diff --git a/src/qemu/qemu.conf b/src/qemu/qemu.conf
index 3979471f81..a12cae2533 100644
--- a/src/qemu/qemu.conf
+++ b/src/qemu/qemu.conf
@@ -385,7 +385,8 @@
 # CA in the migrate_tls_x509_cert_dir (or default_tls_x509_cert_dir).
 #
 # If this option is not supplied, it will be set to the value of
-# "default_tls_x509_verify".
+# "default_tls_x509_verify". If "default_tls_x509_verify" is not supplied
+# either, the default is "1".
 #
 #migrate_tls_x509_verify = 1
 
diff --git a/src/qemu/qemu_conf.c b/src/qemu/qemu_conf.c
index 044e4f19e8..25e9ed2ecd 100644
--- a/src/qemu/qemu_conf.c
+++ b/src/qemu/qemu_conf.c
@@ -1254,7 +1254,7 @@ virQEMUDriverConfigSetDefaults(virQEMUDriverConfigPtr cfg)
 
     SET_TLS_VERIFY_DEFAULT(vnc, false);
     SET_TLS_VERIFY_DEFAULT(chardev, true);
-    SET_TLS_VERIFY_DEFAULT(migrate, false);
+    SET_TLS_VERIFY_DEFAULT(migrate, true);
     SET_TLS_VERIFY_DEFAULT(backup, false);
 
 #undef SET_TLS_VERIFY_DEFAULT