Workaround of using VIR_DOMAIN_XML_SECURE does not work anymore with VMs with additional devices, but usptream has a fix which we apply to our libvirt.