diff --git a/.gitignore b/.gitignore
index c597d9c845..d1bfc91d7f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -147,6 +147,7 @@ python/vyos/xml_ref/cache.py
 python/vyos/xml_ref/pkg_cache/*_cache.py
 python/vyos/xml_ref/op_cache.py
 python/vyos/xml_ref/pkg_cache/*_op_cache.py
+data/reftree.cache
 # autogenerated vyos-configd JSON definition
 data/configd-include.json
 
diff --git a/Makefile b/Makefile
index 411399c3a3..b5d114e59a 100644
--- a/Makefile
+++ b/Makefile
@@ -28,7 +28,7 @@ interface_definitions: $(config_xml_obj)
 
 	find $(BUILD_DIR)/interface-definitions -type f -name "*.xml" | xargs -I {} $(CURDIR)/scripts/build-command-templates {} $(CURDIR)/schema/interface_definition.rng $(TMPL_DIR) || exit 1
 
-	$(CURDIR)/python/vyos/xml_ref/generate_cache.py --xml-dir $(BUILD_DIR)/interface-definitions || exit 1
+	$(CURDIR)/python/vyos/xml_ref/generate_cache.py --xml-dir $(BUILD_DIR)/interface-definitions --internal-cache $(DATA_DIR)/reftree.cache || exit 1
 
 	# XXX: delete top level node.def's that now live in other packages
 	# IPSec VPN EAP-RADIUS does not support source-address
diff --git a/debian/rules b/debian/rules
index df1d9e7f30..c15fcab115 100755
--- a/debian/rules
+++ b/debian/rules
@@ -9,6 +9,7 @@ VYOS_CFG_TMPL_DIR := opt/vyatta/share/vyatta-cfg/templates
 VYOS_OP_TMPL_DIR := opt/vyatta/share/vyatta-op/templates
 VYOS_MIBS_DIR := usr/share/snmp/mibs
 VYOS_LOCALUI_DIR := srv/localui
+VYCONF_CONFIG_DIR := $(VYOS_LIBEXEC_DIR)/vyconf/config
 
 MIGRATION_SCRIPTS_DIR := opt/vyatta/etc/config-migrate/migrate
 ACTIVATION_SCRIPTS_DIR := usr/libexec/vyos/activate
@@ -89,6 +90,8 @@ override_dh_auto_install:
 	cp -r templates-op/* $(DIR)/$(VYOS_OP_TMPL_DIR)
 
 	# Install data files
+	mkdir -p $(DIR)/$(VYCONF_CONFIG_DIR)
+	cp -r data/reftree.cache $(DIR)/$(VYCONF_CONFIG_DIR)
 	mkdir -p $(DIR)/$(VYOS_DATA_DIR)
 	cp -r data/* $(DIR)/$(VYOS_DATA_DIR)
 
diff --git a/debian/vyos-1x.install b/debian/vyos-1x.install
index 502fc7aaa1..d5dd3bcec5 100644
--- a/debian/vyos-1x.install
+++ b/debian/vyos-1x.install
@@ -40,6 +40,7 @@ usr/libexec/vyos/op_mode
 usr/libexec/vyos/services
 usr/libexec/vyos/system
 usr/libexec/vyos/validators
+usr/libexec/vyos/vyconf
 usr/libexec/vyos/*.py
 usr/libexec/vyos/*.sh
 usr/share
diff --git a/python/vyos/configsession.py b/python/vyos/configsession.py
index 5876dc5b04..073ec09a47 100644
--- a/python/vyos/configsession.py
+++ b/python/vyos/configsession.py
@@ -23,8 +23,8 @@
 from vyos.utils.dict import dict_to_paths
 
 CLI_SHELL_API = '/bin/cli-shell-api'
-SET = '/opt/vyatta/sbin/my_set'
-DELETE = '/opt/vyatta/sbin/my_delete'
+SET = '/usr/libexec/vyos/vyconf/vy_set'
+DELETE = '/usr/libexec/vyos/vyconf/vy_delete'
 COMMENT = '/opt/vyatta/sbin/my_comment'
 COMMIT = '/opt/vyatta/sbin/my_commit'
 DISCARD = '/opt/vyatta/sbin/my_discard'
diff --git a/python/vyos/configtree.py b/python/vyos/configtree.py
index 3e02fbba61..fb79e84598 100644
--- a/python/vyos/configtree.py
+++ b/python/vyos/configtree.py
@@ -469,15 +469,15 @@ def mask_inclusive(left, right, libpath=LIBPATH):
 
     return tree
 
-def reference_tree_to_json(from_dir, to_file, libpath=LIBPATH):
+def reference_tree_to_json(from_dir, to_file, internal_cache="", libpath=LIBPATH):
     try:
         __lib = cdll.LoadLibrary(libpath)
         __reference_tree_to_json = __lib.reference_tree_to_json
-        __reference_tree_to_json.argtypes = [c_char_p, c_char_p]
+        __reference_tree_to_json.argtypes = [c_char_p, c_char_p, c_char_p]
         __get_error = __lib.get_error
         __get_error.argtypes = []
         __get_error.restype = c_char_p
-        res = __reference_tree_to_json(from_dir.encode(), to_file.encode())
+        res = __reference_tree_to_json(internal_cache.encode(), from_dir.encode(), to_file.encode())
     except Exception as e:
         raise ConfigTreeError(e)
     if res == 1:
diff --git a/python/vyos/utils/misc.py b/python/vyos/utils/misc.py
index d82655914b..ac8011b8d3 100644
--- a/python/vyos/utils/misc.py
+++ b/python/vyos/utils/misc.py
@@ -52,7 +52,7 @@ def install_into_config(conf, config_paths, override_prompt=True):
                 continue
 
