diff --git a/tests/qemuxml2argvdata/aarch64-gic-default-both.args b/tests/qemuxml2argvdata/aarch64-gic-default-both.args
index 9f604422c4..0d7a1c259a 100644
--- a/tests/qemuxml2argvdata/aarch64-gic-default-both.args
+++ b/tests/qemuxml2argvdata/aarch64-gic-default-both.args
@@ -9,11 +9,12 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 /usr/bin/qemu-system-aarch64 \
 -name guest=aarch64test,debug-threads=on \
 -S \
--object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes \
--machine virt,usb=off,gic-version=3,dump-guest-core=off \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes"}' \
+-machine virt,usb=off,gic-version=3,dump-guest-core=off,memory-backend=mach-virt.ram \
 -accel kvm \
 -cpu host \
 -m 1024 \
+-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 -uuid 6ba410c5-1e5c-4d57-bee7-2228e7ffa32f \
@@ -27,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 -no-acpi \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/aarch64-gic-default-v2.args b/tests/qemuxml2argvdata/aarch64-gic-default-v2.args
index 07dd297842..fe06bd19ac 100644
--- a/tests/qemuxml2argvdata/aarch64-gic-default-v2.args
+++ b/tests/qemuxml2argvdata/aarch64-gic-default-v2.args
@@ -9,11 +9,12 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 /usr/bin/qemu-system-aarch64 \
 -name guest=aarch64test,debug-threads=on \
 -S \
--object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes \
--machine virt,usb=off,gic-version=2,dump-guest-core=off \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes"}' \
+-machine virt,usb=off,gic-version=2,dump-guest-core=off,memory-backend=mach-virt.ram \
 -accel kvm \
 -cpu host \
 -m 1024 \
+-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 -uuid 6ba410c5-1e5c-4d57-bee7-2228e7ffa32f \
@@ -27,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 -no-acpi \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/aarch64-gic-default-v3.args b/tests/qemuxml2argvdata/aarch64-gic-default-v3.args
index 9f604422c4..0d7a1c259a 100644
--- a/tests/qemuxml2argvdata/aarch64-gic-default-v3.args
+++ b/tests/qemuxml2argvdata/aarch64-gic-default-v3.args
@@ -9,11 +9,12 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 /usr/bin/qemu-system-aarch64 \
 -name guest=aarch64test,debug-threads=on \
 -S \
--object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes \
--machine virt,usb=off,gic-version=3,dump-guest-core=off \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes"}' \
+-machine virt,usb=off,gic-version=3,dump-guest-core=off,memory-backend=mach-virt.ram \
 -accel kvm \
 -cpu host \
 -m 1024 \
+-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 -uuid 6ba410c5-1e5c-4d57-bee7-2228e7ffa32f \
@@ -27,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 -no-acpi \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/aarch64-gic-host.args b/tests/qemuxml2argvdata/aarch64-gic-host.args
index bee6ededdf..9f9799917d 100644
--- a/tests/qemuxml2argvdata/aarch64-gic-host.args
+++ b/tests/qemuxml2argvdata/aarch64-gic-host.args
@@ -9,11 +9,12 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 /usr/bin/qemu-system-aarch64 \
 -name guest=aarch64test,debug-threads=on \
 -S \
--object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes \
--machine virt,usb=off,gic-version=host,dump-guest-core=off \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes"}' \
+-machine virt,usb=off,gic-version=host,dump-guest-core=off,memory-backend=mach-virt.ram \
 -accel kvm \
 -cpu host \
 -m 1024 \
+-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 -uuid 6ba410c5-1e5c-4d57-bee7-2228e7ffa32f \
@@ -27,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 -no-acpi \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/aarch64-gic-none-both.args b/tests/qemuxml2argvdata/aarch64-gic-none-both.args
index 9f604422c4..0d7a1c259a 100644
--- a/tests/qemuxml2argvdata/aarch64-gic-none-both.args
+++ b/tests/qemuxml2argvdata/aarch64-gic-none-both.args
