diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index 51b89158a7b358062851da8e17b4cae026204a18..c2fa75ba466705053cb538856c82f6e124d09753 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -1539,7 +1539,7 @@ qemuDomainChangeGraphics(struct qemud_driver *driver,
                             _("cannot change listen address setting on spice graphics"));
             return -1;
         }
-        if (STRNEQ_NULLABLE(oldListenNetwork,newListenNetwork)) {
+        if (STRNEQ_NULLABLE(oldListenNetwork, newListenNetwork)) {
             qemuReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                             _("cannot change listen network setting on spice graphics"));
             return -1;
@@ -1551,11 +1551,16 @@ qemuDomainChangeGraphics(struct qemud_driver *driver,
             return -1;
         }
 
-        /* If a password lifetime was, or is set, then we must always run,
-         * even if new password matches old password */
+        /* We must reset the password if it has changed but also if:
+         * - password lifetime is or was set
+         * - the requested action has changed
+         * - the action is "disconnect"
+         */
         if (olddev->data.spice.auth.expires ||
             dev->data.spice.auth.expires ||
             olddev->data.spice.auth.connected != dev->data.spice.auth.connected ||
+            dev->data.spice.auth.connected ==
+            VIR_DOMAIN_GRAPHICS_AUTH_CONNECTED_DISCONNECT ||
             STRNEQ_NULLABLE(olddev->data.spice.auth.passwd,
                             dev->data.spice.auth.passwd)) {
             VIR_DEBUG("Updating password on SPICE server %p %p",