diff --git a/docs/api/html/NetworkManager.conf.html b/docs/api/html/NetworkManager.conf.html
index 0043209..035fd48 100644
--- a/docs/api/html/NetworkManager.conf.html
+++ b/docs/api/html/NetworkManager.conf.html
@@ -628,7 +628,7 @@ unmanaged-devices=mac:00:22:68:1c:59:b1;mac:00:1E:65:30:D1:C4;interface-name:eth
           are "<code class="literal">syslog</code>" and "<code class="literal">journal</code>".
           When NetworkManager is started with "<code class="literal">--debug</code>"
           in addition all messages will be printed to stderr.
-          If unspecified, the default is "<code class="literal">journal</code>".
+          If unspecified, the default is "<code class="literal">syslog</code>".
           </p></td>
 </tr>
 <tr>
diff --git a/man/NetworkManager.conf.5 b/man/NetworkManager.conf.5
index ac3df60..cf94846 100644
--- a/man/NetworkManager.conf.5
+++ b/man/NetworkManager.conf.5
@@ -640,7 +640,7 @@ INFO\&.
 .PP
 \fIbackend\fR
 .RS 4
-The logging backend\&. Supported values are "syslog" and "journal"\&. When NetworkManager is started with "\-\-debug" in addition all messages will be printed to stderr\&. If unspecified, the default is "journal"\&.
+The logging backend\&. Supported values are "syslog" and "journal"\&. When NetworkManager is started with "\-\-debug" in addition all messages will be printed to stderr\&. If unspecified, the default is "syslog"\&.
 .RE
 .PP
 \fIaudit\fR
diff --git a/src/nm-cloud-setup/nm-cloud-setup.service.in b/src/nm-cloud-setup/nm-cloud-setup.service.in
index 78441c7..809f707 100644
--- a/src/nm-cloud-setup/nm-cloud-setup.service.in
+++ b/src/nm-cloud-setup/nm-cloud-setup.service.in
@@ -27,15 +27,15 @@ PrivateDevices=yes
 PrivateTmp=yes
 ProtectControlGroups=yes
 ProtectHome=yes
-#ProtectHostname=yes
-#ProtectKernelLogs=yes
+ProtectHostname=yes
+ProtectKernelLogs=yes
 ProtectKernelModules=yes
 ProtectKernelTunables=yes
 ProtectSystem=strict
 RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6
 RestrictNamespaces=yes
 RestrictRealtime=yes
-#RestrictSUIDSGID=yes
+RestrictSUIDSGID=yes
 SystemCallFilter=@system-service
 
 [Install]