diff --git a/qemu.go b/qemu.go
index 869ae3be55..15cb20c1a0 100644
--- a/qemu.go
+++ b/qemu.go
@@ -219,7 +219,7 @@ func (fsdev FSDevice) QemuParams(config *Config) []string {
 	fsParams = append(fsParams, string(fsdev.FSDriver))
 	fsParams = append(fsParams, fmt.Sprintf(",id=%s", fsdev.ID))
 	fsParams = append(fsParams, fmt.Sprintf(",path=%s", fsdev.Path))
-	fsParams = append(fsParams, fmt.Sprintf(",security-model=%s", fsdev.SecurityModel))
+	fsParams = append(fsParams, fmt.Sprintf(",security_model=%s", fsdev.SecurityModel))
 
 	qemuParams = append(qemuParams, "-device")
 	qemuParams = append(qemuParams, strings.Join(deviceParams, ""))
diff --git a/qemu_test.go b/qemu_test.go
index 647b202a92..87e17ec9fe 100644
--- a/qemu_test.go
+++ b/qemu_test.go
@@ -100,7 +100,7 @@ func TestAppendDeviceNVDIMM(t *testing.T) {
 	testAppend(object, deviceNVDIMMString, t)
 }
 
-var deviceFSString = "-device virtio-9p-pci,fsdev=workload9p,mount_tag=rootfs -fsdev local,id=workload9p,path=/var/lib/docker/devicemapper/mnt/e31ebda2,security-model=none"
+var deviceFSString = "-device virtio-9p-pci,fsdev=workload9p,mount_tag=rootfs -fsdev local,id=workload9p,path=/var/lib/docker/devicemapper/mnt/e31ebda2,security_model=none"
 
 func TestAppendDeviceFS(t *testing.T) {
 	fsdev := FSDevice{