diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index bfdc94e1b9..d49d70f866 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -101,7 +101,8 @@ VIR_ENUM_IMPL(virDomainTaint, VIR_DOMAIN_TAINT_LAST,
               "disk-probing",
               "external-launch",
               "host-cpu",
-              "hook-script");
+              "hook-script",
+              "cdrom-passthrough");
 
 VIR_ENUM_IMPL(virDomainVirt, VIR_DOMAIN_VIRT_LAST,
               "qemu",
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index d8a8e31dd3..f93d73ef10 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -2288,6 +2288,7 @@ typedef enum {
     VIR_DOMAIN_TAINT_EXTERNAL_LAUNCH,  /* Externally launched guest domain */
     VIR_DOMAIN_TAINT_HOST_CPU,         /* Host CPU passthrough in use */
     VIR_DOMAIN_TAINT_HOOK,             /* Domain (possibly) changed via hook script */
+    VIR_DOMAIN_TAINT_CDROM_PASSTHROUGH,/* CDROM passthrough */
 
     VIR_DOMAIN_TAINT_LAST
 } virDomainTaintFlags;
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index 608eed7109..db8554b79e 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -2079,6 +2079,12 @@ void qemuDomainObjCheckDiskTaint(virQEMUDriverPtr driver,
         qemuDomainObjTaint(driver, obj, VIR_DOMAIN_TAINT_HIGH_PRIVILEGES,
                            logFD);
 
+    if (disk->device == VIR_DOMAIN_DISK_DEVICE_CDROM &&
+        virStorageSourceGetActualType(disk->src) == VIR_STORAGE_TYPE_BLOCK &&
+        disk->src->path)
+        qemuDomainObjTaint(driver, obj, VIR_DOMAIN_TAINT_CDROM_PASSTHROUGH,
+                           logFD);
+
     virObjectUnref(cfg);
 }
 
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index 0cc0a29fb2..a2f8e24f77 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -8202,6 +8202,7 @@ qemuDomainUpdateDeviceLive(virConnectPtr conn,
 
     switch ((virDomainDeviceType) dev->type) {
     case VIR_DOMAIN_DEVICE_DISK:
+        qemuDomainObjCheckDiskTaint(driver, vm, dev->data.disk, -1);
         ret = qemuDomainChangeDiskMediaLive(conn, vm, dev, driver, force);
         break;
     case VIR_DOMAIN_DEVICE_GRAPHICS: