diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
index 833c75514c..aa8d350f51 100644
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -473,6 +473,7 @@ VIR_ENUM_IMPL(virQEMUCaps, QEMU_CAPS_LAST,
               /* 290 */
               "query-cpus-fast",
               "disk-write-cache",
+              "nbd-tls",
     );
 
 
@@ -1247,6 +1248,7 @@ static struct virQEMUCapsStringFlags virQEMUCapsQMPSchemaQueries[] = {
     { "blockdev-add/arg-type/+vxhs", QEMU_CAPS_VXHS},
     { "blockdev-add/arg-type/+iscsi/password-secret", QEMU_CAPS_ISCSI_PASSWORD_SECRET },
     { "blockdev-add/arg-type/+qcow2/encrypt/+luks/key-secret", QEMU_CAPS_QCOW2_LUKS },
+    { "nbd-server-start/arg-type/tls-creds", QEMU_CAPS_NBD_TLS },
 };
 
 typedef struct _virQEMUCapsObjectTypeProps virQEMUCapsObjectTypeProps;
diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
index c55cada7b8..2afe7ef580 100644
--- a/src/qemu/qemu_capabilities.h
+++ b/src/qemu/qemu_capabilities.h
@@ -457,6 +457,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check */
     /* 290 */
     QEMU_CAPS_QUERY_CPUS_FAST, /* query-cpus-fast command */
     QEMU_CAPS_DISK_WRITE_CACHE, /* qemu block frontends support write-cache param */
+    QEMU_CAPS_NBD_TLS, /* NBD server supports TLS transport */
 
