diff --git a/src/qemu/qemu_blockjob.c b/src/qemu/qemu_blockjob.c
index 80d0269128..c118f2c298 100644
--- a/src/qemu/qemu_blockjob.c
+++ b/src/qemu/qemu_blockjob.c
@@ -664,9 +664,9 @@ qemuBlockJobEventProcessLegacyCompleted(virQEMUDriverPtr driver,
         virObjectUnref(disk->src);
         disk->src = disk->mirror;
     } else {
-        if (disk->mirror) {
-            virStorageSourcePtr n;
+        virStorageSourcePtr n;
 
+        if (disk->mirror) {
             virDomainLockImageDetach(driver->lockManager, vm, disk->mirror);
 
             /* Ideally, we would restore seclabels on the backing chain here
@@ -684,6 +684,16 @@ qemuBlockJobEventProcessLegacyCompleted(virQEMUDriverPtr driver,
 
             virObjectUnref(disk->mirror);
         }
+
+        for (n = disk->src; virStorageSourceIsBacking(n); n = n->backingStore) {
+            if (qemuSecurityMoveImageMetadata(driver, vm, n, NULL) < 0) {
+                VIR_WARN("Unable to remove disk metadata on "
+                         "vm %s from %s (disk target %s)",
+                         vm->def->name,
+                         NULLSTR(n->path),
+                         disk->dst);
+            }
+        }
     }
 
     /* Recompute the cached backing chain to match our