diff --git a/src/conf/domain_addr.c b/src/conf/domain_addr.c
index 080d8821196c49297a51a4c985d7e7444beda005..1e96fe9730c2cf058e8c2fbacac59839aaa84083 100644
--- a/src/conf/domain_addr.c
+++ b/src/conf/domain_addr.c
@@ -96,7 +96,9 @@ virDomainPCIAddressFlagsCompatible(virPCIDeviceAddressPtr addr,
     if (fromConfig) {
         /* If the requested connection was manually specified in
          * config, allow a PCI device to connect to a PCIe slot, or
-         * vice versa.
+         * vice versa. In order to do so, we add *both* the PCI_DEVICE
+         * and the PCIE_DEVICE flags to the bus if it already has either
+         * of them, using the ENDPOINT mask.
          */
         if (busFlags & VIR_PCI_CONNECT_TYPES_ENDPOINT)
             busFlags |= VIR_PCI_CONNECT_TYPES_ENDPOINT;
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-q35-pci-force-address.args b/tests/qemuxml2argvdata/qemuxml2argv-q35-pci-force-address.args
new file mode 100644
index 0000000000000000000000000000000000000000..9ca342ba711baa435f7a4f8012df78e068a30729
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-q35-pci-force-address.args
@@ -0,0 +1,25 @@
+LC_ALL=C \
+PATH=/bin \
+HOME=/home/test \
+USER=test \
+LOGNAME=test \
+QEMU_AUDIO_DRV=none \
+/usr/libexec/qemu-kvm \
+-name q35-test \
+-S \
+-M q35 \
+-m 2048 \
+-smp 2,sockets=2,cores=1,threads=1 \
+-uuid 11dbdcdd-4c3b-482b-8903-9bdb8c0a2774 \
+-nographic \
+-nodefaults \
+-monitor unix:/tmp/lib/domain--1-q35-test/monitor.sock,server,nowait \
+-no-acpi \
+-boot c \
+-device i82801b11-bridge,id=pci.1,bus=pcie.0,addr=0x1e \
+-device pci-bridge,chassis_nr=2,id=pci.2,bus=pci.1,addr=0x0 \
+-device ioh3420,port=0x10,chassis=3,id=pci.3,bus=pcie.0,addr=0x2 \
+-device e1000e,vlan=0,id=net0,mac=52:54:00:aa:bf:ef,bus=pci.2,addr=0x1 \
+-net user,vlan=0,name=hostnet0 \
+-device intel-hda,id=sound0,bus=pci.3,addr=0x0 \
+-device hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0
diff --git a/tests/qemuxml2argvdata/qemuxml2argv-q35-pci-force-address.xml b/tests/qemuxml2argvdata/qemuxml2argv-q35-pci-force-address.xml
new file mode 100644
index 0000000000000000000000000000000000000000..34ec7c7750315d6e21be1481531ed549727bcc9e
--- /dev/null
+++ b/tests/qemuxml2argvdata/qemuxml2argv-q35-pci-force-address.xml
@@ -0,0 +1,32 @@
+<domain type='qemu'>
+  <name>q35-test</name>
+  <uuid>11dbdcdd-4c3b-482b-8903-9bdb8c0a2774</uuid>
+  <memory unit='KiB'>2097152</memory>
+  <currentMemory unit='KiB'>2097152</currentMemory>
+  <vcpu placement='static' cpuset='0-1'>2</vcpu>
+  <os>
+    <type arch='x86_64' machine='q35'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/libexec/qemu-kvm</emulator>
+    <controller type='pci' index='0' model='pcie-root'/>
+    <controller type='pci' index='1' model='dmi-to-pci-bridge'/>
+    <controller type='pci' index='2' model='pci-bridge'/>
+    <controller type='pci' index='3' model='pcie-root-port'/>
+    <sound model='ich6'>
+      <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
+    </sound>
+    <interface type='user'>
+      <model type='e1000e'/>
+      <mac address='52:54:00:aa:bf:ef'/>
+      <address type='pci' domain='0x0000' bus='0x02' slot='0x01' function='0x0'/>
+    </interface>
+    <controller type='usb' model='none'/>
+    <memballoon model='none'/>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index e8438b41e38a09c7b4add6cf742d8352bd3d5c62..b1cc4d8cd5a747388a2189f22b4c4d846911915d 100644
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -1756,6 +1756,13 @@ mymain(void)
             QEMU_CAPS_ICH9_AHCI,
