diff --git a/src/qemu/qemu_block.c b/src/qemu/qemu_block.c
index ada0dcf955e710e1312b2d38b805e18775fd1d63..0ebf2d2aff40a6d79242ba3c552155434113c62c 100644
--- a/src/qemu/qemu_block.c
+++ b/src/qemu/qemu_block.c
@@ -1488,6 +1488,8 @@ qemuBlockStorageSourceAttachDataFree(qemuBlockStorageSourceAttachDataPtr data)
     virJSONValueFree(data->prmgrProps);
     virJSONValueFree(data->authsecretProps);
     virJSONValueFree(data->encryptsecretProps);
+    virJSONValueFree(data->tlsProps);
+    VIR_FREE(data->tlsAlias);
     VIR_FREE(data->authsecretAlias);
     VIR_FREE(data->encryptsecretAlias);
     VIR_FREE(data->driveCmd);
@@ -1567,6 +1569,10 @@ qemuBlockStorageSourceAttachApply(qemuMonitorPtr mon,
                              &data->encryptsecretAlias) < 0)
         return -1;
 
+    if (data->tlsProps &&
+        qemuMonitorAddObject(mon, &data->tlsProps, &data->tlsAlias) < 0)
+        return -1;
+
     if (data->storageProps) {
         rv = qemuMonitorBlockdevAdd(mon, data->storageProps);
         data->storageProps = NULL;
@@ -1637,6 +1643,9 @@ qemuBlockStorageSourceAttachRollback(qemuMonitorPtr mon,
     if (data->encryptsecretAlias)
         ignore_value(qemuMonitorDelObject(mon, data->encryptsecretAlias));
 
+    if (data->tlsAlias)
+        ignore_value(qemuMonitorDelObject(mon, data->tlsAlias));
+
 
     virErrorRestore(&orig_err);
 }
diff --git a/src/qemu/qemu_block.h b/src/qemu/qemu_block.h
index 4ffb42dfd62214b98268a2448029ed85e3ee512a..418b5064b5b012d46d9fe37a54c4075cd047f2e6 100644
--- a/src/qemu/qemu_block.h
+++ b/src/qemu/qemu_block.h
@@ -91,6 +91,9 @@ struct qemuBlockStorageSourceAttachData {
 
     virJSONValuePtr encryptsecretProps;
     char *encryptsecretAlias;
+
+    virJSONValuePtr tlsProps;
+    char *tlsAlias;
 };
 
 
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index e3a347dacc28024534f675294f334340207da4aa..c4eff3c7fb074bdd99ac6ab7279180ea3f4c2434 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -10491,13 +10491,15 @@ qemuBuildStorageSourceAttachPrepareDrive(virDomainDiskDefPtr disk,
  * qemuBuildStorageSourceAttachPrepareCommon:
  * @src: storage source
  * @data: already initialized data for disk source addition
+ * @qemuCaps: qemu capabilities object
  *
  * Prepare data for configuration associated with the disk source such as
  * secrets/TLS/pr objects etc ...
  */
 int
 qemuBuildStorageSourceAttachPrepareCommon(virStorageSourcePtr src,
-                                          qemuBlockStorageSourceAttachDataPtr data)
+                                          qemuBlockStorageSourceAttachDataPtr data,
+                                          virQEMUCapsPtr qemuCaps)
 {
     qemuDomainStorageSourcePrivatePtr srcpriv = QEMU_DOMAIN_STORAGE_SOURCE_PRIVATE(src);
 
@@ -10517,5 +10519,10 @@ qemuBuildStorageSourceAttachPrepareCommon(virStorageSourcePtr src,
             return -1;
     }
 
+    if (src->haveTLS == VIR_TRISTATE_BOOL_YES &&
+        qemuBuildTLSx509BackendProps(src->tlsCertdir, false, true, src->tlsAlias,
+                                     NULL, qemuCaps, &data->tlsProps) < 0)
+        return -1;
+
     return 0;
 }
diff --git a/src/qemu/qemu_command.h b/src/qemu/qemu_command.h
index 51a1af0b30f1d260230181cd1d563af784160134..0d7d2bac2a96ae1dd51a65dda50722efb13f55e8 100644
--- a/src/qemu/qemu_command.h
+++ b/src/qemu/qemu_command.h
@@ -108,7 +108,8 @@ qemuBuildStorageSourceAttachPrepareDrive(virDomainDiskDefPtr disk,
                                          virQEMUCapsPtr qemuCaps);
 int
 qemuBuildStorageSourceAttachPrepareCommon(virStorageSourcePtr src,
-                                          qemuBlockStorageSourceAttachDataPtr data);
+                                          qemuBlockStorageSourceAttachDataPtr data,
+                                          virQEMUCapsPtr qemuCaps);
 
 /* Current, best practice */
 char *qemuBuildDriveDevStr(const virDomainDef *def,
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index a1f94328d8a0630b6dd16ceb63c80a2eb5f2de9f..bad60b701c3860b99ed1ecd1117231380b2e3d49 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -154,35 +154,6 @@ qemuHotplugPrepareDiskAccess(virQEMUDriverPtr driver,
 }
 
 
-static int
-qemuDomainAddDiskSrcTLSObject(virQEMUDriverPtr driver,
-                              virDomainObjPtr vm,
-                              virStorageSourcePtr src)
-{
-    int ret = -1;
-    qemuDomainObjPrivatePtr priv = vm->privateData;
-    virJSONValuePtr tlsProps = NULL;
-
-    if (qemuDomainGetTLSObjects(priv->qemuCaps, NULL,
-                                src->tlsCertdir,
-                                false, true,
-                                src->tlsAlias,
-                                &tlsProps, NULL) < 0)
-        goto cleanup;
-
-    if (qemuDomainAddTLSObjects(driver, vm, QEMU_ASYNC_JOB_NONE,
-                                NULL, &tlsProps) < 0)
-        goto cleanup;
-
-    ret = 0;
-
- cleanup:
-    virJSONValueFree(tlsProps);
-
-    return ret;
-}
-
-
 static int
 qemuHotplugWaitForTrayEject(virQEMUDriverPtr driver,
                             virDomainObjPtr vm,
@@ -413,11 +384,7 @@ qemuDomainAttachDiskGeneric(virQEMUDriverPtr driver,
     if (!(data = qemuBuildStorageSourceAttachPrepareDrive(disk, priv->qemuCaps)))
         goto error;
 
-    if (qemuBuildStorageSourceAttachPrepareCommon(disk->src, data) < 0)
-        goto error;
-
-    if (disk->src->haveTLS == VIR_TRISTATE_BOOL_YES &&
-        qemuDomainAddDiskSrcTLSObject(driver, vm, disk->src) < 0)
+    if (qemuBuildStorageSourceAttachPrepareCommon(disk->src, data, priv->qemuCaps) < 0)
         goto error;
 
     if (!(devstr = qemuBuildDriveDevStr(vm->def, disk, 0, priv->qemuCaps)))
@@ -463,8 +430,6 @@ qemuDomainAttachDiskGeneric(virQEMUDriverPtr driver,
     virErrorPreserveLast(&orig_err);
     if (managedPrmgrAlias)
         ignore_value(qemuMonitorDelObject(priv->mon, managedPrmgrAlias));
-    if (disk->src->tlsAlias)
-        ignore_value(qemuMonitorDelObject(priv->mon, disk->src->tlsAlias));
     if (qemuDomainObjExitMonitor(driver, vm) < 0)
         ret = -2;
     virErrorRestore(&orig_err);