diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 26aeca05bff3eb883cc0200f3fb338a876b80630..2d375b4ca4d1e5b33def2ab41b2853c439c95171 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -791,9 +791,6 @@ qemuBuildDiskSrcTLSx509CommandLine(virCommandPtr cmd,
     /* other protocols may be added later */
     if (src->protocol == VIR_STORAGE_NET_PROTOCOL_VXHS &&
         src->haveTLS == VIR_TRISTATE_BOOL_YES) {
-        if (!(src->tlsAlias = qemuAliasTLSObjFromSrcAlias(srcalias)))
-            return -1;
-
         return qemuBuildTLSx509CommandLine(cmd, src->tlsCertdir,
                                            false, src->tlsVerify,
                                            false, srcalias, qemuCaps);
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index 7bbaf8a53a9a66dbe69f1415ac828d6c9dc75a08..a7188e9127ccd36dad0ac8a4ba13f8b589d9d6f6 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -9957,6 +9957,7 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
 /* qemuProcessPrepareStorageSourceTLS:
  * @source: source for a disk
  * @cfg: driver configuration
+ * @parentAlias: alias of the parent device
  *
  * Updates host interface TLS encryption setting based on qemu.conf
  * for disk devices.  This will be presented as "tls='yes|no'" in
@@ -9966,7 +9967,8 @@ qemuProcessPrepareStorageSourceTLSVxhs(virStorageSourcePtr src,
  */
 static int
 qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
-                                  virQEMUDriverConfigPtr cfg)
+                                  virQEMUDriverConfigPtr cfg,
+                                  const char *parentAlias)
 {
     if (virStorageSourceGetActualType(src) != VIR_STORAGE_TYPE_NETWORK)
         return 0;
@@ -10003,6 +10005,10 @@ qemuDomainPrepareStorageSourceTLS(virStorageSourcePtr src,
         return -1;
     }
 
+    if (src->haveTLS == VIR_TRISTATE_BOOL_YES &&
+        !(src->tlsAlias = qemuAliasTLSObjFromSrcAlias(parentAlias)))
+        return -1;
+
     return 0;
 }
 
@@ -12516,6 +12522,9 @@ qemuDomainPrepareDiskSourceLegacy(virDomainDiskDefPtr disk,
     if (qemuDomainPrepareStorageSourcePR(disk->src, priv, disk->info.alias) < 0)
         return -1;
 
+    if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg, disk->info.alias) < 0)
+        return -1;
+
     return 0;
 }
 
@@ -12530,9 +12539,6 @@ qemuDomainPrepareDiskSource(virDomainDiskDefPtr disk,
     if (qemuDomainPrepareDiskSourceLegacy(disk, priv, cfg) < 0)
         return -1;
 
-    if (qemuDomainPrepareStorageSourceTLS(disk->src, cfg) < 0)
-        return -1;
-
     return 0;
 }
 
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index 1d9381ea5cecd188875a453cc96fec4c3ecbfe02..148523c29055a2013d266067e1f3135c7cf2c5c6 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -156,8 +156,7 @@ qemuHotplugPrepareDiskAccess(virQEMUDriverPtr driver,
 static int
 qemuDomainAddDiskSrcTLSObject(virQEMUDriverPtr driver,
                               virDomainObjPtr vm,
-                              virStorageSourcePtr src,
-                              const char *srcalias)
+                              virStorageSourcePtr src)
 {
     int ret = -1;
     qemuDomainObjPrivatePtr priv = vm->privateData;
@@ -167,7 +166,7 @@ qemuDomainAddDiskSrcTLSObject(virQEMUDriverPtr driver,
                                 src->tlsCertdir,
                                 false,
                                 src->tlsVerify,
-                                srcalias, &tlsProps, &src->tlsAlias,
+                                NULL, &tlsProps, NULL,
                                 NULL, NULL) < 0)
         goto cleanup;
 
@@ -471,8 +470,7 @@ qemuDomainAttachDiskGeneric(virQEMUDriverPtr driver,
         prdStarted = true;
 
     if (disk->src->haveTLS &&
-        qemuDomainAddDiskSrcTLSObject(driver, vm, disk->src,
-                                      disk->info.alias) < 0)
+        qemuDomainAddDiskSrcTLSObject(driver, vm, disk->src) < 0)
         goto error;
 
     if (!(drivestr = qemuBuildDriveStr(disk, false, priv->qemuCaps)))