diff --git a/src/qemu/qemu_migration.c b/src/qemu/qemu_migration.c
index ad87aebd3ba22ce8ce43ae38fd7149b2ab9a04e9..bee5fe983ea30013615f0728ee8a3d8d074b40b8 100644
--- a/src/qemu/qemu_migration.c
+++ b/src/qemu/qemu_migration.c
@@ -1771,7 +1771,7 @@ qemuMigrationSrcCleanup(virDomainObjPtr vm,
                  " domain was successfully started on destination or not",
                  vm->def->name);
         qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_MIGRATION_OUT,
-                                 priv->job.migParams);
+                                 priv->job.migParams, priv->job.apiFlags);
         /* clear the job and let higher levels decide what to do */
         qemuDomainObjDiscardAsyncJob(driver, vm);
         break;
@@ -2500,7 +2500,7 @@ qemuMigrationDstPrepareAny(virQEMUDriverPtr driver,
 
  stopjob:
     qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_MIGRATION_IN,
-                             priv->job.migParams);
+                             priv->job.migParams, priv->job.apiFlags);
 
     if (stopProcess) {
         unsigned int stopFlags = VIR_QEMU_PROCESS_STOP_MIGRATED;
@@ -2870,7 +2870,7 @@ qemuMigrationSrcConfirmPhase(virQEMUDriverPtr driver,
         }
 
         qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_MIGRATION_OUT,
-                                 priv->job.migParams);
+                                 priv->job.migParams, priv->job.apiFlags);
 
         if (virDomainSaveStatus(driver->xmlopt, cfg->stateDir, vm, driver->caps) < 0)
             VIR_WARN("Failed to save status on vm %s", vm->def->name);
@@ -4497,7 +4497,7 @@ qemuMigrationSrcPerformJob(virQEMUDriverPtr driver,
      */
     if (!v3proto && ret < 0)
         qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_MIGRATION_OUT,
-                                 priv->job.migParams);
+                                 priv->job.migParams, priv->job.apiFlags);
 
     if (qemuMigrationSrcRestoreDomainState(driver, vm)) {
         event = virDomainEventLifecycleNewFromObj(vm,
@@ -4586,7 +4586,7 @@ qemuMigrationSrcPerformPhase(virQEMUDriverPtr driver,
  endjob:
     if (ret < 0) {
         qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_MIGRATION_OUT,
-                                 priv->job.migParams);
+                                 priv->job.migParams, priv->job.apiFlags);
         qemuMigrationJobFinish(driver, vm);
     } else {
         qemuMigrationJobContinue(vm);
@@ -5044,7 +5044,7 @@ qemuMigrationDstFinish(virQEMUDriverPtr driver,
     }
 
     qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_MIGRATION_IN,
-                             priv->job.migParams);
+                             priv->job.migParams, priv->job.apiFlags);
 
     qemuMigrationJobFinish(driver, vm);
     if (!virDomainObjIsActive(vm))
diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_params.c
index 8af6d8ad0e2b2d15a63149f20feb10ab4c7bd0bd..4f3b239637e093d4bdb301b0e451f4b1cd8c8488 100644
--- a/src/qemu/qemu_migration_params.c
+++ b/src/qemu/qemu_migration_params.c
@@ -899,6 +899,7 @@ qemuMigrationParamsDisableTLS(virDomainObjPtr vm,
  * @driver: pointer to qemu driver
  * @vm: domain object
  * @asyncJob: migration job to join
+ * @apiFlags: API flags used to start the migration
  *
  * Deconstruct all the setup possibly done for TLS - delete the TLS and
  * security objects, free the secinfo, and reset the migration params to "".
@@ -907,13 +908,16 @@ static void
 qemuMigrationParamsResetTLS(virQEMUDriverPtr driver,
                             virDomainObjPtr vm,
                             int asyncJob,
-                            qemuMigrationParamsPtr origParams)
+                            qemuMigrationParamsPtr origParams,
+                            unsigned long apiFlags)
 {
     char *tlsAlias = NULL;
     char *secAlias = NULL;
 
-    /* If QEMU does not support TLS migration we didn't set the aliases. */
-    if (!origParams->params[QEMU_MIGRATION_PARAM_TLS_CREDS].set)
+    /* There's nothing to do if QEMU does not support TLS migration or we were
+     * not asked to enable it. */
+    if (!origParams->params[QEMU_MIGRATION_PARAM_TLS_CREDS].set ||
+        !(apiFlags & VIR_MIGRATE_TLS))
         return;
 
     /* NB: If either or both fail to allocate memory we can still proceed
@@ -1081,11 +1085,13 @@ void
 qemuMigrationParamsReset(virQEMUDriverPtr driver,
                          virDomainObjPtr vm,
                          int asyncJob,
-                         qemuMigrationParamsPtr origParams)
+                         qemuMigrationParamsPtr origParams,
+                         unsigned long apiFlags)
 {
     virErrorPtr err = virSaveLastError();
 
-    VIR_DEBUG("Resetting migration parameters %p", origParams);
+    VIR_DEBUG("Resetting migration parameters %p, flags 0x%lx",
+              origParams, apiFlags);
 
     if (!virDomainObjIsActive(vm) || !origParams)
         goto cleanup;
@@ -1093,7 +1099,7 @@ qemuMigrationParamsReset(virQEMUDriverPtr driver,
     if (qemuMigrationParamsApply(driver, vm, asyncJob, origParams) < 0)
         goto cleanup;
 
-    qemuMigrationParamsResetTLS(driver, vm, asyncJob, origParams);
+    qemuMigrationParamsResetTLS(driver, vm, asyncJob, origParams, apiFlags);
 
  cleanup:
     if (err) {
diff --git a/src/qemu/qemu_migration_params.h b/src/qemu/qemu_migration_params.h
index 99dde0ad3cddfe0ff6208eedaa340170ee4eb1be..c3484ed1c0061ced3a30d749c89daa629f8a5892 100644
--- a/src/qemu/qemu_migration_params.h
+++ b/src/qemu/qemu_migration_params.h
@@ -133,7 +133,8 @@ void
 qemuMigrationParamsReset(virQEMUDriverPtr driver,
                          virDomainObjPtr vm,
                          int asyncJob,
-                         qemuMigrationParamsPtr origParams);
+                         qemuMigrationParamsPtr origParams,
+                         unsigned long apiFlags);
 
 void
 qemuMigrationParamsFormat(virBufferPtr buf,
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index d67f93d30eb3d207a01bcf4b7bd82abc7393ce36..6a5262ae46ab53195b61313c3fec8ff77639a7c8 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -3079,7 +3079,8 @@ qemuProcessRecoverMigrationIn(virQEMUDriverPtr driver,
         break;
     }
 
-    qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_NONE, job->migParams);
+    qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_NONE,
+                             job->migParams, job->apiFlags);
     return 0;
 }
 
@@ -3173,7 +3174,8 @@ qemuProcessRecoverMigrationOut(virQEMUDriverPtr driver,
         }
     }
 
-    qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_NONE, job->migParams);
+    qemuMigrationParamsReset(driver, vm, QEMU_ASYNC_JOB_NONE,
+                             job->migParams, job->apiFlags);
     return 0;
 }