diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index 253e62be90..9833f6dc6a 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -166,8 +166,7 @@ qemuDomainAddDiskSrcTLSObject(virQEMUDriverPtr driver,
                                 src->tlsCertdir,
                                 false,
                                 src->tlsVerify,
-                                NULL, &tlsProps, NULL,
-                                NULL, NULL) < 0)
+                                NULL, &tlsProps, NULL, NULL) < 0)
         goto cleanup;
 
     if (qemuDomainAddTLSObjects(driver, vm, QEMU_ASYNC_JOB_NONE,
@@ -1502,21 +1501,19 @@ qemuDomainGetTLSObjects(virQEMUCapsPtr qemuCaps,
                         const char *srcAlias,
                         virJSONValuePtr *tlsProps,
                         char **tlsAlias,
-                        virJSONValuePtr *secProps,
-                        char **secAlias)
+                        virJSONValuePtr *secProps)
 {
+    const char *secAlias = NULL;
+
     if (secinfo) {
         if (qemuBuildSecretInfoProps(secinfo, secProps) < 0)
             return -1;
 
-        if (secAlias &&
-            !(*secAlias = qemuDomainGetSecretAESAlias(srcAlias, false)))
-            return -1;
+        secAlias = secinfo->s.aes.alias;
     }
 
     if (qemuBuildTLSx509BackendProps(tlsCertdir, tlsListen, tlsVerify,
-                                     secAlias ? *secAlias : NULL, qemuCaps,
-                                     tlsProps) < 0)
+                                     secAlias, qemuCaps, tlsProps) < 0)
         return -1;
 
     if (tlsAlias &&
@@ -1567,7 +1564,7 @@ qemuDomainAddChardevTLSObjects(virQEMUDriverPtr driver,
                                 dev->data.tcp.listen,
                                 cfg->chardevTLSx509verify,
                                 charAlias, &tlsProps, tlsAlias,
-                                &secProps, NULL) < 0)
+                                &secProps) < 0)
         goto cleanup;
     dev->data.tcp.tlscreds = true;
 
diff --git a/src/qemu/qemu_hotplug.h b/src/qemu/qemu_hotplug.h
index 0bcccee8fc..b0f741c37c 100644
--- a/src/qemu/qemu_hotplug.h
+++ b/src/qemu/qemu_hotplug.h
@@ -56,8 +56,7 @@ int qemuDomainGetTLSObjects(virQEMUCapsPtr qemuCaps,
                             const char *srcAlias,
                             virJSONValuePtr *tlsProps,
                             char **tlsAlias,
-                            virJSONValuePtr *secProps,
-                            char **secAlias);
+                            virJSONValuePtr *secProps);
 
 int qemuDomainAttachControllerDevice(virQEMUDriverPtr driver,
                                      virDomainObjPtr vm,
diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_params.c
index c50498852c..fede814c00 100644
--- a/src/qemu/qemu_migration_params.c
+++ b/src/qemu/qemu_migration_params.c
@@ -860,7 +860,7 @@ qemuMigrationParamsEnableTLS(virQEMUDriverPtr driver,
                                 cfg->migrateTLSx509certdir, tlsListen,
                                 cfg->migrateTLSx509verify,
                                 QEMU_MIGRATION_TLS_ALIAS_BASE,
-                                &tlsProps, tlsAlias, &secProps, NULL) < 0)
+                                &tlsProps, tlsAlias, &secProps) < 0)
         goto error;
 
     /* Ensure the domain doesn't already have the TLS objects defined...