diff --git a/clients/cloud-setup/nm-cloud-setup.service.in b/clients/cloud-setup/nm-cloud-setup.service.in
index 849f7ea..57f9e93 100644
--- a/clients/cloud-setup/nm-cloud-setup.service.in
+++ b/clients/cloud-setup/nm-cloud-setup.service.in
@@ -23,15 +23,15 @@ PrivateDevices=yes
 PrivateTmp=yes
 ProtectControlGroups=yes
 ProtectHome=yes
-#ProtectHostname=yes
-#ProtectKernelLogs=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
 ProtectKernelModules=yes
 ProtectKernelTunables=yes
 ProtectSystem=strict
 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
 RestrictNamespaces=yes
 RestrictRealtime=yes
-#RestrictSUIDSGID=yes
+RestrictSUIDSGID=yes
 SystemCallFilter=@system-service
 
 [Install]
diff --git a/docs/api/html/NetworkManager.conf.html b/docs/api/html/NetworkManager.conf.html
index 409dd35..3655be2 100644
--- a/docs/api/html/NetworkManager.conf.html
+++ b/docs/api/html/NetworkManager.conf.html
@@ -600,7 +600,7 @@ unmanaged-devices=mac:00:22:68:1c:59:b1;mac:00:1E:65:30:D1:C4;interface-name:eth
           are "<code class="literal">syslog</code>" and "<code class="literal">journal</code>".
           When NetworkManager is started with "<code class="literal">--debug</code>"
           in addition all messages will be printed to stderr.
-          If unspecified, the default is "<code class="literal">journal</code>".
+          If unspecified, the default is "<code class="literal">syslog</code>".
           </p></td>
 </tr>
 <tr>
diff --git a/man/NetworkManager.conf.5 b/man/NetworkManager.conf.5
index 506010f..01c6429 100644
--- a/man/NetworkManager.conf.5
+++ b/man/NetworkManager.conf.5
@@ -626,7 +626,7 @@ INFO\&.
 .PP
 \fIbackend\fR
 .RS 4
-The logging backend\&. Supported values are "syslog" and "journal"\&. When NetworkManager is started with "\-\-debug" in addition all messages will be printed to stderr\&. If unspecified, the default is "journal"\&.
+The logging backend\&. Supported values are "syslog" and "journal"\&. When NetworkManager is started with "\-\-debug" in addition all messages will be printed to stderr\&. If unspecified, the default is "syslog"\&.
 .RE
 .PP
 \fIaudit\fR