diff --git a/tools/virsh.c b/tools/virsh.c
index 113124ff52571693b1e0ca35984a86e65d91bc20..57aded30b75a1a1faa197a8eac86b1b31293dcbc 100644
--- a/tools/virsh.c
+++ b/tools/virsh.c
@@ -4830,6 +4830,8 @@ static const vshCmdOptDef opts_migrate[] = {
     {"suspend", VSH_OT_BOOL, 0, N_("do not restart the domain on the destination host")},
     {"copy-storage-all", VSH_OT_BOOL, 0, N_("migration with non-shared storage with full disk copy")},
     {"copy-storage-inc", VSH_OT_BOOL, 0, N_("migration with non-shared storage with incremental copy (same base image shared between source and destination)")},
+    {"change-protection", VSH_OT_BOOL, 0,
+     N_("prevent any configuration changes to domain until migration ends)")},
     {"verbose", VSH_OT_BOOL, 0, N_("display the progress of migration")},
     {"domain", VSH_OT_DATA, VSH_OFLAG_REQ, N_("domain name, id or uuid")},
     {"desturi", VSH_OT_DATA, VSH_OFLAG_REQ, N_("connection URI of the destination host as seen from the client(normal migration) or source(p2p migration)")},
@@ -4906,6 +4908,8 @@ doMigrate (void *opaque)
     if (vshCommandOptBool (cmd, "copy-storage-inc"))
         flags |= VIR_MIGRATE_NON_SHARED_INC;
 
+    if (vshCommandOptBool (cmd, "change-protection"))
+        flags |= VIR_MIGRATE_CHANGE_PROTECTION;
 
     if (xmlfile &&
         virFileReadAll(xmlfile, 8192, &xml) < 0)
diff --git a/tools/virsh.pod b/tools/virsh.pod
index e9aaa800ceaf6df0a57ab42fbea23e6a239df5ed..f6f9908c26343020f8bdb99a925228fe520cacbc 100644
--- a/tools/virsh.pod
+++ b/tools/virsh.pod
@@ -564,8 +564,9 @@ type attribute for the <domain> element of XML.
 
 =item B<migrate> [I<--live>] [I<--direct>] [I<--p2p> [I<--tunnelled>]]
 [I<--persistent>] [I<--undefinesource>] [I<--suspend>] [I<--copy-storage-all>]
-[I<--copy-storage-inc>] [I<--verbose>] I<domain-id> I<desturi> [I<migrateuri>]
-[I<dname>] [I<--timeout> B<seconds>] [I<--xml> B<file>]
+[I<--copy-storage-inc>] [I<--change-protection>] [I<--verbose>]
+I<domain-id> I<desturi> [I<migrateuri>] [I<dname>]
+[I<--timeout> B<seconds>] [I<--xml> B<file>]
 
 Migrate domain to another host.  Add I<--live> for live migration; I<--p2p>
 for peer-2-peer migration; I<--direct> for direct migration; or I<--tunnelled>
@@ -575,7 +576,11 @@ and I<--suspend> leaves the domain paused on the destination host.
 I<--copy-storage-all> indicates migration with non-shared storage with full
 disk copy, I<--copy-storage-inc> indicates migration with non-shared storage
 with incremental copy (same base image shared between source and destination).
-I<--verbose> displays the progress of migration.
+I<--change-protection> enforces that no incompatible configuration changes
+will be made to the domain while the migration is underway; this flag is
+implicitly enabled when supported by the hypervisor, but can be explicitly
+used to reject the migration if the hypervisor lacks change protection
+support.  I<--verbose> displays the progress of migration.
 
 The I<desturi> is the connection URI of the destination host, and
 I<migrateuri> is the migration URI, which usually can be omitted.