diff --git a/internal/virt/domain/domain.go b/internal/virt/domain/domain.go
index 6f1f761..cde9ca0 100644
--- a/internal/virt/domain/domain.go
+++ b/internal/virt/domain/domain.go
@@ -402,12 +402,17 @@ func (d *VirtDomain) render() ([]byte, error) {
 			return nil, err
 		}
 	}
+	hostDirs, err := d.hostDirs()
+	if err != nil {
+		return nil, err
+	}
 	var args = map[string]any{
 		"name":              d.guest.ID,
 		"uuid":              uuid,
 		"memory":            d.guest.MemoryInMiB(),
 		"cpu":               d.guest.CPU,
 		"gpus":              gpus,
+		"host_dirs":         hostDirs,
 		"sysvol":            string(sysVolXML),
 		"datavols":          dataVols,
 		"interface":         d.getInterfaceType(),
@@ -555,6 +560,29 @@ func (d *VirtDomain) gpus() ([]map[string]string, error) {
 	return allocGPUs(d.guest.GPUEngineParams)
 }
 
+func (d *VirtDomain) hostDirs() ([]map[string]string, error) {
+	ss, ok := d.guest.JSONLabels["instance/host-dirs"]
+	if !ok {
+		return nil, nil
+	}
+	parts := strings.FieldsFunc(ss, func(r rune) bool {
+		return r == ',' || r == ' ' || r == ';'
+	})
+	ans := make([]map[string]string, 0, len(parts))
+	for _, p := range parts {
+		switch parts2 := strings.Split(p, ":"); len(parts2) {
+		case 2:
+			ans = append(ans, map[string]string{
+				"src": parts2[0],
+				"dst": parts2[1],
+			})
+		default:
+			return nil, fmt.Errorf("invalid host dir: %s", p)
+		}
+	}
+	return ans, nil
+}
+
 type vncConfig struct {
 	Port     int    `json:"port"`
 	Password string `json:"password"`
diff --git a/internal/virt/domain/templates/guest.xml b/internal/virt/domain/templates/guest.xml
index fbe3960..b62bbde 100644
--- a/internal/virt/domain/templates/guest.xml
+++ b/internal/virt/domain/templates/guest.xml
@@ -42,6 +42,14 @@
     <suspend-to-mem enabled='no'/>
     <suspend-to-disk enabled='no'/>
   </pm>
+
+  {{if .host_dirs }}
+  <memoryBacking>
+    <source type='memfd'/>
+    <access mode='shared'/>
+  </memoryBacking>
+  {{end}}
+
   <devices>
     {{ .sysvol }}
 
@@ -56,6 +64,15 @@
       <readonly/>
       <address type='drive' controller='0' bus='0' target='0' unit='0'/>
     </disk>
+
+    {{range .host_dirs}}
+    <filesystem type='mount' accessmode='passthrough'>
+      <driver type='virtiofs' queue='1024'/>
+      <source dir='{{.src}}'/>
+      <target dir='{{.dst}}'/>
+    </filesystem>
+    {{end}}
+
     <controller type='usb' index='0' model='ich9-ehci1'>
       <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x7'/>
     </controller>