diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c
index 1c406ce68e..88c1ce2cc7 100644
--- a/src/qemu/qemu_cgroup.c
+++ b/src/qemu/qemu_cgroup.c
@@ -789,6 +789,17 @@ qemuInitCgroup(virQEMUDriverPtr driver,
         goto cleanup;
     }
 
+    if (virCgroupAddTask(priv->cgroup, vm->pid) < 0) {
+        virErrorPtr saved = virSaveLastError();
+        virCgroupRemove(priv->cgroup);
+        virCgroupFree(&priv->cgroup);
+        if (saved) {
+            virSetError(saved);
+            virFreeError(saved);
+        }
+        goto cleanup;
+    }
+
  done:
     ret = 0;
  cleanup:
@@ -1160,10 +1171,6 @@ qemuSetupCgroupForEmulator(virDomainObjPtr vm)
             goto cleanup;
     }
 
-    /* consider the first thread an emulator-thread */
-    if (virCgroupAddTask(cgroup_emulator, vm->pid) < 0)
-        goto cleanup;
-
     virCgroupFree(&cgroup_emulator);
     return 0;
 
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index f083f3f329..05cbda2372 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -4895,6 +4895,12 @@ qemuProcessLaunch(virConnectPtr conn,
     if (qemuSetupCgroup(driver, vm, nnicindexes, nicindexes) < 0)
         goto cleanup;
 
+    /* This must be done after cgroup placement to avoid resetting CPU
+     * affinity */
+    if (!vm->def->cputune.emulatorpin &&
+        qemuProcessInitCpuAffinity(vm) < 0)
+        goto cleanup;
+
     VIR_DEBUG("Setting domain security labels");
     if (virSecurityManagerSetAllLabel(driver->securityManager,
                                       vm->def,
@@ -4941,12 +4947,6 @@ qemuProcessLaunch(virConnectPtr conn,
     if (qemuSetupCgroupForEmulator(vm) < 0)
         goto cleanup;
 
-    /* This must be done after cgroup placement to avoid resetting CPU
-     * affinity */
-    if (!vm->def->cputune.emulatorpin &&
-        qemuProcessInitCpuAffinity(vm) < 0)
-        goto cleanup;
-
     VIR_DEBUG("Setting affinity of emulator threads");
     if (qemuProcessSetEmulatorAffinity(vm) < 0)
         goto cleanup;