diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index eb5373d591..8bab2ff3c6 100644
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -392,8 +392,8 @@ static inline PacketAlert PacketAlertSet(
 /**
  * \brief Append signature to local packet alert queue for later preprocessing
  */
-void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint64_t tx_id,
-        uint8_t alert_flags)
+static void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
+        uint64_t tx_id, uint8_t alert_flags)
 {
     /* first time we see a drop action signature, set that in the packet */
     /* we do that even before inserting into the queue, so we save it even if appending fails */
@@ -418,6 +418,37 @@ void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet
     det_ctx->alert_queue_size++;
 }
 
+/**
+ * \brief Append signature to local packet alert queue for later preprocessing
+ */
+void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
+        uint64_t tx_id, uint8_t alert_flags)
+{
+    alert_flags |= (PACKET_ALERT_FLAG_TX | PACKET_ALERT_FLAG_STATE_MATCH);
+    return AlertQueueAppend(det_ctx, s, p, tx_id, alert_flags);
+}
+
+/**
+ * \brief Append signature to local packet alert queue for later preprocessing
+ * This does not automatically set PACKET_ALERT_FLAG_STATE_MATCH as this
+ * comes from the packet alert path.
+ */
+void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
+        uint64_t tx_id, uint8_t alert_flags)
+{
+    alert_flags |= PACKET_ALERT_FLAG_TX;
+    return AlertQueueAppend(det_ctx, s, p, tx_id, alert_flags);
+}
+
+/**
+ * \brief Append signature to local packet alert queue for later preprocessing
+ */
+void AlertQueueAppendPacket(
+        DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint8_t alert_flags)
+{
+    return AlertQueueAppend(det_ctx, s, p, PACKET_ALERT_NOTX, alert_flags);
+}
+
 /** \internal
  * \brief sort helper for sorting alerts by priority
  *
diff --git a/src/detect-engine-alert.h b/src/detect-engine-alert.h
index 1a8c8b81c3..259444d5e9 100644
--- a/src/detect-engine-alert.h
+++ b/src/detect-engine-alert.h
@@ -30,8 +30,12 @@
 
 void AlertQueueInit(DetectEngineThreadCtx *det_ctx);
 void AlertQueueFree(DetectEngineThreadCtx *det_ctx);
-void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint64_t tx_id,
-        uint8_t alert_flags);
+void AlertQueueAppendPacket(
+        DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p, uint8_t alert_flags);
+void AlertQueueAppendAppTxFromPacket(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
+        uint64_t tx_id, uint8_t alert_flags);
+void AlertQueueAppendAppTx(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet *p,
+        uint64_t tx_id, uint8_t alert_flags);
 void PacketAlertFinalize(const DetectEngineCtx *, DetectEngineThreadCtx *, Packet *);
 #ifdef UNITTESTS
 int PacketAlertCheck(Packet *, uint32_t);
diff --git a/src/detect-engine-iponly.c b/src/detect-engine-iponly.c
index 31a5f02f28..b410f7aa96 100644
--- a/src/detect-engine-iponly.c
+++ b/src/detect-engine-iponly.c
@@ -1113,7 +1113,7 @@ void IPOnlyMatchPacket(ThreadVars *tv, const DetectEngineCtx *de_ctx,
                         }
                     }
                 }
-                AlertQueueAppend(det_ctx, s, p, 0, 0);
+                AlertQueueAppendPacket(det_ctx, s, p, 0);
             }
         }
     }
diff --git a/src/detect.c b/src/detect.c
index 527227ced4..cd2a91d011 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -739,7 +739,7 @@ static uint8_t DetectRunApplyPacketPolicy(const DetectEngineCtx *de_ctx,
     }
     Signature *s = de_ctx->fw_policies->pkt_policy_signatures[policy];
     if (s != NULL) {
-        AlertQueueAppend(det_ctx, s, p, 0, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
+        AlertQueueAppendPacket(det_ctx, s, p, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
     }
     return p->action;
 }
@@ -875,7 +875,11 @@ static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
                 }
             }
         }
-        AlertQueueAppend(det_ctx, s, p, txid, alert_flags);
+        if (alert_flags & PACKET_ALERT_FLAG_TX) {
+            AlertQueueAppendAppTx(det_ctx, s, p, txid, alert_flags);
+        } else {
+            AlertQueueAppendPacket(det_ctx, s, p, alert_flags);
+        }
 
         if (det_ctx->post_rule_work_queue.len > 0) {
             /* run post match prefilter engines on work queue */
@@ -1668,8 +1672,7 @@ static inline void DetectRunAppendDefaultAppPolicyAlert(DetectEngineThreadCtx *d
                 det_ctx->de_ctx->fw_policies, alproto, direction, hook);
         BUG_ON(s == NULL);
         uint8_t alert_flags = apply_to_packet ? PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET : 0;
-        alert_flags |= PACKET_ALERT_FLAG_TX;
-        AlertQueueAppend(det_ctx, s, p, tx_id, alert_flags);
+        AlertQueueAppendAppTx(det_ctx, s, p, tx_id, alert_flags);
     }
 }
 
