diff --git a/tests/cli-test-xml/compare/virt-install-cpu-disable-sec.xml b/tests/cli-test-xml/compare/virt-install-cpu-disable-sec.xml
index de73803b..a86d6926 100644
--- a/tests/cli-test-xml/compare/virt-install-cpu-disable-sec.xml
+++ b/tests/cli-test-xml/compare/virt-install-cpu-disable-sec.xml
@@ -14,8 +14,6 @@
   </features>
   <cpu mode="custom" match="exact">
     <model>qemu64</model>
-    <feature policy="require" name="spec-ctrl"/>
-    <feature policy="require" name="ssbd"/>
   </cpu>
   <clock offset="utc">
     <timer name="rtc" tickpolicy="catchup"/>
@@ -63,8 +61,6 @@
   </features>
   <cpu mode="custom" match="exact">
     <model>qemu64</model>
-    <feature policy="require" name="spec-ctrl"/>
-    <feature policy="require" name="ssbd"/>
   </cpu>
   <clock offset="utc">
     <timer name="rtc" tickpolicy="catchup"/>
diff --git a/virtinst/cli.py b/virtinst/cli.py
index 5356e7b4..1899c600 100644
--- a/virtinst/cli.py
+++ b/virtinst/cli.py
@@ -1951,11 +1951,12 @@ class ParserCPU(VirtCLIParser):
     @classmethod
     def _init_class(cls, **kwargs):
         VirtCLIParser._init_class(**kwargs)
+        # 'secure' needs to be parsed before 'model'
+        cls.add_arg("secure", "secure", is_onoff=True)
         cls.add_arg("model", "model", cb=cls.set_model_cb)
         cls.add_arg("mode", "mode")
         cls.add_arg("match", "match")
         cls.add_arg("vendor", "vendor")
-        cls.add_arg("secure", "secure", is_onoff=True)
         cls.add_arg("cache.mode", "cache.mode")
         cls.add_arg("cache.level", "cache.level")