diff --git a/board/common/users b/board/common/users
index e57dbddc..f297289f 100644
--- a/board/common/users
+++ b/board/common/users
@@ -1,2 +1 @@
-admin	 -1 wheel    -1 =admin /home/admin /bin/bash	 -     Administrator
 factory	 -1 wheel    -1 =reset -	   /sbin/factory -     Reset to factory defaults
diff --git a/src/confd/src/ietf-system.c b/src/confd/src/ietf-system.c
index fe7894cc..900d205e 100644
--- a/src/confd/src/ietf-system.c
+++ b/src/confd/src/ietf-system.c
@@ -595,13 +595,29 @@ static int sys_del_user(char *user)
 	return SR_ERR_OK;
 }
 
+/*
+ * XXX: drop superuser/wheel exception as soon as we have clish-ng in place.
+ *      It is supposed to connect to the netopeer server via 127.0.0.1 so
+ *      that the full NACM applies to the user instead of the file system
+ *      permissions that apply to the current klish.
+ */
 static int sys_add_new_user(char *name)
 {
-	char *args[] = {
+	char *sargs[] = {
+		"adduser", "-D", "-S", "-G", "wheel", name, NULL
+	};
+	char *uargs[] = {
 		"adduser", "-D", name, NULL
 	};
+	char **args;
 	int err;
 
+	/* XXX: group mapping to wheel should be done using nacm ACLs instead. */
+	if (!strcmp(name, "admin"))
+		args = sargs;	/* superuser */
+	else
+		args = uargs;	/* user */
+
 	/**
 	 * The Busybox implementation of adduser -D sets the password to "!",
 	 * which should prevent the new user from logging in until Augeas has
diff --git a/src/confd/src/srx_module.c b/src/confd/src/srx_module.c
index 37e446bf..1ac0c444 100644
--- a/src/confd/src/srx_module.c
+++ b/src/confd/src/srx_module.c
@@ -51,6 +51,21 @@ sr_error_t srx_require_module(sr_conn_ctx_t *conn,
 		}
 	}
 
+	/*
+	 * XXX: allow admin users access to the same modules as 'root'
+	 */
+	if (!err) {
+		int i;
+
+		for (i = 0; i < SR_MOD_DS_PLUGIN_COUNT; i++) {
+			err = sr_set_module_ds_access(conn, mr->name, i, "root", "wheel", 0660);
+			if (err) {
+				ERROR("Failed setting group 'wheel' permissions on %s", mr->name);
+				err = 0;
+			}
+		}
+	}
+
 	return err;
 }