diff --git a/netbox/dcim/forms.py b/netbox/dcim/forms.py
index 18896bac6..e10b0df56 100644
--- a/netbox/dcim/forms.py
+++ b/netbox/dcim/forms.py
@@ -28,12 +28,6 @@ from .models import (
 )
 
 
-FORM_STATUS_CHOICES = [
-    ['', '---------'],
-]
-
-FORM_STATUS_CHOICES += STATUS_CHOICES
-
 DEVICE_BY_PK_RE = '{\d+\}'
 
 
@@ -633,13 +627,28 @@ class DeviceForm(BootstrapMixin, TenancyForm, CustomFieldForm):
 
             # Compile list of choices for primary IPv4 and IPv6 addresses
             for family in [4, 6]:
-                ip_choices = []
-                interface_ips = IPAddress.objects.filter(family=family, interface__device=self.instance)
-                ip_choices += [(ip.id, '{} ({})'.format(ip.address, ip.interface)) for ip in interface_ips]
-                nat_ips = IPAddress.objects.filter(family=family, nat_inside__interface__device=self.instance)\
-                    .select_related('nat_inside__interface')
-                ip_choices += [(ip.id, '{} ({} NAT)'.format(ip.address, ip.nat_inside.interface)) for ip in nat_ips]
-                self.fields['primary_ip{}'.format(family)].choices = [(None, '---------')] + ip_choices
+                ip_choices = [(None, '---------')]
+                # Collect interface IPs
+                interface_ips = IPAddress.objects.select_related('interface').filter(
+                    family=family, interface__device=self.instance
+                )
+                if interface_ips:
+                    ip_choices.append(
+                        ('Interface IPs', [
+                            (ip.id, '{} ({})'.format(ip.address, ip.interface)) for ip in interface_ips
+                        ])
+                    )
+                # Collect NAT IPs
+                nat_ips = IPAddress.objects.select_related('nat_inside').filter(
+                    family=family, nat_inside__interface__device=self.instance
+                )
+                if nat_ips:
+                    ip_choices.append(
+                        ('NAT IPs', [
+                            (ip.id, '{} ({})'.format(ip.address, ip.nat_inside.address)) for ip in nat_ips
+                        ])
+                    )
+                self.fields['primary_ip{}'.format(family)].choices = ip_choices
 
             # If editing an existing device, exclude it from the list of occupied rack units. This ensures that a device
             # can be flipped from one face to another.
@@ -839,7 +848,7 @@ class DeviceBulkEditForm(BootstrapMixin, CustomFieldBulkEditForm):
     device_role = forms.ModelChoiceField(queryset=DeviceRole.objects.all(), required=False, label='Role')
     tenant = forms.ModelChoiceField(queryset=Tenant.objects.all(), required=False)
     platform = forms.ModelChoiceField(queryset=Platform.objects.all(), required=False)
-    status = forms.ChoiceField(choices=FORM_STATUS_CHOICES, required=False, initial='', label='Status')
+    status = forms.ChoiceField(choices=add_blank_choice(STATUS_CHOICES), required=False, initial='')
     serial = forms.CharField(max_length=50, required=False, label='Serial Number')
 
     class Meta:
diff --git a/netbox/dcim/models.py b/netbox/dcim/models.py
index 4b3d41304..b6c726863 100644
--- a/netbox/dcim/models.py
+++ b/netbox/dcim/models.py
@@ -898,13 +898,25 @@ class Device(CreatedUpdatedModel, CustomFieldModel):
                 pass
 
         # Validate primary IPv4 address
-        if self.primary_ip4 and (self.primary_ip4.interface is None or self.primary_ip4.interface.device != self):
+        if self.primary_ip4 and (
+            self.primary_ip4.interface is None or
+            self.primary_ip4.interface.device != self
+        ) and (
+            self.primary_ip4.nat_inside.interface is None or
+            self.primary_ip4.nat_inside.interface.device != self
+        ):
             raise ValidationError({
                 'primary_ip4': "The specified IP address ({}) is not assigned to this device.".format(self.primary_ip4),
             })
 
         # Validate primary IPv6 address
-        if self.primary_ip6 and (self.primary_ip6.interface is None or self.primary_ip6.interface.device != self):
+        if self.primary_ip6 and (
+            self.primary_ip6.interface is None or
+            self.primary_ip6.interface.device != self
+        ) and (
+            self.primary_ip6.nat_inside.interface is None or
+            self.primary_ip6.nat_inside.interface.device != self
+        ):
             raise ValidationError({
                 'primary_ip6': "The specified IP address ({}) is not assigned to this device.".format(self.primary_ip6),
             })
diff --git a/netbox/ipam/forms.py b/netbox/ipam/forms.py
index 1fa6562d1..f989ff3d2 100644
--- a/netbox/ipam/forms.py
+++ b/netbox/ipam/forms.py
@@ -25,11 +25,8 @@ IP_FAMILY_CHOICES = [
     (6, 'IPv6'),
 ]
 
-PREFIX_MASK_LENGTH_CHOICES = [
-    ('', '---------'),
-] + [(i, i) for i in range(1, 128)]
-
-IPADDRESS_MASK_LENGTH_CHOICES = PREFIX_MASK_LENGTH_CHOICES + [(128, 128)]
+PREFIX_MASK_LENGTH_CHOICES = add_blank_choice([(i, i) for i in range(1, 128)])
+IPADDRESS_MASK_LENGTH_CHOICES = add_blank_choice([(i, i) for i in range(1, 129)])
 
 
 #
diff --git a/netbox/project-static/js/secrets.js b/netbox/project-static/js/secrets.js
index 638638623..d1ec3d883 100644
--- a/netbox/project-static/js/secrets.js
+++ b/netbox/project-static/js/secrets.js
@@ -43,7 +43,7 @@ $(document).ready(function() {
             success: function (response, status) {
                 if (response.plaintext) {
                     console.log("Secret retrieved successfully");
-                    $('#secret_' + secret_id).html(response.plaintext);
+                    $('#secret_' + secret_id).text(response.plaintext);
                     $('button.unlock-secret[secret-id=' + secret_id + ']').hide();
                     $('button.lock-secret[secret-id=' + secret_id + ']').show();
                 } else {