diff --git a/src/security/security_manager.c b/src/security/security_manager.c
index 66cffb5be517f1032515465d812b78708f5ef95f..6406161cfa7304272d47eff2343190bcb6e47ed8 100644
--- a/src/security/security_manager.c
+++ b/src/security/security_manager.c
@@ -309,6 +309,14 @@ int virSecurityManagerSetProcessLabel(virSecurityManagerPtr mgr,
 int virSecurityManagerVerify(virSecurityManagerPtr mgr,
                              virDomainDefPtr def)
 {
+    const virSecurityLabelDefPtr secdef = &def->seclabel;
+    /* NULL model == dynamic labelling, with whatever driver
+     * is active, so we can short circuit verify check to
+     * avoid drivers de-referencing NULLs by accident
+     */
+    if (!secdef->model)
+        return 0;
+
     if (mgr->drv->domainSecurityVerify)
         return mgr->drv->domainSecurityVerify(mgr, def);