From 4f0204eb15fa435af8771fb7af6a4a6b6d8919ba Mon Sep 17 00:00:00 2001
From: Rusty Bird <rustybird@net-c.com>
Date: Wed, 22 Jul 2026 16:16:25 +0000
Subject: [PATCH 1/2] storage: unconditionally call stop_encrypted()

A volume's ephemeral property might have become False while the volume
was already started, e.g. by changing the pool level default with
'qvm-pool set -o ephemeral_volatile=False'
---
 qubes/storage/__init__.py | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/qubes/storage/__init__.py b/qubes/storage/__init__.py
index 5da497171..3bbe41701 100644
--- a/qubes/storage/__init__.py
+++ b/qubes/storage/__init__.py
@@ -857,16 +857,12 @@ async def start(self):
                 pass
 
     async def stop(self):
-        """Execute the stop method on each volume"""
+        """Stop each volume"""
         await qubes.utils.void_coros_maybe(
-            # pylint: disable=line-too-long
-            (
-                vol.stop_encrypted(
-                    vol.encrypted_volume_path(self.vm.name, name)
-                )
-                if vol.ephemeral
-                else vol.stop()
-            )
+            # Always call stop_encrypted() - which can handle an unencrypted
+            # volume as well - to correctly clean up even if the ephemeral
+            # property became False while the volume was already started.
+            vol.stop_encrypted(vol.encrypted_volume_path(self.vm.name, name))
             for name, vol in self.vm.volumes.items()
         )
         for vol in self.vm.volumes.values():

From 9b92297c7f385c284eef41e6bae8c6043ca70f02 Mon Sep 17 00:00:00 2001
From: Rusty Bird <rustybird@net-c.com>
Date: Wed, 22 Jul 2026 16:16:26 +0000
Subject: [PATCH 2/2] api/admin: allow admin.vm.volume.Set.ephemeral even if
 started

admin.pool.Set.ephemeral_volatile already had no such restriction.
---
 qubes/api/admin.py | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/qubes/api/admin.py b/qubes/api/admin.py
index bc6dcd866..81f25b188 100644
--- a/qubes/api/admin.py
+++ b/qubes/api/admin.py
@@ -766,9 +766,6 @@ async def vm_volume_set_ephemeral(self, untrusted_payload):
 
         self.fire_event_for_permission(newvalue=newvalue)
 
-        if not self.dest.is_halted():
-            raise qubes.exc.QubesVMNotHaltedError(self.dest)
-
         self.dest.volumes[self.arg].ephemeral = newvalue
         self.app.save()