             QEMU_CAPS_PCI_MULTIFUNCTION, QEMU_CAPS_ICH9_USB_EHCI1,
             QEMU_CAPS_NEC_USB_XHCI);
+    /* Make sure the user can always override libvirt's default device
+     * placement policy by providing an explicit PCI address */
+    DO_TEST("q35-pci-force-address",
+            QEMU_CAPS_DEVICE_PCI_BRIDGE,
+            QEMU_CAPS_DEVICE_DMI_TO_PCI_BRIDGE,
+            QEMU_CAPS_DEVICE_IOH3420,
+            QEMU_CAPS_HDA_DUPLEX);
 
     DO_TEST_PARSE_ERROR("q35-wrong-root",
             QEMU_CAPS_DEVICE_PCI_BRIDGE,
diff --git a/tests/qemuxml2xmloutdata/qemuxml2xmlout-q35-pci-force-address.xml b/tests/qemuxml2xmloutdata/qemuxml2xmlout-q35-pci-force-address.xml
new file mode 100644
index 0000000000000000000000000000000000000000..c0332d46560616cb520bfec90022322d5b9642e4
--- /dev/null
+++ b/tests/qemuxml2xmloutdata/qemuxml2xmlout-q35-pci-force-address.xml
@@ -0,0 +1,48 @@
+<domain type='qemu'>
+  <name>q35-test</name>
+  <uuid>11dbdcdd-4c3b-482b-8903-9bdb8c0a2774</uuid>
+  <memory unit='KiB'>2097152</memory>
+  <currentMemory unit='KiB'>2097152</currentMemory>
+  <vcpu placement='static' cpuset='0-1'>2</vcpu>
+  <os>
+    <type arch='x86_64' machine='q35'>hvm</type>
+    <boot dev='hd'/>
+  </os>
+  <clock offset='utc'/>
+  <on_poweroff>destroy</on_poweroff>
+  <on_reboot>restart</on_reboot>
+  <on_crash>destroy</on_crash>
+  <devices>
+    <emulator>/usr/libexec/qemu-kvm</emulator>
+    <controller type='pci' index='0' model='pcie-root'/>
+    <controller type='pci' index='1' model='dmi-to-pci-bridge'>
+      <model name='i82801b11-bridge'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x1e' function='0x0'/>
+    </controller>
+    <controller type='pci' index='2' model='pci-bridge'>
+      <model name='pci-bridge'/>
+      <target chassisNr='2'/>
+      <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
+    </controller>
+    <controller type='pci' index='3' model='pcie-root-port'>
+      <model name='ioh3420'/>
+      <target chassis='3' port='0x10'/>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>
+    </controller>
+    <controller type='usb' index='0' model='none'/>
+    <controller type='sata' index='0'>
+      <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
+    </controller>
+    <interface type='user'>
+      <mac address='52:54:00:aa:bf:ef'/>
+      <model type='e1000e'/>
+      <address type='pci' domain='0x0000' bus='0x02' slot='0x01' function='0x0'/>
+    </interface>
+    <input type='mouse' bus='ps2'/>
+    <input type='keyboard' bus='ps2'/>
+    <sound model='ich6'>
+      <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/>
+    </sound>
+    <memballoon model='none'/>
+  </devices>
+</domain>
diff --git a/tests/qemuxml2xmltest.c b/tests/qemuxml2xmltest.c
index 62bff8cd7a16e94ae0852e34eef778193f3ac211..95c0bf23a85794ddf49023cebf145cf93032f1cd 100644
--- a/tests/qemuxml2xmltest.c
+++ b/tests/qemuxml2xmltest.c
@@ -727,6 +727,13 @@ mymain(void)
             QEMU_CAPS_DEVICE_XIO3130_DOWNSTREAM, QEMU_CAPS_ICH9_AHCI,
             QEMU_CAPS_PCI_MULTIFUNCTION, QEMU_CAPS_ICH9_USB_EHCI1,
             QEMU_CAPS_NEC_USB_XHCI);
+    /* Make sure the user can always override libvirt's default device
+     * placement policy by providing an explicit PCI address */
+    DO_TEST("q35-pci-force-address",
+            QEMU_CAPS_DEVICE_PCI_BRIDGE,
+            QEMU_CAPS_DEVICE_DMI_TO_PCI_BRIDGE,
+            QEMU_CAPS_DEVICE_IOH3420,
+            QEMU_CAPS_HDA_DUPLEX);
 
     DO_TEST("hostdev-scsi-lsi",
             QEMU_CAPS_VIRTIO_SCSI, QEMU_CAPS_SCSI_LSI,