diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
index c2cd9377436c8d3b1403769e3e25e3d456499443..54d9dfa02579d9ffcaf2e9f2770f2e7da0773137 100644
--- a/src/qemu/qemu_migration.c
+++ b/src/qemu/qemu_migration.c
@@ -2228,7 +2228,6 @@ qemuMigrationDstPrepareAny(virQEMUDriverPtr driver,
 {
     virDomainObjPtr vm = NULL;
     virObjectEventPtr event = NULL;
-    virQEMUDriverConfigPtr cfg = NULL;
     int ret = -1;
     int dataFD[2] = { -1, -1 };
     qemuDomainObjPrivatePtr priv = NULL;
@@ -2451,8 +2450,7 @@ qemuMigrationDstPrepareAny(virQEMUDriverPtr driver,
     /* Migrations using TLS need to add the "tls-creds-x509" object and
      * set the migration TLS parameters */
     if (flags & VIR_MIGRATE_TLS) {
-        cfg = virQEMUDriverGetConfig(driver);
-        if (qemuMigrationParamsEnableTLS(driver, vm, cfg, true,
+        if (qemuMigrationParamsEnableTLS(driver, vm, true,
                                          QEMU_ASYNC_JOB_MIGRATION_IN,
                                          &tlsAlias, &secAlias, NULL,
                                          migParams) < 0)
@@ -2549,7 +2547,6 @@ qemuMigrationDstPrepareAny(virQEMUDriverPtr driver,
  cleanup:
     VIR_FREE(tlsAlias);
     VIR_FREE(secAlias);
-    virObjectUnref(cfg);
     qemuProcessIncomingDefFree(incoming);
     VIR_FREE(xmlout);
     VIR_FORCE_CLOSE(dataFD[0]);
@@ -3330,7 +3327,6 @@ qemuMigrationSrcRun(virQEMUDriverPtr driver,
 {
     int ret = -1;
     unsigned int migrate_flags = QEMU_MONITOR_MIGRATE_BACKGROUND;
-    virQEMUDriverConfigPtr cfg = NULL;
     qemuDomainObjPrivatePtr priv = vm->privateData;
     qemuMigrationCookiePtr mig = NULL;
     char *tlsAlias = NULL;
@@ -3410,8 +3406,7 @@ qemuMigrationSrcRun(virQEMUDriverPtr driver,
             spec->destType == MIGRATION_DEST_FD)
             hostname = spec->dest.host.name;
 
-        cfg = virQEMUDriverGetConfig(driver);
-        if (qemuMigrationParamsEnableTLS(driver, vm, cfg, false,
+        if (qemuMigrationParamsEnableTLS(driver, vm, false,
                                          QEMU_ASYNC_JOB_MIGRATION_OUT,
                                          &tlsAlias, &secAlias, hostname,
                                          migParams) < 0)
@@ -3649,7 +3644,6 @@ qemuMigrationSrcRun(virQEMUDriverPtr driver,
  cleanup:
     VIR_FREE(tlsAlias);
     VIR_FREE(secAlias);
-    virObjectUnref(cfg);
     VIR_FORCE_CLOSE(fd);
     virDomainDefFree(persistDef);
     qemuMigrationCookieFree(mig);
diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_params.c
index 476687aae2fc888c5b00d19291b9921e8253b8b2..dd8cf6884241594afb12ba3814e7e0351b93982d 100644
--- a/src/qemu/qemu_migration_params.c
+++ b/src/qemu/qemu_migration_params.c
@@ -136,7 +136,6 @@ qemuMigrationParamsSet(virQEMUDriverPtr driver,
 /* qemuMigrationParamsEnableTLS
  * @driver: pointer to qemu driver
  * @vm: domain object
- * @cfg: configuration pointer
  * @tlsListen: server or client
  * @asyncJob: Migration job to join
  * @tlsAlias: alias to be generated for TLS object
@@ -153,7 +152,6 @@ qemuMigrationParamsSet(virQEMUDriverPtr driver,
 int
 qemuMigrationParamsEnableTLS(virQEMUDriverPtr driver,
                              virDomainObjPtr vm,
-                             virQEMUDriverConfigPtr cfg,
                              bool tlsListen,
                              int asyncJob,
                              char **tlsAlias,
@@ -164,6 +162,8 @@ qemuMigrationParamsEnableTLS(virQEMUDriverPtr driver,
     qemuDomainObjPrivatePtr priv = vm->privateData;
     virJSONValuePtr tlsProps = NULL;
     virJSONValuePtr secProps = NULL;
+    virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver);
+    int ret = -1;
 
     if (!cfg->migrateTLSx509certdir) {
         virReportError(VIR_ERR_OPERATION_INVALID, "%s",
@@ -206,12 +206,16 @@ qemuMigrationParamsEnableTLS(virQEMUDriverPtr driver,
         VIR_STRDUP(migParams->params.tlsHostname, hostname ? hostname : "") < 0)
         goto error;
 
-    return 0;
+    ret = 0;
+
+ cleanup:
+    virObjectUnref(cfg);
+    return ret;
 
  error:
     virJSONValueFree(tlsProps);
     virJSONValueFree(secProps);
-    return -1;
+    goto cleanup;
 }
 
 
diff --git a/src/qemu/qemu_migration_params.h b/src/qemu/qemu_migration_params.h
index 6535c3af4746aeea5484cdeaeb50a04340ae4d5a..e8323dc9bbdf7452fe112374d0a44d91e274dbec 100644
--- a/src/qemu/qemu_migration_params.h
+++ b/src/qemu/qemu_migration_params.h
@@ -74,7 +74,6 @@ qemuMigrationParamsSet(virQEMUDriverPtr driver,
 int
 qemuMigrationParamsEnableTLS(virQEMUDriverPtr driver,
                              virDomainObjPtr vm,
-                             virQEMUDriverConfigPtr cfg,
                              bool tlsListen,
                              int asyncJob,
                              char **tlsAlias,