diff --git a/src/libvirt.c b/src/libvirt.c
index f01b6dd857a0f2d0f83ddbeb3774f80eef20f3e6..23612f51fabca463857ccd46894a0afdd8a2a047 100644
--- a/src/libvirt.c
+++ b/src/libvirt.c
@@ -4348,7 +4348,8 @@ virDomainGetXMLDesc(virDomainPtr domain, unsigned int flags)
     virCheckDomainReturn(domain, NULL);
     conn = domain->conn;
 
-    if ((conn->flags & VIR_CONNECT_RO) && (flags & VIR_DOMAIN_XML_SECURE)) {
+    if ((conn->flags & VIR_CONNECT_RO) &&
+        (flags & (VIR_DOMAIN_XML_SECURE | VIR_DOMAIN_XML_MIGRATABLE))) {
         virReportError(VIR_ERR_OPERATION_DENIED, "%s",
                        _("virDomainGetXMLDesc with secure flag"));
         goto error;
diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x
index 1f9d58307df67627a4e553d8636945fdd0f096d8..dc9da4cd764a447d82e6bc54bce64e3d0b07a813 100644
--- a/src/remote/remote_protocol.x
+++ b/src/remote/remote_protocol.x
@@ -3144,6 +3144,7 @@ enum remote_procedure {
      * @generate: both
      * @acl: domain:read
      * @acl: domain:read_secure:VIR_DOMAIN_XML_SECURE
+     * @acl: domain:read_secure:VIR_DOMAIN_XML_MIGRATABLE
      */
     REMOTE_PROC_DOMAIN_GET_XML_DESC = 14,