diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index d8d8989766..04e93feb10 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -15579,7 +15579,8 @@ qemuDomainBlockCopyCommon(virDomainObjPtr vm,
                           unsigned long long bandwidth,
                           unsigned int granularity,
                           unsigned long long buf_size,
-                          unsigned int flags)
+                          unsigned int flags,
+                          bool keepParentLabel)
 {
     virQEMUDriverPtr driver = conn->privateData;
     qemuDomainObjPrivatePtr priv;
@@ -15711,7 +15712,8 @@ qemuDomainBlockCopyCommon(virDomainObjPtr vm,
     if (mirror->format > 0)
         format = virStorageFileFormatTypeToString(mirror->format);
 
-    if (virStorageSourceInitChainElement(mirror, disk->src, false) < 0)
+    if (virStorageSourceInitChainElement(mirror, disk->src,
+                                         keepParentLabel) < 0)
         goto endjob;
 
     if (qemuDomainPrepareDiskChainElement(driver, vm, mirror,
@@ -15823,7 +15825,7 @@ qemuDomainBlockRebase(virDomainPtr dom, const char *path, const char *base,
     flags &= (VIR_DOMAIN_BLOCK_REBASE_SHALLOW |
               VIR_DOMAIN_BLOCK_REBASE_REUSE_EXT);
     ret = qemuDomainBlockCopyCommon(vm, dom->conn, path, dest,
-                                    bandwidth, 0, 0, flags);
+                                    bandwidth, 0, 0, flags, true);
     vm = NULL;
     dest = NULL;
 
@@ -15896,8 +15898,8 @@ qemuDomainBlockCopy(virDomainPtr dom, const char *disk, const char *destxml,
                                              VIR_DOMAIN_XML_INACTIVE)))
         goto cleanup;
 
-    ret = qemuDomainBlockCopyCommon(vm, dom->conn, disk, dest,
-                                    bandwidth, granularity, buf_size, flags);
+    ret = qemuDomainBlockCopyCommon(vm, dom->conn, disk, dest, bandwidth,
+                                    granularity, buf_size, flags, false);
     vm = NULL;
 
  cleanup:
@@ -16072,7 +16074,7 @@ qemuDomainBlockCommit(virDomainPtr dom,
             goto endjob;
         if (virStorageSourceInitChainElement(mirror,
                                              disk->src,
-                                             false) < 0)
+                                             true) < 0)
             goto endjob;
     }
 
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
index 6c635c2cd5..8185d1294a 100644
--- a/src/qemu/qemu_process.c
+++ b/src/qemu/qemu_process.c
@@ -1064,7 +1064,7 @@ qemuProcessHandleBlockJob(qemuMonitorPtr mon ATTRIBUTE_UNUSED,
                         copy = virStorageSourceCopy(disk->mirror, false);
                         if (virStorageSourceInitChainElement(copy,
                                                              persistDisk->src,
-                                                             false) < 0) {
+                                                             true) < 0) {
                             VIR_WARN("Unable to update persistent definition "
                                      "on vm %s after block job",
                                      vm->def->name);
diff --git a/src/util/virstoragefile.c b/src/util/virstoragefile.c
index 4a3b7ca8e1..064b4f0d01 100644
--- a/src/util/virstoragefile.c
+++ b/src/util/virstoragefile.c
@@ -1901,29 +1901,26 @@ virStorageSourceCopy(const virStorageSource *src,
  * virStorageSourceInitChainElement:
  * @newelem: New backing chain element disk source
  * @old: Existing top level disk source
- * @force: Force-copy the information
+ * @transferLabels: Transfer security lables.
  *
  * Transfers relevant information from the existing disk source to the new
  * backing chain element if they weren't supplied so that labelling info
  * and possibly other stuff is correct.
  *
- * If @force is true, user-supplied information for the new backing store
- * element is overwritten from @old instead of keeping it.
+ * If @transferLabels is true, security labels from the existing disk are copied
+ * to the new disk. Otherwise the default domain imagelabel label will be used.
  *
  * Returns 0 on success, -1 on error.
  */
 int
 virStorageSourceInitChainElement(virStorageSourcePtr newelem,
                                  virStorageSourcePtr old,
-                                 bool force)
+                                 bool transferLabels)
 {
     int ret = -1;
 
-    if (force) {
-        virStorageSourceSeclabelsClear(newelem);
-    }
-
-    if (!newelem->seclabels &&
+    if (transferLabels &&
+        !newelem->seclabels &&
         virStorageSourceSeclabelsCopy(newelem, old) < 0)
         goto cleanup;
 
@@ -2370,7 +2367,7 @@ virStorageSourceNewFromBacking(virStorageSourcePtr parent)
         }
 
         /* copy parent's labelling and other top level stuff */
-        if (virStorageSourceInitChainElement(ret, parent, false) < 0)
+        if (virStorageSourceInitChainElement(ret, parent, true) < 0)
             goto error;
     }