diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c
index 931ea05566f17dd8a33241a37d62ae98cdb16ac8..ada0dcf955e710e1312b2d38b805e18775fd1d63 100644
--- a/src/qemu/qemu_block.c
+++ b/src/qemu/qemu_block.c
@@ -1486,6 +1486,10 @@ qemuBlockStorageSourceAttachDataFree(qemuBlockStorageSourceAttachDataPtr data)
     virJSONValueFree(data->storageProps);
     virJSONValueFree(data->formatProps);
     virJSONValueFree(data->prmgrProps);
+    virJSONValueFree(data->authsecretProps);
+    virJSONValueFree(data->encryptsecretProps);
+    VIR_FREE(data->authsecretAlias);
+    VIR_FREE(data->encryptsecretAlias);
     VIR_FREE(data->driveCmd);
     VIR_FREE(data->driveAlias);
     VIR_FREE(data);
@@ -1553,6 +1557,16 @@ qemuBlockStorageSourceAttachApply(qemuMonitorPtr mon,
         qemuMonitorAddObject(mon, &data->prmgrProps, &data->prmgrAlias) < 0)
         return -1;
 
+    if (data->authsecretProps &&
+        qemuMonitorAddObject(mon, &data->authsecretProps,
+                             &data->authsecretAlias) < 0)
+        return -1;
+
+    if (data->encryptsecretProps &&
+        qemuMonitorAddObject(mon, &data->encryptsecretProps,
+                             &data->encryptsecretAlias) < 0)
+        return -1;
+
     if (data->storageProps) {
         rv = qemuMonitorBlockdevAdd(mon, data->storageProps);
         data->storageProps = NULL;
@@ -1617,6 +1631,13 @@ qemuBlockStorageSourceAttachRollback(qemuMonitorPtr mon,
     if (data->prmgrAlias)
         ignore_value(qemuMonitorDelObject(mon, data->prmgrAlias));
 
+    if (data->authsecretAlias)
+        ignore_value(qemuMonitorDelObject(mon, data->authsecretAlias));
+
+    if (data->encryptsecretAlias)
+        ignore_value(qemuMonitorDelObject(mon, data->encryptsecretAlias));
+
+
     virErrorRestore(&orig_err);
 }
 
diff --git a/src/qemu/qemu_block.h b/src/qemu/qemu_block.h
index e5064574a927c011d49f601d3cd793a4c026ed3f..4ffb42dfd62214b98268a2448029ed85e3ee512a 100644
--- a/src/qemu/qemu_block.h
+++ b/src/qemu/qemu_block.h
@@ -85,6 +85,12 @@ struct qemuBlockStorageSourceAttachData {
     char *driveCmd;
     char *driveAlias;
     bool driveAdded;
+
+    virJSONValuePtr authsecretProps;
+    char *authsecretAlias;
+
+    virJSONValuePtr encryptsecretProps;
+    char *encryptsecretAlias;
 };
 
 
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 99e63ab3a96dd7e1b20cf9c240df41ce2f4bed00..e3a347dacc28024534f675294f334340207da4aa 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -10499,10 +10499,23 @@ int
 qemuBuildStorageSourceAttachPrepareCommon(virStorageSourcePtr src,
                                           qemuBlockStorageSourceAttachDataPtr data)
 {
+    qemuDomainStorageSourcePrivatePtr srcpriv = QEMU_DOMAIN_STORAGE_SOURCE_PRIVATE(src);
+
     if (src->pr &&
         !virStoragePRDefIsManaged(src->pr) &&
         !(data->prmgrProps = qemuBuildPRManagerInfoProps(src)))
         return -1;
 
