diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index db5af101914a5a55d104f4c2f03d7a16f4c46d76..6d7827220e0c5a778b80cb11d6f0e0917558aaf4 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -1647,10 +1647,7 @@ qemuDomainSecretPrepare(virConnectPtr conn,
     size_t i;
     int ret = -1;
 
-    for (i = 0; i < vm->def->ndisks; i++) {
-        if (qemuDomainSecretDiskPrepare(conn, priv, vm->def->disks[i]) < 0)
-            goto cleanup;
-    }
+    /* disk secrets are prepared when preparing disks */
 
     for (i = 0; i < vm->def->nhostdevs; i++) {
         if (qemuDomainSecretHostdevPrepare(conn, priv,
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index 18dd3aa465b414b5cb50e0ac7e3d2baa0a550936..6d242b1b51aa2c963fc5ae91587c931926827aed 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -5343,6 +5343,7 @@ static int
 qemuProcessPrepareDomainStorage(virConnectPtr conn,
                                 virQEMUDriverPtr driver,
                                 virDomainObjPtr vm,
+                                qemuDomainObjPrivatePtr priv,
                                 virQEMUDriverConfigPtr cfg,
                                 unsigned int flags)
 {
@@ -5363,6 +5364,9 @@ qemuProcessPrepareDomainStorage(virConnectPtr conn,
 
         if (qemuDomainPrepareDiskSourceTLS(disk->src, cfg) < 0)
             return -1;
+
+        if (qemuDomainSecretDiskPrepare(conn, priv, disk) < 0)
+            return -1;
     }
 
     return 0;
@@ -5467,18 +5471,18 @@ qemuProcessPrepareDomain(virConnectPtr conn,
     if (qemuProcessSetupGraphics(driver, vm, flags) < 0)
         goto cleanup;
 
-    VIR_DEBUG("Setting up storage");
-    if (qemuProcessPrepareDomainStorage(conn, driver, vm, cfg, flags) < 0)
-        goto cleanup;
-
     VIR_DEBUG("Create domain masterKey");
     if (qemuDomainMasterKeyCreate(vm) < 0)
         goto cleanup;
 
+    VIR_DEBUG("Setting up storage");
+    if (qemuProcessPrepareDomainStorage(conn, driver, vm, priv, cfg, flags) < 0)
+        goto cleanup;
+
     VIR_DEBUG("Prepare chardev source backends for TLS");
     qemuDomainPrepareChardevSource(vm->def, cfg);
 
-    VIR_DEBUG("Add secrets to disks, hostdevs, and chardevs");
+    VIR_DEBUG("Add secrets to hostdevs and chardevs");
     if (qemuDomainSecretPrepare(conn, driver, vm) < 0)
         goto cleanup;