diff --git a/src/confd/configure.ac b/src/confd/configure.ac
index 804727c5..6266615b 100644
--- a/src/confd/configure.ac
+++ b/src/confd/configure.ac
@@ -20,6 +20,7 @@ AC_CONFIG_FILES([
 	share/migrate/1.4/Makefile
 	share/migrate/1.5/Makefile
 	share/migrate/1.6/Makefile
+	share/migrate/1.7/Makefile
 	yang/Makefile
 	yang/confd/Makefile
 	yang/test-mode/Makefile
diff --git a/src/confd/share/migrate/1.7/10-netconf-server-tcp-params.sh b/src/confd/share/migrate/1.7/10-netconf-server-tcp-params.sh
new file mode 100755
index 00000000..1ebab54d
--- /dev/null
+++ b/src/confd/share/migrate/1.7/10-netconf-server-tcp-params.sh
@@ -0,0 +1,28 @@
+#!/bin/sh
+# Migrate NETCONF server TCP parameters to new YANG schema (RFC 9643)
+# The 'local-address' leaf has been moved into a 'local-bind' list
+# Old: tcp-server-parameters/local-address
+# New: tcp-server-parameters/local-bind[]/local-address
+
+file=$1
+temp=${file}.tmp
+
+jq '
+if .["ietf-netconf-server:netconf-server"]?.listen?.endpoints?.endpoint then
+  .["ietf-netconf-server:netconf-server"].listen.endpoints.endpoint |= map(
+    if .ssh?."tcp-server-parameters"?."local-address" then
+      # Extract and remove the old local-address value, then add new structure
+      .ssh."tcp-server-parameters"."local-address" as $addr |
+      .ssh."tcp-server-parameters" |= (del(."local-address") | . + {
+        "local-bind": [{
+          "local-address": $addr
+        }]
+      })
+    else
+      .
+    end
+  )
+else
+  .
+end
+' "$file" > "$temp" && mv "$temp" "$file"
diff --git a/src/confd/share/migrate/1.7/20-keystore-cleartext-key-rename.sh b/src/confd/share/migrate/1.7/20-keystore-cleartext-key-rename.sh
new file mode 100755
index 00000000..2343e5f8
--- /dev/null
+++ b/src/confd/share/migrate/1.7/20-keystore-cleartext-key-rename.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+# Migrate keystore symmetric key syntax to new YANG schema (RFC 9643)
+# The 'cleartext-key' leaf has been renamed to 'cleartext-symmetric-key'
+# Old: symmetric-key[]/key-type/cleartext-key
+# New: symmetric-key[]/key-type/cleartext-symmetric-key
+
+file=$1
+temp=${file}.tmp
+
+jq '
+if .["ietf-keystore:keystore"]?."symmetric-keys"?."symmetric-key" then
+  .["ietf-keystore:keystore"]."symmetric-keys"."symmetric-key" |= map(
+    if ."key-type"?."cleartext-key" then
+      # Rename cleartext-key to cleartext-symmetric-key
+      ."key-type"."cleartext-key" as $key_value |
+      ."key-type" |= (del(."cleartext-key") | . + {
+        "cleartext-symmetric-key": $key_value
+      })
+    else
+      .
+    end
+  )
+else
+  .
+end
+' "$file" > "$temp" && mv "$temp" "$file"
diff --git a/src/confd/share/migrate/1.7/Makefile.am b/src/confd/share/migrate/1.7/Makefile.am
new file mode 100644
index 00000000..488c2765
--- /dev/null
+++ b/src/confd/share/migrate/1.7/Makefile.am
@@ -0,0 +1,3 @@
+migratedir          = $(pkgdatadir)/migrate/1.7
+dist_migrate_DATA   = 10-netconf-server-tcp-params.sh \
+                      20-keystore-cleartext-key-rename.sh
diff --git a/src/confd/share/migrate/Makefile.am b/src/confd/share/migrate/Makefile.am
index c5d75c31..0a7c2c82 100644
--- a/src/confd/share/migrate/Makefile.am
+++ b/src/confd/share/migrate/Makefile.am
@@ -1,2 +1,2 @@
-SUBDIRS             = 1.0 1.1 1.2 1.3 1.4 1.5 1.6
+SUBDIRS             = 1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7
 migratedir          = $(pkgdatadir)/migrate