+    if (srcpriv) {
+        if (srcpriv->secinfo &&
+            srcpriv->secinfo->type == VIR_DOMAIN_SECRET_INFO_TYPE_AES &&
+            qemuBuildSecretInfoProps(srcpriv->secinfo, &data->authsecretProps) < 0)
+            return -1;
+
+        if (srcpriv->encinfo &&
+            qemuBuildSecretInfoProps(srcpriv->encinfo, &data->encryptsecretProps) < 0)
+            return -1;
+    }
+
     return 0;
 }
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index a337fe53666a653d7e8f18b1a86c34815c1377f4..a1f94328d8a0630b6dd16ceb63c80a2eb5f2de9f 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -395,15 +395,8 @@ qemuDomainAttachDiskGeneric(virQEMUDriverPtr driver,
     virErrorPtr orig_err;
     char *devstr = NULL;
     char *managedPrmgrAlias = NULL;
-    char *encobjAlias = NULL;
-    char *secobjAlias = NULL;
     virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver);
-    virJSONValuePtr secobjProps = NULL;
-    virJSONValuePtr encobjProps = NULL;
     virJSONValuePtr managedPrmgrProps = NULL;
-    qemuDomainStorageSourcePrivatePtr srcPriv;
-    qemuDomainSecretInfoPtr secinfo = NULL;
-    qemuDomainSecretInfoPtr encinfo = NULL;
 
     if (qemuHotplugPrepareDiskAccess(driver, vm, disk, NULL, false) < 0)
         goto cleanup;
@@ -414,20 +407,6 @@ qemuDomainAttachDiskGeneric(virQEMUDriverPtr driver,
     if (qemuDomainPrepareDiskSource(disk, priv, cfg) < 0)
         goto error;
 
-    srcPriv = QEMU_DOMAIN_STORAGE_SOURCE_PRIVATE(disk->src);
-    if (srcPriv) {
-        secinfo = srcPriv->secinfo;
-        encinfo = srcPriv->encinfo;
-    }
-
-    if (secinfo && secinfo->type == VIR_DOMAIN_SECRET_INFO_TYPE_AES) {
-        if (qemuBuildSecretInfoProps(secinfo, &secobjProps) < 0)
-            goto error;
-    }
-
-    if (encinfo && qemuBuildSecretInfoProps(encinfo, &encobjProps) < 0)
-        goto error;
-
     if (qemuDomainDiskAttachManagedPR(vm, disk, &managedPrmgrProps) < 0)
         goto error;
 
@@ -449,14 +428,6 @@ qemuDomainAttachDiskGeneric(virQEMUDriverPtr driver,
 
     qemuDomainObjEnterMonitor(driver, vm);
 
-    if (secobjProps &&
-        qemuMonitorAddObject(priv->mon, &secobjProps, &secobjAlias) < 0)
-        goto exit_monitor;
-
-    if (encobjProps &&
-        qemuMonitorAddObject(priv->mon, &encobjProps, &encobjAlias) < 0)
-        goto exit_monitor;
-
     if (managedPrmgrProps &&
         qemuMonitorAddObject(priv->mon, &managedPrmgrProps, &managedPrmgrAlias) < 0)
         goto exit_monitor;
@@ -480,12 +451,8 @@ qemuDomainAttachDiskGeneric(virQEMUDriverPtr driver,
  cleanup:
     qemuBlockStorageSourceAttachDataFree(data);
     virJSONValueFree(managedPrmgrProps);
-    virJSONValueFree(encobjProps);
-    virJSONValueFree(secobjProps);
     qemuDomainSecretDiskDestroy(disk);
     VIR_FREE(managedPrmgrAlias);
-    VIR_FREE(secobjAlias);
-    VIR_FREE(encobjAlias);
     VIR_FREE(devstr);
     virObjectUnref(cfg);
     return ret;
@@ -494,10 +461,6 @@ qemuDomainAttachDiskGeneric(virQEMUDriverPtr driver,
     qemuBlockStorageSourceAttachRollback(priv->mon, data);
 
     virErrorPreserveLast(&orig_err);
-    if (secobjAlias)
-        ignore_value(qemuMonitorDelObject(priv->mon, secobjAlias));
-    if (encobjAlias)
-        ignore_value(qemuMonitorDelObject(priv->mon, encobjAlias));
     if (managedPrmgrAlias)
         ignore_value(qemuMonitorDelObject(priv->mon, managedPrmgrAlias));
     if (disk->src->tlsAlias)