diff --git a/src/security/security_dac.c b/src/security/security_dac.c
index f3fbede737..2266059819 100644
--- a/src/security/security_dac.c
+++ b/src/security/security_dac.c
@@ -956,10 +956,10 @@ virSecurityDACSetImageLabel(virSecurityManagerPtr mgr,
 
 
 static int
-virSecurityDACRestoreImageLabelInt(virSecurityManagerPtr mgr,
-                                   virDomainDefPtr def,
-                                   virStorageSourcePtr src,
-                                   bool migrated)
+virSecurityDACRestoreImageLabelSingle(virSecurityManagerPtr mgr,
+                                      virDomainDefPtr def,
+                                      virStorageSourcePtr src,
+                                      bool migrated)
 {
     virSecurityDACDataPtr priv = virSecurityManagerGetPrivateData(mgr);
     virSecurityLabelDefPtr secdef;
@@ -1010,6 +1010,26 @@ virSecurityDACRestoreImageLabelInt(virSecurityManagerPtr mgr,
 }
 
 
+static int
+virSecurityDACRestoreImageLabelInt(virSecurityManagerPtr mgr,
+                                   virDomainDefPtr def,
+                                   virStorageSourcePtr src,
+                                   bool migrated)
+{
+    if (virSecurityDACRestoreImageLabelSingle(mgr, def, src, migrated) < 0)
+        return -1;
+
+    if (src->externalDataStore &&
+        virSecurityDACRestoreImageLabelSingle(mgr,
+                                              def,
+                                              src->externalDataStore,
+                                              migrated) < 0)
+        return -1;
+
+    return 0;
+}
+
+
 static int
 virSecurityDACRestoreImageLabel(virSecurityManagerPtr mgr,
                                 virDomainDefPtr def,