo-bootstrap.sh
+++ b/src/confd/sysrepo-bootstrap.sh
@@ -83,6 +83,9 @@ sysrepoctl -s $SEARCH							\
 	   -I "${INIT_DATA}"
 rc=$?
 
+# Unlike `sysrepoctl -i` the `-c` command requires separate invocations.
+# NOTE: we ignore any errors from these at bootstrap since sysrepo may
+#       already enable some of these feature, resulting in error here.
 # Enable features required by netopeer2
 sysrepoctl -c ietf-netconf			-g wheel -p 0660	\
 		-e writable-running					\
@@ -93,6 +96,8 @@ sysrepoctl -c ietf-netconf			-g wheel -p 0660	\
 		-e url							\
 		-e xpath						\
 		-e confirmed-commit
+# Allow wheel group users (admin) to modify NACM
+sysrepoctl -c ietf-netconf-acm -g wheel -p 0660
 
 # On first boot, install factory-config as startup-config
 # Otherwise, load startup-config to {startup}.  Due to a
diff --git a/src/klinfix/xml/infix.xml b/src/klinfix/xml/infix.xml
index 6258e52a..7b449038 100644
--- a/src/klinfix/xml/infix.xml
+++ b/src/klinfix/xml/infix.xml
@@ -15,6 +15,9 @@
     MultiKeysWithStatement = y
     Colorize = y
     Indent = 2
+    HidePasswords = y
+    DefaultKeys = n
+    EnableNACM = y
   </PLUGIN>
 
   <PTYPE name="DATASTORE">
@@ -156,8 +159,8 @@
 
     <!-- Move -->
 
-    <COMMAND name="abort" help="Abandon candidate">
-      <ACTION sym="srp_rollback@sysrepo"/>
+    <COMMAND name="abort" help="Abandon changes made candidate">
+      <ACTION sym="srp_reset@sysrepo"/>
       <ACTION sym="nav">replace main</ACTION>
     </COMMAND>
 
@@ -206,8 +209,8 @@
       <ACTION sym="klix_commit@klinfix"/>
     </COMMAND>
 
-    <COMMAND name="rollback" help="Restore candidate to running-config">
-      <ACTION sym="srp_rollback@sysrepo"/>
+    <COMMAND name="reset" help="Reset candidate to running-config">
+      <ACTION sym="srp_reset@sysrepo"/>
     </COMMAND>
 
     <!-- Display -->