@@ -9,11 +9,12 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 /usr/bin/qemu-system-aarch64 \
 -name guest=aarch64test,debug-threads=on \
 -S \
--object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes \
--machine virt,usb=off,gic-version=3,dump-guest-core=off \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes"}' \
+-machine virt,usb=off,gic-version=3,dump-guest-core=off,memory-backend=mach-virt.ram \
 -accel kvm \
 -cpu host \
 -m 1024 \
+-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 -uuid 6ba410c5-1e5c-4d57-bee7-2228e7ffa32f \
@@ -27,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 -no-acpi \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/aarch64-gic-none-v2.args b/tests/qemuxml2argvdata/aarch64-gic-none-v2.args
index 07dd297842..fe06bd19ac 100644
--- a/tests/qemuxml2argvdata/aarch64-gic-none-v2.args
+++ b/tests/qemuxml2argvdata/aarch64-gic-none-v2.args
@@ -9,11 +9,12 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 /usr/bin/qemu-system-aarch64 \
 -name guest=aarch64test,debug-threads=on \
 -S \
--object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes \
--machine virt,usb=off,gic-version=2,dump-guest-core=off \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes"}' \
+-machine virt,usb=off,gic-version=2,dump-guest-core=off,memory-backend=mach-virt.ram \
 -accel kvm \
 -cpu host \
 -m 1024 \
+-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 -uuid 6ba410c5-1e5c-4d57-bee7-2228e7ffa32f \
@@ -27,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 -no-acpi \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/aarch64-gic-none-v3.args b/tests/qemuxml2argvdata/aarch64-gic-none-v3.args
index 9f604422c4..0d7a1c259a 100644
--- a/tests/qemuxml2argvdata/aarch64-gic-none-v3.args
+++ b/tests/qemuxml2argvdata/aarch64-gic-none-v3.args
@@ -9,11 +9,12 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 /usr/bin/qemu-system-aarch64 \
 -name guest=aarch64test,debug-threads=on \
 -S \
--object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes \
--machine virt,usb=off,gic-version=3,dump-guest-core=off \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes"}' \
+-machine virt,usb=off,gic-version=3,dump-guest-core=off,memory-backend=mach-virt.ram \
 -accel kvm \
 -cpu host \
 -m 1024 \
+-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 -uuid 6ba410c5-1e5c-4d57-bee7-2228e7ffa32f \
@@ -27,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 -no-acpi \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/aarch64-gic-v2.args b/tests/qemuxml2argvdata/aarch64-gic-v2.args
index 07dd297842..fe06bd19ac 100644
--- a/tests/qemuxml2argvdata/aarch64-gic-v2.args
+++ b/tests/qemuxml2argvdata/aarch64-gic-v2.args
@@ -9,11 +9,12 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 /usr/bin/qemu-system-aarch64 \
 -name guest=aarch64test,debug-threads=on \
 -S \
--object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes \
--machine virt,usb=off,gic-version=2,dump-guest-core=off \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes"}' \
+-machine virt,usb=off,gic-version=2,dump-guest-core=off,memory-backend=mach-virt.ram \
 -accel kvm \
 -cpu host \
 -m 1024 \
+-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 -uuid 6ba410c5-1e5c-4d57-bee7-2228e7ffa32f \
@@ -27,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 -no-acpi \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/aarch64-gic-v3.args b/tests/qemuxml2argvdata/aarch64-gic-v3.args
index 9f604422c4..0d7a1c259a 100644
--- a/tests/qemuxml2argvdata/aarch64-gic-v3.args
+++ b/tests/qemuxml2argvdata/aarch64-gic-v3.args
@@ -9,11 +9,12 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 /usr/bin/qemu-system-aarch64 \
 -name guest=aarch64test,debug-threads=on \
 -S \
--object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes \
--machine virt,usb=off,gic-version=3,dump-guest-core=off \
+-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-aarch64test/master-key.aes"}' \
