diff --git a/core/includes/bootstrap.inc b/core/includes/bootstrap.inc
index 086e26c..a113b9d 100644
--- a/core/includes/bootstrap.inc
+++ b/core/includes/bootstrap.inc
@@ -589,7 +589,7 @@ function drupal_settings_initialize() {
   global $base_url, $base_path, $base_root, $script_path;
 
   // Export these settings.php variables to the global namespace.
-  global $databases, $cookie_domain, $conf, $db_prefix, $drupal_hash_salt, $base_secure_url, $base_insecure_url, $config_directories;
+  global $databases, $cookie_domain, $conf, $db_prefix, $base_secure_url, $base_insecure_url, $config_directories;
   $conf = array();
 
   // Make conf_path() available as local variable in settings.php.
@@ -1898,7 +1898,8 @@ function drupal_get_user_timezone() {
  *   A salt based on information in settings.php, not in the database.
  */
 function drupal_get_hash_salt() {
-  global $drupal_hash_salt, $databases;
+  global $databases;
+  $drupal_hash_salt = settings()->get('drupal_hash_salt');
   // If the $drupal_hash_salt variable is empty, a hash of the serialized
   // database credentials is used as a fallback salt.
   return empty($drupal_hash_salt) ? hash('sha256', serialize($databases)) : $drupal_hash_salt;
diff --git a/core/includes/install.core.inc b/core/includes/install.core.inc
index 8789366..329ce9f 100644
--- a/core/includes/install.core.inc
+++ b/core/includes/install.core.inc
@@ -1228,7 +1228,7 @@ function install_settings_form_submit($form, &$form_state) {
       'value'    => $database,
       'required' => TRUE,
     );
-    $settings['drupal_hash_salt'] = (object) array(
+    $settings['settings']['drupal_hash_salt'] = (object) array(
       'value'    => Crypt::randomStringHashed(55),
       'required' => TRUE,
     );
diff --git a/sites/default/default.settings.php b/sites/default/default.settings.php
index fe16cfc..1f6f0b6 100644
--- a/sites/default/default.settings.php
+++ b/sites/default/default.settings.php
@@ -215,25 +215,6 @@
 $databases = array();
 
 /**
- * Salt for one-time login links and cancel links, form tokens, etc.
- *
- * This variable will be set to a random value by the installer. All one-time
- * login links will be invalidated if the value is changed. Note that if your
- * site is deployed on a cluster of web servers, you must ensure that this
- * variable has the same value on each server. If this variable is empty, a hash
- * of the serialized database credentials will be used as a fallback salt.
- *
- * For enhanced security, you may set this variable to a value using the
- * contents of a file outside your docroot that is never saved together
- * with any backups of your Drupal files and database.
- *
- * Example:
- *   $drupal_hash_salt = file_get_contents('/home/example/salt.txt');
- *
- */
-$drupal_hash_salt = '';
-
-/**
  * Location of the site configuration files.
  *
  * By default, Drupal configuration files are stored in a randomly named
@@ -271,6 +252,26 @@
  */
 
 /**
+ * Salt for one-time login links and cancel links, form tokens, etc.
+ *
+ * This variable will be set to a random value by the installer. All one-time
+ * login links will be invalidated if the value is changed. Note that if your
+ * site is deployed on a cluster of web servers, you must ensure that this
+ * variable has the same value on each server. If this variable is empty, a hash
+ * of the serialized database credentials will be used as a fallback salt.
+ *
+ * For enhanced security, you may set this variable to a value using the
+ * contents of a file outside your docroot that is never saved together
+ * with any backups of your Drupal files and database.
+ *
+ * Example:
+ * @code
+ *   $settings['drupal_hash_salt'] = file_get_contents('/home/example/salt.txt');
+ * @endcode
+ */
+$settings['drupal_hash_salt'] = '';
+
+/**
  * Access control for update.php script.
  *
  * If you are updating your Drupal installation using the update.php script but