         try:
-            cmd(f'/opt/vyatta/sbin/my_set {path}')
+            cmd(f'/usr/libexec/vyos/vyconf/vy_set {path}')
             count += 1
         except:
             failed.append(path)
diff --git a/python/vyos/xml_ref/generate_cache.py b/python/vyos/xml_ref/generate_cache.py
index 5f3f84deee..093697993e 100755
--- a/python/vyos/xml_ref/generate_cache.py
+++ b/python/vyos/xml_ref/generate_cache.py
@@ -55,6 +55,8 @@ def main():
     parser = ArgumentParser(description='generate and save dict from xml defintions')
     parser.add_argument('--xml-dir', type=str, required=True,
                         help='transcluded xml interface-definition directory')
+    parser.add_argument('--internal-cache', type=str, required=True,
+                        help='cache as unrendered json data for loading by vyconfd')
     parser.add_argument('--package-name', type=non_trivial, default='vyos-1x',
                         help='name of current package')
     parser.add_argument('--output-path', help='path to generated cache')
@@ -66,9 +68,11 @@ def main():
     out_path = args['output_path']
     path = out_path if out_path is not None else pkg_cache
     xml_cache = abspath(join(path, cache_name))
+    internal_cache = args['internal_cache']
 
     try:
-        reference_tree_to_json(xml_dir, xml_tmp)
+        reference_tree_to_json(xml_dir, xml_tmp,
+                               internal_cache=internal_cache)
     except ConfigTreeError as e:
         print(e)
         sys.exit(1)
diff --git a/src/init/vyos-router b/src/init/vyos-router
index 8825cc16aa..82ac4c6900 100755
--- a/src/init/vyos-router
+++ b/src/init/vyos-router
@@ -24,6 +24,8 @@ declare action=$1; shift
 declare -x BOOTFILE=$vyatta_sysconfdir/config/config.boot
 declare -x DEFAULT_BOOTFILE=$vyatta_sysconfdir/config.boot.default
 
+declare -x VYCONF_CONFIG_DIR=/usr/libexec/vyos/vyconf/config
+
 # If vyos-config= boot option is present, use that file instead
 for x in $(cat /proc/cmdline); do
     [[ $x = vyos-config=* ]] || continue
@@ -146,6 +148,10 @@ init_bootfile () {
         chgrp ${GROUP} $BOOTFILE
         chmod 660 $BOOTFILE
     fi
+    if [ -d $VYCONF_CONFIG_DIR ] ; then
+        cp -f $BOOTFILE $VYCONF_CONFIG_DIR/config.boot
+        cp -f $DEFAULT_BOOTFILE $VYCONF_CONFIG_DIR/config.failsafe
+    fi
 }
 
 # if necessary, migrate initial config
@@ -154,6 +160,10 @@ migrate_bootfile ()
     if [ -x $vyos_libexec_dir/run-config-migration.py ]; then
         log_progress_msg migrate
         sg ${GROUP} -c "$vyos_libexec_dir/run-config-migration.py $BOOTFILE"
+        # update vyconf copy after migration
+        if [ -d $VYCONF_CONFIG_DIR ] ; then
+            cp -f $BOOTFILE $VYCONF_CONFIG_DIR/config.boot
+        fi
     fi
 }
 
@@ -512,6 +522,8 @@ start ()
 
     disabled system_config || system_config
 
+    systemctl start vyconfd.service
+
     for s in ${subinit[@]} ; do
     if ! disabled $s; then
         log_progress_msg $s
@@ -554,6 +566,8 @@ stop()
     umount ${vyatta_configdir}
     log_action_end_msg $?
 
+    systemctl stop vyconfd.service
+
     systemctl stop frr.service
 
     unmount_encrypted_config
diff --git a/src/systemd/vyconfd.service b/src/systemd/vyconfd.service
new file mode 100644
index 0000000000..ab2280263b
--- /dev/null
+++ b/src/systemd/vyconfd.service
@@ -0,0 +1,21 @@
+[Unit]
+Description=VyOS vyconf daemon
+
+# Without this option, lots of default dependencies are added,
+# among them network.target, which creates a dependency cycle
+DefaultDependencies=no
+
+After=systemd-remount-fs.service
+
+[Service]
+ExecStart=/usr/libexec/vyos/vyconf/vyconfd --log-file /var/run/log/vyconfd.log
+Type=exec
+SyslogIdentifier=vyconfd
+SyslogFacility=daemon
+Restart=on-failure
+
+User=root
+Group=vyattacfg
+
+[Install]
+WantedBy=vyos.target