diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm
index 9112d937..a5ee8e2a 100644
--- a/PVE/QemuServer.pm
+++ b/PVE/QemuServer.pm
@@ -3407,6 +3407,8 @@ sub config_to_command {
         }
 
 	my $drive_cmd = print_drive_commandline_full($storecfg, $vmid, $drive);
+	$drive_cmd .= ',readonly' if PVE::QemuConfig->is_template($conf);
+
 	push @$devices, '-drive',$drive_cmd;
 	push @$devices, '-device', print_drivedevice_full($storecfg, $conf, $vmid, $drive, $bridges, $arch, $machine_type);
     });
@@ -4785,7 +4787,8 @@ sub vm_start {
     return PVE::QemuConfig->lock_config($vmid, sub {
 	my $conf = PVE::QemuConfig->load_config($vmid, $migrate_opts->{migratedfrom});
 
-	die "you can't start a vm if it's a template\n" if PVE::QemuConfig->is_template($conf);
+	die "you can't start a vm if it's a template\n"
+	    if !$params->{skiptemplate} && PVE::QemuConfig->is_template($conf);
 
 	my $has_suspended_lock = PVE::QemuConfig->has_lock($conf, 'suspended');
 
@@ -4814,6 +4817,7 @@ sub vm_start {
 # params:
 #   statefile => 'tcp', 'unix' for migration or path/volid for RAM state
 #   skiplock => 0/1, skip checking for config lock
+#   skiptemplate => 0/1, skip checking whether VM is template
 #   forcemachine => to force Qemu machine (rollback/migration)
 #   forcecpu => a QEMU '-cpu' argument string to override get_cpu_options
 #   timeout => in seconds
diff --git a/PVE/VZDump/QemuServer.pm b/PVE/VZDump/QemuServer.pm
index e9619602..da874b91 100644
--- a/PVE/VZDump/QemuServer.pm
+++ b/PVE/VZDump/QemuServer.pm
@@ -472,20 +472,11 @@ sub archive_pbs {
     my $keyfile = PVE::Storage::PBSPlugin::pbs_encryption_key_file_name($scfg, $opts->{storage});
 
     my $diskcount = scalar(@{$task->{disks}});
-    if (PVE::QemuConfig->is_template($self->{vmlist}->{$vmid}) || !$diskcount) {
+    # proxmox-backup-client can only handle raw files and block devs
+    # only use it (directly) for disk-less VMs
+    if (!$diskcount) {
 	my @pathlist;
-	# FIXME: accumulate disk sizes to use for backup job (email) log
-	foreach my $di (@{$task->{disks}}) {
-	    if ($di->{type} eq 'block' || $di->{type} eq 'file') {
-		push @pathlist, "$di->{qmdevice}.img:$di->{path}";
-	    } else {
-		die "implement me (type $di->{type})";
-	    }
-	}
-
-	if (!$diskcount) {
-	    $self->loginfo("backup contains no disks");
-	}
+	$self->loginfo("backup contains no disks");
 
 	local $ENV{PBS_PASSWORD} = $password;
 	local $ENV{PBS_FINGERPRINT} = $fingerprint if defined($fingerprint);
@@ -500,7 +491,6 @@ sub archive_pbs {
 
 	push @$cmd, "qemu-server.conf:$conffile";
 	push @$cmd, "fw.conf:$firewall" if -e $firewall;
-	push @$cmd, @pathlist if scalar(@pathlist);
 
 	$self->loginfo("starting template backup");
 	$self->loginfo(join(' ', @$cmd));
@@ -549,8 +539,9 @@ sub archive_pbs {
 	    $params->{encrypt} = JSON::false;
 	}
 
+	my $is_template = PVE::QemuConfig->is_template($self->{vmlist}->{$vmid});
 	$params->{'use-dirty-bitmap'} = JSON::true
-	    if $qemu_support->{'pbs-dirty-bitmap'} && $self->{vm_was_running};
+	    if $qemu_support->{'pbs-dirty-bitmap'} && $self->{vm_was_running} && !$is_template;
 
 	$params->{timeout} = 60; # give some time to connect to the backup server
 
@@ -831,6 +822,7 @@ sub enforce_vm_running_for_backup {
 	# start with skiplock
 	my $params = {
 	    skiplock => 1,
+	    skiptemplate => 1,
 	    paused => 1,
 	};
 	PVE::QemuServer::vm_start($self->{storecfg}, $vmid, $params);