diff --git a/src/configs/bigbox-v1-cm-2.json b/src/configs/bigbox-v1-cm-2.json
index 416623a1..99decc68 100644
--- a/src/configs/bigbox-v1-cm-2.json
+++ b/src/configs/bigbox-v1-cm-2.json
@@ -8,6 +8,10 @@
           "name": "config",
           "root": "/data/devicecode/configs"
         },
+        {
+          "name": "credentials",
+          "root": "/data/configs"
+        },
         {
           "name": "state",
           "root": "/tmp/devicecode-state"
diff --git a/src/services/hal/backends/openwrt/uci_manager.lua b/src/services/hal/backends/openwrt/uci_manager.lua
index ad610e69..9e70b853 100644
--- a/src/services/hal/backends/openwrt/uci_manager.lua
+++ b/src/services/hal/backends/openwrt/uci_manager.lua
@@ -78,6 +78,11 @@ local function is_uci_identifier(s)
 	return type(s) == 'string' and s ~= '' and s:match('^[A-Za-z0-9_]+$') ~= nil
 end
 
+-- UCI section types (e.g. wifi-device, wifi-iface) may contain hyphens.
+local function is_uci_section_type(s)
+	return type(s) == 'string' and s ~= '' and s:match('^[A-Za-z0-9_%-]+$') ~= nil
+end
+
 local function validate_pkg(s, label)
 	if not is_uci_identifier(s) then
 		return nil, label .. ' must be a non-empty UCI identifier'
@@ -149,7 +154,7 @@ local function validate_change(record, ch, i)
 			return nil, 'change ' .. i .. ' option/section type required'
 		end
 		if ch.value == nil then
-			if not is_uci_identifier(ch.option) then
+			if not is_uci_section_type(ch.option) then
 				return nil, 'change ' .. i .. ' named section type must be a UCI identifier'
 			end
 		else
diff --git a/src/services/metrics.lua b/src/services/metrics.lua
index eec75852..91bc2e65 100644
--- a/src/services/metrics.lua
+++ b/src/services/metrics.lua
@@ -556,7 +556,7 @@ function M.start(conn, opts)
 	end)
 
 	svc:obs_log('info', 'waiting for filesystem capability')
-	local fs_listener = cap_sdk.new_cap_listener(conn, 'fs', 'configs')
+	local fs_listener = cap_sdk.new_cap_listener(conn, 'fs', 'credentials')
 	local fs_cap, cap_err = fs_listener:wait_for_cap()
 	fs_listener:close()
 	if not fs_cap then
diff --git a/src/services/wifi.lua b/src/services/wifi.lua
index 4ec1e339..bd405617 100644
--- a/src/services/wifi.lua
+++ b/src/services/wifi.lua
@@ -757,7 +757,7 @@ local function on_fs_cap(ctx, msg)
     local state = msg.payload
     if state == 'added' then
         ctx.svc:obs_log('info', { what = 'fs_configs_cap_added' })
-        ctx.fs_configs_cap = cap_sdk.new_cap_ref(ctx.conn, 'fs', 'configs')
+        ctx.fs_configs_cap = cap_sdk.new_cap_ref(ctx.conn, 'fs', 'credentials')
         reapply_all_radios(ctx)
     elseif state == 'removed' then
         ctx.svc:obs_log('info', { what = 'fs_configs_cap_removed' })
@@ -810,7 +810,7 @@ function WifiService.start(conn, opts)
     -- Subscribe to cap state notifications (radio, band, fs/configs)
     local radio_cap_listener = cap_sdk.new_cap_listener(conn, 'radio', '+')
     local band_cap_listener  = cap_sdk.new_cap_listener(conn, 'band', '1')
-    local fs_cap_listener    = cap_sdk.new_cap_listener(conn, 'fs', 'configs')
+    local fs_cap_listener    = cap_sdk.new_cap_listener(conn, 'fs', 'credentials')
 
     svc:status('running')
     svc:obs_log('info', 'service running')