diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index 9c0a2566ae51fe06129dde7ea38cbbe86af5b92d..361a345fe5c31fefa6d751f17a9562128f0ff6ad 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -3225,6 +3225,9 @@ qemuBuildControllerDevCommandLine(virCommandPtr cmd,
          * one. Likewise, we don't do anything for the primary IDE
          * controller on an i440fx machine or primary SATA on q35, but
          * we do add those beyond these two exceptions.
+         *
+         * CCID controllers are formatted separately after USB hubs,
+         * because they go on the USB bus.
          */
         VIR_DOMAIN_CONTROLLER_TYPE_PCI,
         VIR_DOMAIN_CONTROLLER_TYPE_USB,
@@ -3232,7 +3235,6 @@ qemuBuildControllerDevCommandLine(virCommandPtr cmd,
         VIR_DOMAIN_CONTROLLER_TYPE_IDE,
         VIR_DOMAIN_CONTROLLER_TYPE_SATA,
         VIR_DOMAIN_CONTROLLER_TYPE_VIRTIO_SERIAL,
-        VIR_DOMAIN_CONTROLLER_TYPE_CCID,
     };
     int ret = -1;
 
@@ -10629,6 +10631,10 @@ qemuBuildCommandLine(virQEMUDriverPtr driver,
     if (qemuBuildHubCommandLine(cmd, def, qemuCaps) < 0)
         goto error;
 
+    if (qemuBuildControllersByTypeCommandLine(cmd, def, qemuCaps,
+                                              VIR_DOMAIN_CONTROLLER_TYPE_CCID) < 0)
+        goto error;
+
     if (qemuBuildDisksCommandLine(cmd, def, qemuCaps) < 0)
         goto error;
 
