diff --git a/core/modules/block/block.services.yml b/core/modules/block/block.services.yml
index fe20e4a..960eb37 100644
--- a/core/modules/block/block.services.yml
+++ b/core/modules/block/block.services.yml
@@ -1,6 +1,7 @@
 services:
   theme.negotiator.block.admin_demo:
     class: Drupal\block\Theme\AdminDemoNegotiator
+    arguments: ['@current_user']
     tags:
       - { name: theme_negotiator, priority: 1000 }
   block.page_display_variant_subscriber:
diff --git a/core/modules/block/src/Tests/BlockAdminThemeTest.php b/core/modules/block/src/Tests/BlockAdminThemeTest.php
index 52a51da..7bcafe8 100644
--- a/core/modules/block/src/Tests/BlockAdminThemeTest.php
+++ b/core/modules/block/src/Tests/BlockAdminThemeTest.php
@@ -42,5 +42,10 @@ function testAdminTheme() {
     $this->drupalPostForm('admin/appearance', $edit, t('Save configuration'));
     $this->drupalGet('admin/structure/block/list/bartik');
     $this->assertResponse(200);
+
+    // Ensure that when access is denied, the default theme is shown instead.
+    $this->drupalLogout();
+    $this->drupalGet('admin/structure/block/demo/bartik');
+    $this->assertRaw('core/themes/classy');
   }
 }
diff --git a/core/modules/block/src/Theme/AdminDemoNegotiator.php b/core/modules/block/src/Theme/AdminDemoNegotiator.php
index 50d88c3..b2f5e12 100644
--- a/core/modules/block/src/Theme/AdminDemoNegotiator.php
+++ b/core/modules/block/src/Theme/AdminDemoNegotiator.php
@@ -8,6 +8,7 @@
 namespace Drupal\block\Theme;
 
 use Drupal\Core\Routing\RouteMatchInterface;
+use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\Theme\ThemeNegotiatorInterface;
 
 /**
@@ -16,10 +17,27 @@
 class AdminDemoNegotiator implements ThemeNegotiatorInterface {
 
   /**
+   * The current user.
+   *
+   * @var \Drupal\Core\Session\AccountInterface
+   */
+  protected $user;
+
+  /**
+   * Creates a new AdminDemoNegotiator instance.
+   *
+   * @param \Drupal\Core\Session\AccountInterface $user
+   *   The current user.
+   */
+  public function __construct(AccountInterface $user) {
+    $this->user = $user;
+  }
+
+  /**
    * {@inheritdoc}
    */
   public function applies(RouteMatchInterface $route_match) {
-    return $route_match->getRouteName() == 'block.admin_demo';
+    return $route_match->getRouteName() == 'block.admin_demo' && $this->user->hasPermission('administer blocks');
   }
 
   /**