+-machine virt,usb=off,gic-version=3,dump-guest-core=off,memory-backend=mach-virt.ram \
 -accel kvm \
 -cpu host \
 -m 1024 \
+-object '{"qom-type":"memory-backend-ram","id":"mach-virt.ram","size":1073741824}' \
 -overcommit mem-lock=off \
 -smp 1,sockets=1,cores=1,threads=1 \
 -uuid 6ba410c5-1e5c-4d57-bee7-2228e7ffa32f \
@@ -27,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-aarch64test/.config \
 -no-acpi \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index 772caca47e..2498469dc9 100644
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -915,10 +915,13 @@ mymain(void)
 # define DO_TEST_NOCAPS(name) \
     DO_TEST_FULL(name, "",  ARG_END)
 
-# define DO_TEST_GIC(name, gic, ...) \
+/* GIC tests use 'latest' capabilities */
+# define DO_TEST_GIC(name, gic) \
     DO_TEST_FULL(name, "", \
                  ARG_GIC, gic, \
-                 ARG_QEMU_CAPS, __VA_ARGS__, QEMU_CAPS_LAST, ARG_END)
+                 ARG_CAPS_ARCH, "aarch64", \
+                 ARG_CAPS_VER, "latest", \
+                 ARG_END)
 
 # define DO_TEST_FAILURE(name, ...) \
     DO_TEST_FULL(name, "", \
@@ -2400,13 +2403,10 @@ mymain(void)
                  ARG_CAPS_ARCH, "aarch64",
                  ARG_CAPS_VER, "latest",
                  ARG_END);
+    DO_TEST_GIC("aarch64-gic-none-v2", GIC_V2);
+    DO_TEST_GIC("aarch64-gic-none-v3", GIC_V3);
+    DO_TEST_GIC("aarch64-gic-none-both", GIC_BOTH);
     qemuTestSetHostArch(&driver, VIR_ARCH_AARCH64);
-    DO_TEST_GIC("aarch64-gic-none-v2", GIC_V2,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-none-v3", GIC_V3,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-none-both", GIC_BOTH,
-            QEMU_CAPS_KVM);
     DO_TEST_FULL("aarch64-gic-none-tcg", "", ARG_GIC, GIC_BOTH, ARG_END);
     DO_TEST_FULL("aarch64-gic-default", ".aarch64-4.2.0",
                  ARG_GIC, GIC_NONE,
@@ -2418,37 +2418,22 @@ mymain(void)
                  ARG_CAPS_ARCH, "aarch64",
                  ARG_CAPS_VER, "latest",
                  ARG_END);
+    DO_TEST_GIC("aarch64-gic-default-v2", GIC_V2);
+    DO_TEST_GIC("aarch64-gic-default-v3", GIC_V3);
+    DO_TEST_GIC("aarch64-gic-default-both", GIC_BOTH);
+    DO_TEST_GIC("aarch64-gic-v2", GIC_NONE);
+    DO_TEST_GIC("aarch64-gic-v2", GIC_V2);
+    DO_TEST_GIC("aarch64-gic-v2", GIC_V3);
+    DO_TEST_GIC("aarch64-gic-v2", GIC_BOTH);
+    DO_TEST_GIC("aarch64-gic-v3", GIC_NONE);
+    DO_TEST_GIC("aarch64-gic-v3", GIC_V2);
+    DO_TEST_GIC("aarch64-gic-v3", GIC_V3);
+    DO_TEST_GIC("aarch64-gic-v3", GIC_BOTH);
+    DO_TEST_GIC("aarch64-gic-host", GIC_NONE);
+    DO_TEST_GIC("aarch64-gic-host", GIC_V2);
+    DO_TEST_GIC("aarch64-gic-host", GIC_V3);
+    DO_TEST_GIC("aarch64-gic-host", GIC_BOTH);
     qemuTestSetHostArch(&driver, VIR_ARCH_AARCH64);
-    DO_TEST_GIC("aarch64-gic-default-v2", GIC_V2,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-default-v3", GIC_V3,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-default-both", GIC_BOTH,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-v2", GIC_NONE,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-v2", GIC_V2,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-v2", GIC_V3,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-v2", GIC_BOTH,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-v3", GIC_NONE,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-v3", GIC_V2,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-v3", GIC_V3,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-v3", GIC_BOTH,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-host", GIC_NONE,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-host", GIC_V2,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-host", GIC_V3,
-            QEMU_CAPS_KVM);
-    DO_TEST_GIC("aarch64-gic-host", GIC_BOTH,
-            QEMU_CAPS_KVM);
     DO_TEST_PARSE_ERROR("aarch64-gic-invalid",
             QEMU_CAPS_KVM);
     DO_TEST_PARSE_ERROR("aarch64-gic-not-virt",