diff --git a/core/modules/block/block.services.yml b/core/modules/block/block.services.yml
index fe20e4a..960eb37 100644
--- a/core/modules/block/block.services.yml
+++ b/core/modules/block/block.services.yml
@@ -1,6 +1,7 @@
 services:
   theme.negotiator.block.admin_demo:
     class: Drupal\block\Theme\AdminDemoNegotiator
+    arguments: ['@current_user']
     tags:
       - { name: theme_negotiator, priority: 1000 }
   block.page_display_variant_subscriber:
diff --git a/core/modules/block/src/Theme/AdminDemoNegotiator.php b/core/modules/block/src/Theme/AdminDemoNegotiator.php
index 50d88c3..b2f5e12 100644
--- a/core/modules/block/src/Theme/AdminDemoNegotiator.php
+++ b/core/modules/block/src/Theme/AdminDemoNegotiator.php
@@ -8,6 +8,7 @@
 namespace Drupal\block\Theme;
 
 use Drupal\Core\Routing\RouteMatchInterface;
+use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\Theme\ThemeNegotiatorInterface;
 
 /**
@@ -16,10 +17,27 @@
 class AdminDemoNegotiator implements ThemeNegotiatorInterface {
 
   /**
+   * The current user.
+   *
+   * @var \Drupal\Core\Session\AccountInterface
+   */
+  protected $user;
+
+  /**
+   * Creates a new AdminDemoNegotiator instance.
+   *
+   * @param \Drupal\Core\Session\AccountInterface $user
+   *   The current user.
+   */
+  public function __construct(AccountInterface $user) {
+    $this->user = $user;
+  }
+
+  /**
    * {@inheritdoc}
    */
   public function applies(RouteMatchInterface $route_match) {
-    return $route_match->getRouteName() == 'block.admin_demo';
+    return $route_match->getRouteName() == 'block.admin_demo' && $this->user->hasPermission('administer blocks');
   }
 
   /**