diff --git a/tools/virsh.c b/tools/virsh.c
index ed1dbb8d9c..72ca93add7 100644
--- a/tools/virsh.c
+++ b/tools/virsh.c
@@ -4265,6 +4265,7 @@ static const vshCmdInfo info_destroy[] = {
 
 static const vshCmdOptDef opts_destroy[] = {
     {"domain", VSH_OT_DATA, VSH_OFLAG_REQ, N_("domain name, id or uuid")},
+    {"graceful", VSH_OT_BOOL, VSH_OFLAG_NONE, N_("terminate gracefully")},
     {NULL, 0, 0, NULL}
 };
 
@@ -4274,6 +4275,8 @@ cmdDestroy(vshControl *ctl, const vshCmd *cmd)
     virDomainPtr dom;
     bool ret = true;
     const char *name;
+    unsigned int flags = 0;
+    int result;
 
     if (!vshConnectionUsability(ctl, ctl->conn))
         return false;
@@ -4281,7 +4284,15 @@ cmdDestroy(vshControl *ctl, const vshCmd *cmd)
     if (!(dom = vshCommandOptDomain(ctl, cmd, &name)))
         return false;
 
-    if (virDomainDestroy(dom) == 0) {
+    if (vshCommandOptBool(cmd, "graceful"))
+       flags |= VIR_DOMAIN_DESTROY_GRACEFUL;
+
+    if (flags)
+       result = virDomainDestroyFlags(dom, VIR_DOMAIN_DESTROY_GRACEFUL);
+    else
+       result = virDomainDestroy(dom);
+
+    if (result == 0) {
         vshPrint(ctl, _("Domain %s destroyed\n"), name);
     } else {
         vshError(ctl, _("Failed to destroy domain %s"), name);
diff --git a/tools/virsh.pod b/tools/virsh.pod
index 10b51ff740..a85da1346c 100644
--- a/tools/virsh.pod
+++ b/tools/virsh.pod
@@ -458,7 +458,7 @@ Flag I<--title> selects operation on the title field instead of description.
 If neither of I<--edit> and I<--new_desc> are specified the note or description
 is displayed instead of being modified.
 
-=item B<destroy> I<domain-id>
+=item B<destroy> I<domain-id> [I<--graceful>]
 
 Immediately terminate the domain domain-id.  This doesn't give the domain
 OS any chance to react, and it's the equivalent of ripping the power
@@ -472,6 +472,10 @@ be lost once the guest stops running, but the snapshot contents still
 exist, and a new domain with the same name and UUID can restore the
 snapshot metadata with B<snapshot-create>.
 
+If I<--graceful> is specified, don't resort to extreme measures
+(e.g. SIGKILL) when the guest doesn't stop after a reasonable timeout;
+return an error instead.
+
 =item B<domblkstat> I<domain> I<block-device> [I<--human>]
 
 Get device block stats for a running domain.  A I<block-device> corresponds