diff --git a/internal/server/device/disk.go b/internal/server/device/disk.go
index 9ed2d16aceb..6d820751562 100644
--- a/internal/server/device/disk.go
+++ b/internal/server/device/disk.go
@@ -1301,6 +1301,8 @@ func (d *disk) startVM() (*deviceConfig.RunConfig, error) {
 						var errUnsupported UnsupportedError
 						if errors.As(err, &errUnsupported) {
 							d.logger.Warn("Unable to use virtio-fs for device, using 9p as a fallback", logger.Ctx{"err": errUnsupported})
+							// Fallback to 9p-only.
+							busOption = "9p"
 
 							if errUnsupported == ErrMissingVirtiofsd {
 								_ = d.state.DB.Cluster.Transaction(context.TODO(), func(ctx context.Context, tx *db.ClusterTx) error {
@@ -1339,6 +1341,19 @@ func (d *disk) startVM() (*deviceConfig.RunConfig, error) {
 				if err != nil {
 					return nil, fmt.Errorf("Failed to setup virtiofsd for device %q: %w", d.name, err)
 				}
+
+				// We can't hotplug 9p shares, so only do 9p for stopped instances.
+				if !d.inst.IsRunning() {
+					// If an idmap is specified, disable 9p.
+					if len(rawIDMaps.Entries) > 0 {
+						// If we are 9p-only, return an error.
+						if busOption == "9p" {
+							return nil, fmt.Errorf("9p shares do not support identity mapping")
+						}
+
+						opts = append(opts, "bus=virtiofs")
+					}
+				}
 			} else {
 				// Confirm we're dealing with block options.
 				err := validate.Optional(validate.IsOneOf("nvme", "virtio-blk", "virtio-scsi"))(d.config["io.bus"])