diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index e72a9442bf..5ef98d38cc 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -1578,6 +1578,9 @@ qemuBuildDriveSourceStr(virDomainDiskDefPtr disk,
         }
 
         virQEMUBuildBufferEscapeComma(buf, source);
+
+        if (secinfo && secinfo->type == VIR_DOMAIN_SECRET_INFO_TYPE_AES)
+            virBufferAsprintf(buf, ",file.password-secret=%s", secinfo->s.aes.alias);
     } else {
         if (!(source = virQEMUBuildDriveCommandlineFromJSON(srcprops)))
             goto cleanup;
@@ -1592,16 +1595,6 @@ qemuBuildDriveSourceStr(virDomainDiskDefPtr disk,
             virBufferAsprintf(buf, "file.debug=%d,", cfg->glusterDebugLevel);
     }
 
-    if (secinfo && secinfo->type == VIR_DOMAIN_SECRET_INFO_TYPE_AES) {
-        /* NB: If libvirt starts using the more modern option based
-         *     syntax to build the command line (e.g., "-drive driver=rbd,
-         *     filename=%s,...") instead of the legacy model (e.g."-drive
-         *     file=%s,..."), then the "file." prefix can be removed
-         */
-        virBufferAsprintf(buf, "file.password-secret=%s,",
-                          secinfo->s.aes.alias);
-    }
-
     if (encinfo)
         virQEMUBuildLuksOpts(buf, &disk->src->encryption->encinfo,
                              encinfo->s.aes.alias);