     QEMU_CAPS_LAST /* this must always be the last item */
 } virQEMUCapsFlags;
diff --git a/tests/qemucapabilitiesdata/caps_2.10.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_2.10.0.aarch64.xml
index 527b425dee..a7f8ddd661 100644
--- a/tests/qemucapabilitiesdata/caps_2.10.0.aarch64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.10.0.aarch64.xml
@@ -153,6 +153,7 @@
   <flag name='dump-completed'/>
   <flag name='qcow2-luks'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2010000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>303541</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.10.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_2.10.0.ppc64.xml
index 3ac6be2d88..41d07ffb2b 100644
--- a/tests/qemucapabilitiesdata/caps_2.10.0.ppc64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.10.0.ppc64.xml
@@ -152,6 +152,7 @@
   <flag name='dump-completed'/>
   <flag name='qcow2-luks'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2010000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>382824</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.10.0.s390x.xml b/tests/qemucapabilitiesdata/caps_2.10.0.s390x.xml
index b682d36c93..098326ecc9 100644
--- a/tests/qemucapabilitiesdata/caps_2.10.0.s390x.xml
+++ b/tests/qemucapabilitiesdata/caps_2.10.0.s390x.xml
@@ -113,6 +113,7 @@
   <flag name='dump-completed'/>
   <flag name='qcow2-luks'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2010000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>303326</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.10.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.10.0.x86_64.xml
index 8dd30ccbcf..dd794092a1 100644
--- a/tests/qemucapabilitiesdata/caps_2.10.0.x86_64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.10.0.x86_64.xml
@@ -196,6 +196,7 @@
   <flag name='dump-completed'/>
   <flag name='qcow2-luks'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2010000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>344938</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml b/tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml
index 6dd392502e..64bd554541 100644
--- a/tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml
+++ b/tests/qemucapabilitiesdata/caps_2.11.0.s390x.xml
@@ -118,6 +118,7 @@
   <flag name='qcow2-luks'/>
   <flag name='seccomp-blacklist'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2011000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>342058</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml
index 31c5d0dd23..197060abb5 100644
--- a/tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.12.0.aarch64.xml
@@ -157,6 +157,7 @@
   <flag name='seccomp-blacklist'/>
   <flag name='query-cpus-fast'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2011090</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>342346</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml
index 7dead4a1f4..b0eb0552da 100644
--- a/tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.12.0.ppc64.xml
@@ -154,6 +154,7 @@
   <flag name='seccomp-blacklist'/>
   <flag name='query-cpus-fast'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2011090</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>419215</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml b/tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml
index 70ae8f91c7..80f3ec6ec7 100644
--- a/tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml
+++ b/tests/qemucapabilitiesdata/caps_2.12.0.s390x.xml
@@ -119,6 +119,7 @@
   <flag name='seccomp-blacklist'/>
   <flag name='query-cpus-fast'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2011090</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>0</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml
index d809a78380..0b18dd00f9 100644
--- a/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.12.0.x86_64.xml
@@ -195,6 +195,7 @@
   <flag name='seccomp-blacklist'/>
   <flag name='query-cpus-fast'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2011090</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>390060</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.6.0.aarch64.xml b/tests/qemucapabilitiesdata/caps_2.6.0.aarch64.xml
index b1bb3e7bd2..d80036cc6b 100644
--- a/tests/qemucapabilitiesdata/caps_2.6.0.aarch64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.6.0.aarch64.xml
@@ -140,6 +140,7 @@
   <flag name='isa-serial'/>
   <flag name='pl011'/>
   <flag name='dump-completed'/>
+  <flag name='nbd-tls'/>
   <version>2006000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>228241</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.6.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_2.6.0.ppc64.xml
index f3611e1922..60463930e0 100644
--- a/tests/qemucapabilitiesdata/caps_2.6.0.ppc64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.6.0.ppc64.xml
@@ -135,6 +135,7 @@
   <flag name='spapr-vty'/>
   <flag name='isa-serial'/>
   <flag name='dump-completed'/>
+  <flag name='nbd-tls'/>
   <version>2006000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>263005</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml
index 0e48180275..3e2399ef20 100644
--- a/tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.6.0.x86_64.xml
@@ -171,6 +171,7 @@
   <flag name='virtio-gpu.max_outputs'/>
   <flag name='isa-serial'/>
   <flag name='dump-completed'/>
+  <flag name='nbd-tls'/>
   <version>2006000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>227332</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.7.0.s390x.xml b/tests/qemucapabilitiesdata/caps_2.7.0.s390x.xml
index 34eed23694..266287344d 100644
--- a/tests/qemucapabilitiesdata/caps_2.7.0.s390x.xml
+++ b/tests/qemucapabilitiesdata/caps_2.7.0.s390x.xml
@@ -103,6 +103,7 @@
   <flag name='sclplmconsole'/>
   <flag name='dump-completed'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2007000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>216732</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml
index ee4b25d7fd..711e4c935a 100644
--- a/tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.7.0.x86_64.xml
@@ -176,6 +176,7 @@
   <flag name='isa-serial'/>
   <flag name='dump-completed'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2007000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>239029</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.8.0.s390x.xml b/tests/qemucapabilitiesdata/caps_2.8.0.s390x.xml
index 21046c0546..3449ca5ff1 100644
--- a/tests/qemucapabilitiesdata/caps_2.8.0.s390x.xml
+++ b/tests/qemucapabilitiesdata/caps_2.8.0.s390x.xml
@@ -105,6 +105,7 @@
   <flag name='sclplmconsole'/>
   <flag name='dump-completed'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2007093</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>241633</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.8.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.8.0.x86_64.xml
index c4801ac23a..62e104f3a6 100644
--- a/tests/qemucapabilitiesdata/caps_2.8.0.x86_64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.8.0.x86_64.xml
@@ -178,6 +178,7 @@
   <flag name='isa-serial'/>
   <flag name='dump-completed'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2008000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>255684</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.9.0.ppc64.xml b/tests/qemucapabilitiesdata/caps_2.9.0.ppc64.xml
index 73f42a7392..0e679d1ce3 100644
--- a/tests/qemucapabilitiesdata/caps_2.9.0.ppc64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.9.0.ppc64.xml
@@ -144,6 +144,7 @@
   <flag name='isa-serial'/>
   <flag name='dump-completed'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2009000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>346538</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.9.0.s390x.xml b/tests/qemucapabilitiesdata/caps_2.9.0.s390x.xml
index 30fce6ecf1..2122a5126e 100644
--- a/tests/qemucapabilitiesdata/caps_2.9.0.s390x.xml
+++ b/tests/qemucapabilitiesdata/caps_2.9.0.s390x.xml
@@ -108,6 +108,7 @@
   <flag name='iscsi.password-secret'/>
   <flag name='dump-completed'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2009000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>265051</microcodeVersion>
diff --git a/tests/qemucapabilitiesdata/caps_2.9.0.x86_64.xml b/tests/qemucapabilitiesdata/caps_2.9.0.x86_64.xml
index e1dc257a75..a359e2e75f 100644
--- a/tests/qemucapabilitiesdata/caps_2.9.0.x86_64.xml
+++ b/tests/qemucapabilitiesdata/caps_2.9.0.x86_64.xml
@@ -191,6 +191,7 @@
   <flag name='isa-serial'/>
   <flag name='dump-completed'/>
   <flag name='disk-write-cache'/>
+  <flag name='nbd-tls'/>
   <version>2009000</version>
   <kvmVersion>0</kvmVersion>
   <microcodeVersion>320947</microcodeVersion>