diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index a8342ff7d5..d801018aa2 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -7644,8 +7644,12 @@ qemuBuildGraphicsVNCCommandLine(virQEMUDriverConfigPtr cfg,
                               graphics->data.vnc.sharePolicy));
     }
 
-    if (graphics->data.vnc.auth.passwd || cfg->vncPassword)
-        virBufferAddLit(&opt, ",password");
+    if (graphics->data.vnc.auth.passwd || cfg->vncPassword) {
+        if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_VNC_OPTS))
+            virBufferAddLit(&opt, ",password=on");
+        else
+            virBufferAddLit(&opt, ",password");
+    }
 
     if (cfg->vncTLS) {
         qemuDomainGraphicsPrivatePtr gfxPriv = QEMU_DOMAIN_GRAPHICS_PRIVATE(graphics);
@@ -7670,7 +7674,10 @@ qemuBuildGraphicsVNCCommandLine(virQEMUDriverConfigPtr cfg,
 
             virBufferAsprintf(&opt, ",tls-creds=%s", gfxPriv->tlsAlias);
         } else {
-            virBufferAddLit(&opt, ",tls");
+            if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_VNC_OPTS))
+                virBufferAddLit(&opt, ",tls=on");
+            else
+                virBufferAddLit(&opt, ",tls");
             if (cfg->vncTLSx509verify) {
                 virBufferAddLit(&opt, ",x509verify=");
                 virQEMUBuildBufferEscapeComma(&opt, cfg->vncTLSx509certdir);
@@ -7682,7 +7689,10 @@ qemuBuildGraphicsVNCCommandLine(virQEMUDriverConfigPtr cfg,
     }
 
     if (cfg->vncSASL) {
-        virBufferAddLit(&opt, ",sasl");
+        if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_VNC_OPTS))
+            virBufferAddLit(&opt, ",sasl=on");
+        else
+            virBufferAddLit(&opt, ",sasl");
 
         if (cfg->vncSASLdir)
             virCommandAddEnvPair(cmd, "SASL_CONF_PATH", cfg->vncSASLdir);
diff --git a/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-latest.args b/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-latest.args
index 00119fcd3d..eb0df17eda 100644
--- a/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-latest.args
+++ b/tests/qemuxml2argvdata/graphics-vnc-tls-secret.x86_64-latest.args
@@ -34,7 +34,7 @@ data=9eao5F8qtkGt+seB1HYivWIxbtwUu6MQtg1zpj/oDtUsPr1q8wBYM91uEHCn6j/1,\
 keyid=masterKey0,iv=AAECAwQFBgcICQoLDA0ODw==,format=base64 \
 -object tls-creds-x509,id=vnc-tls-creds0,dir=/etc/pki/libvirt-vnc,\
 endpoint=server,verify-peer=yes,passwordid=vnc-tls-creds0-secret0 \
--vnc 127.0.0.1:3,tls-creds=vnc-tls-creds0,sasl \
+-vnc 127.0.0.1:3,tls-creds=vnc-tls-creds0,sasl=on \
 -device cirrus-vga,id=video0,bus=pci.0,addr=0x2 \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\
 resourcecontrol=deny \
diff --git a/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-2.4.0.args b/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-2.4.0.args
index 471ff0dc77..78a47f1d30 100644
--- a/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-2.4.0.args
+++ b/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-2.4.0.args
@@ -26,6 +26,6 @@ server=on,wait=off \
 -no-acpi \
 -boot strict=on \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
--vnc 127.0.0.1:3,tls,x509verify=/etc/pki/libvirt-vnc,sasl \
+-vnc 127.0.0.1:3,tls=on,x509verify=/etc/pki/libvirt-vnc,sasl=on \
 -device cirrus-vga,id=video0,bus=pci.0,addr=0x2 \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args b/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args
index b739a9b9c8..1c4b948b97 100644
--- a/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args
+++ b/tests/qemuxml2argvdata/graphics-vnc-tls.x86_64-latest.args
@@ -31,7 +31,7 @@ file=/tmp/lib/domain--1-QEMUGuest1/master-key.aes \
 -device piix3-usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 \
 -object tls-creds-x509,id=vnc-tls-creds0,dir=/etc/pki/libvirt-vnc,\
 endpoint=server,verify-peer=yes \
--vnc 127.0.0.1:3,tls-creds=vnc-tls-creds0,sasl \
+-vnc 127.0.0.1:3,tls-creds=vnc-tls-creds0,sasl=on \
 -device cirrus-vga,id=video0,bus=pci.0,addr=0x2 \
 -sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,\
 resourcecontrol=deny \