@@ -2002,7 +2005,7 @@ static void DetectRunAppendDefaultAccept(DetectEngineThreadCtx *det_ctx, Packet
     default_accept.flags = SIG_FLAG_FIREWALL;
     default_accept.detect_table =
             DETECT_TABLE_APP_FILTER; // TODO review, hope this makes it last in sorting
-    AlertQueueAppend(det_ctx, &default_accept, p, 0, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
+    AlertQueueAppendPacket(det_ctx, &default_accept, p, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
 }
 
 /** \internal
@@ -2156,8 +2159,10 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con
         DetectTransaction *tx, struct DetectFirewallAppTxState *fw_state, Flow *f, Packet *p,
         const uint8_t flow_flags)
 {
-    uint8_t alert_flags = (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_TX);
     if (s->action & ACTION_ACCEPT) {
+        /* add alert now, as ApplyAccept may also trigger
+         * policy matches that could add alerts. */
+        SCLogDebug("append alert");
         /* see if we need to apply tx/hook accept to the packet. This can be needed
          * when we've completed the inspection so far for an incomplete tx, and an
          * accept:tx or accept:hook is the last match.*/
@@ -2165,14 +2170,11 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con
         if (fw_accept_to_packet) {
             SCLogDebug("packet %" PRIu64 ": apply accept to packet", PcapPacketCntGet(p));
             SCLogDebug("accept:(tx|hook): should be applied to the packet");
-            alert_flags |= PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET;
+            AlertQueueAppendAppTx(
+                    det_ctx, s, p, tx->tx_id, PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET);
+        } else {
+            AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0);
         }
-        SCLogDebug("append alert");
-
-        /* add alert now, as ApplyAccept may also trigger
-         * policy matches that could add alerts. */
-        AlertQueueAppend(det_ctx, s, p, tx->tx_id, alert_flags);
-
         DetectRunTxFirewallApplyAccept(det_ctx, p, flow_flags, s, tx, fw_state);
     } else if (s->action & ACTION_DROP) {
         SCLogDebug("drop packet because of rule with drop action");
@@ -2183,10 +2185,10 @@ static void DetectRunTxFirewallRuleFullMatch(DetectEngineThreadCtx *det_ctx, con
             f->flags |= FLOW_ACTION_BY_FIREWALL;
         }
         SCLogDebug("append alert");
-        AlertQueueAppend(det_ctx, s, p, tx->tx_id, alert_flags);
+        AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0);
     } else {
         SCLogDebug("append alert");
-        AlertQueueAppend(det_ctx, s, p, tx->tx_id, alert_flags);
+        AlertQueueAppendAppTx(det_ctx, s, p, tx->tx_id, 0);
     }
 }
 
@@ -2559,8 +2561,7 @@ static void DetectRunTx(ThreadVars *tv,
                         "%p/%" PRIu64 " sig %u (%u) matched", tx.tx_ptr, tx.tx_id, s->id, s->iid);
 
                 if ((s->flags & SIG_FLAG_FIREWALL) == 0) {
-                    AlertQueueAppend(det_ctx, s, p, tx.tx_id,
-                            (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_TX));
+                    AlertQueueAppendAppTx(det_ctx, s, p, tx.tx_id, 0);
                 } else {
                     DetectRunTxFirewallRuleFullMatch(det_ctx, s, &tx, &fw_state, f, p, flow_flags);
                 }
@@ -2763,15 +2764,16 @@ static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngin
                 if (r) {
                     /* match */
                     DetectRunPostMatch(tv, det_ctx, p, s);
-
-                    uint8_t alert_flags = (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME);
                     det_ctx->frame_id = frame->id;
                     SCLogDebug(
                             "%p/%" PRIi64 " sig %u (%u) matched", frame, frame->id, s->id, s->iid);
+                    const uint8_t alert_flags =
+                            (PACKET_ALERT_FLAG_STATE_MATCH | PACKET_ALERT_FLAG_FRAME);
                     if (frame->flags & FRAME_FLAG_TX_ID_SET) {
-                        alert_flags |= PACKET_ALERT_FLAG_TX;
+                        AlertQueueAppendAppTx(det_ctx, s, p, frame->tx_id, alert_flags);
+                    } else {
+                        AlertQueueAppendPacket(det_ctx, s, p, alert_flags);
                     }
-                    AlertQueueAppend(det_ctx, s, p, frame->tx_id, alert_flags);
                 }
             }
             DetectVarProcessList(det_ctx, p->flow, p);