diff --git a/tests/qemuxml2argvdata/chardev-reconnect.args b/tests/qemuxml2argvdata/chardev-reconnect.args
index e88e0832915ae7ed33f40626c2b987f98ae81cf0..baff469c7b180cf681510c6e8ba4b676f2c1ec2f 100644
--- a/tests/qemuxml2argvdata/chardev-reconnect.args
+++ b/tests/qemuxml2argvdata/chardev-reconnect.args
@@ -22,8 +22,8 @@ server,nowait \
 -no-acpi \
 -device virtio-serial-pci,id=virtio-serial1,bus=pci.0,addr=0xa \
 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x3 \
--device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -usb \
+-device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -chardev socket,id=charsmartcard0,path=/tmp/channel/asdf,reconnect=20 \
 -device ccid-card-passthru,chardev=charsmartcard0,id=smartcard0,bus=ccid0.0 \
 -chardev socket,id=charchannel0,host=localhost,port=1234,reconnect=10 \
diff --git a/tests/qemuxml2argvdata/controller-order.args b/tests/qemuxml2argvdata/controller-order.args
index 2477cd2e1c63c0cbc1d404030632ae99e0a6f378..6bb4942223e4c2e079cfe38d5f97c3e36ba28bf7 100644
--- a/tests/qemuxml2argvdata/controller-order.args
+++ b/tests/qemuxml2argvdata/controller-order.args
@@ -21,8 +21,8 @@ nowait \
 -boot menu=off \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x7 \
--device usb-ccid,id=ccid0,bus=usb.0,port=1.1 \
 -device usb-hub,id=hub0,bus=usb.0,port=1 \
+-device usb-ccid,id=ccid0,bus=usb.0,port=1.1 \
 -drive file=/tmp/fdr.img,format=raw,if=none,id=drive-virtio-disk0,cache=none,\
 aio=native \
 -device virtio-blk-pci,bus=pci.0,addr=0x5,drive=drive-virtio-disk0,\
diff --git a/tests/qemuxml2argvdata/name-escape.args b/tests/qemuxml2argvdata/name-escape.args
index 58f284014c985bb194776187eb914418a16b50f3..d314ed409a1e9cccdd1436e489420480ddb37976 100644
--- a/tests/qemuxml2argvdata/name-escape.args
+++ b/tests/qemuxml2argvdata/name-escape.args
@@ -22,8 +22,8 @@ bar=2/monitor.sock,server,nowait \
 -no-shutdown \
 -no-acpi \
 -device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x3 \
--device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -usb \
+-device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -drive file=/dev/HostVG/QEMUGuest1,format=qcow2,if=none,id=drive-ide0-0-0,\
 cache=none,throttling.bps-total=5000,throttling.iops-total=6000,\
 throttling.bps-total-max=10000,throttling.iops-total-max=11000,\
diff --git a/tests/qemuxml2argvdata/smartcard-controller.args b/tests/qemuxml2argvdata/smartcard-controller.args
index 1a654cb4e186a754c73291234b601c6ccd09f619..4c5286dd8705c251805a5633f30abe1f124fe4eb 100644
--- a/tests/qemuxml2argvdata/smartcard-controller.args
+++ b/tests/qemuxml2argvdata/smartcard-controller.args
@@ -20,7 +20,7 @@ server,nowait \
 -rtc base=utc \
 -no-shutdown \
 -no-acpi \
--device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -usb \
+-device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -device ccid-card-emulated,backend=nss-emulated,id=smartcard0,bus=ccid0.0 \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3
diff --git a/tests/qemuxml2argvdata/smartcard-host-certificates-database.args b/tests/qemuxml2argvdata/smartcard-host-certificates-database.args
index 17fb50699aab2f60e133c5cd347dc3bfafb03b45..1056f52cfa00fa7643ce70a6f144d430ae2580f9 100644
--- a/tests/qemuxml2argvdata/smartcard-host-certificates-database.args
+++ b/tests/qemuxml2argvdata/smartcard-host-certificates-database.args
@@ -20,8 +20,8 @@ server,nowait \
 -rtc base=utc \
 -no-shutdown \
 -no-acpi \
--device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -usb \
+-device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -device ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,\
 cert3=cert3,db=/tmp/foo,id=smartcard0,bus=ccid0.0 \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3
diff --git a/tests/qemuxml2argvdata/smartcard-host-certificates.args b/tests/qemuxml2argvdata/smartcard-host-certificates.args
index 489299a475a3c44eff0fc6f0346ef3d4d9783969..6bfb56b94b0f9517a5d877fdf88e11bd3ee5bb87 100644
--- a/tests/qemuxml2argvdata/smartcard-host-certificates.args
+++ b/tests/qemuxml2argvdata/smartcard-host-certificates.args
@@ -20,8 +20,8 @@ server,nowait \
 -rtc base=utc \
 -no-shutdown \
 -no-acpi \
--device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -usb \
+-device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -device ccid-card-emulated,backend=certificates,cert1=cert1,cert2=cert2,\
 cert3=cert3,db=/etc/pki/nssdb,id=smartcard0,bus=ccid0.0 \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3
diff --git a/tests/qemuxml2argvdata/smartcard-host.args b/tests/qemuxml2argvdata/smartcard-host.args
index 1a654cb4e186a754c73291234b601c6ccd09f619..4c5286dd8705c251805a5633f30abe1f124fe4eb 100644
--- a/tests/qemuxml2argvdata/smartcard-host.args
+++ b/tests/qemuxml2argvdata/smartcard-host.args
@@ -20,7 +20,7 @@ server,nowait \
 -rtc base=utc \
 -no-shutdown \
 -no-acpi \
--device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -usb \
+-device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -device ccid-card-emulated,backend=nss-emulated,id=smartcard0,bus=ccid0.0 \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3
diff --git a/tests/qemuxml2argvdata/smartcard-passthrough-spicevmc.args b/tests/qemuxml2argvdata/smartcard-passthrough-spicevmc.args
index 8784a3ffaa7d439ee35e172af91e8929be553a1a..9fbc86bce79a046b0aa258b56171ca227e73f932 100644
--- a/tests/qemuxml2argvdata/smartcard-passthrough-spicevmc.args
+++ b/tests/qemuxml2argvdata/smartcard-passthrough-spicevmc.args
@@ -20,8 +20,8 @@ server,nowait \
 -rtc base=utc \
 -no-shutdown \
 -no-acpi \
--device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -usb \
+-device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -chardev spicevmc,id=charsmartcard0,name=smartcard \
 -device ccid-card-passthru,chardev=charsmartcard0,id=smartcard0,bus=ccid0.0 \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3
diff --git a/tests/qemuxml2argvdata/smartcard-passthrough-tcp.args b/tests/qemuxml2argvdata/smartcard-passthrough-tcp.args
index e55126c2068c68443e414908d2e6124803fa475d..12c03ad4b6da8e39cae4b82ff60de82c5a7af673 100644
--- a/tests/qemuxml2argvdata/smartcard-passthrough-tcp.args
+++ b/tests/qemuxml2argvdata/smartcard-passthrough-tcp.args
@@ -20,8 +20,8 @@ server,nowait \
 -rtc base=utc \
 -no-shutdown \
 -no-acpi \
--device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -usb \
+-device usb-ccid,id=ccid0,bus=usb.0,port=1 \
 -chardev socket,id=charsmartcard0,host=127.0.0.1,port=2001,server,nowait \
 -device ccid-card-passthru,chardev=charsmartcard0,id=smartcard0,bus=ccid0.0 \
 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3
diff --git a/tests/qemuxml2argvdata/user-aliases.args b/tests/qemuxml2argvdata/user-aliases.args
index 089a7d8d4b5f84c7c0e4ab747371701ee9de1abe..7fd3b4a6e191624d97708e709c15a4d5b74bf95b 100644
--- a/tests/qemuxml2argvdata/user-aliases.args
+++ b/tests/qemuxml2argvdata/user-aliases.args
@@ -35,9 +35,9 @@ server,nowait \
 -global PIIX4_PM.disable_s3=0 \
 -global PIIX4_PM.disable_s4=0 \
 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x8 \
+-usb \
 -device usb-ccid,id=ua-myCCID,bus=ua-SomeWeirdController.0,port=1 \
 -device usb-ccid,id=ua-myCCID2,bus=ua-SomeWeirdController.0,port=2 \
--usb \
 -drive file=/var/lib/libvirt/images/fd.img,format=raw,if=none,\
 id=drive-ua-myDisk1,cache=none \
 -drive file=/var/lib/libvirt/images/gentoo.qcow2,format=qcow2,if=none,\