diff --git a/qubesadmin/devices.py b/qubesadmin/devices.py
index c8f10333..f0d33325 100644
--- a/qubesadmin/devices.py
+++ b/qubesadmin/devices.py
@@ -39,6 +39,9 @@ class is implemented by an extension.
                                         DeviceAssignment, VirtualDevice)
 
 
+DEVICE_DENY_LIST = "/etc/qubes/device-deny.list"
+
+
 class DeviceCollection:
     """Bag for devices.
 
diff --git a/qubesadmin/tools/qvm_device.py b/qubesadmin/tools/qvm_device.py
index b1d3a0b4..3ab4181e 100644
--- a/qubesadmin/tools/qvm_device.py
+++ b/qubesadmin/tools/qvm_device.py
@@ -35,6 +35,7 @@
 from qubesadmin.device_protocol import (Port, DeviceInfo, UnknownDevice,
                                         DeviceAssignment, VirtualDevice,
                                         DeviceInterface)
+from qubesadmin.devices import DEVICE_DENY_LIST
 
 
 def prepare_table(dev_list):
@@ -252,9 +253,6 @@ def assign_device(args):
               f"{assignment.backend_domain}:{assignment.port_id}")
 
 
-DEVICE_DENY_LIST = "/etc/qubes/device-deny.list"  # TODO
-
-
 def is_on_deny_list(device, dest):
     """
     Checks if *any* interface of the device is on the deny list for `dest` vm.