diff --git a/src/RequestHandler.php b/src/RequestHandler.php
index 239df58..e3f8a10 100644
--- a/src/RequestHandler.php
+++ b/src/RequestHandler.php
@@ -145,9 +145,10 @@ class RequestHandler implements ContainerAwareInterface, ContainerInjectionInter
         $request,
         $cacheable_metadata
       ) {
-        // The serializer modifies the $cacheable_metadata, which is referenced
-        // by the $response object, effectively adding the metadata to the
-        // response.
+        // The serializer receives the response's cacheability metadata object
+        // as serialization context. Normalizers called by the serializer then
+        // refine this cacheability metadata, and thus they are effectively
+        // updating the response object's cacheability.
         return $serializer->serialize($data, $format, ['request' => $request, 'cacheable_metadata' => $cacheable_metadata]);
       });
     $error_handler->restore();
diff --git a/src/Resource/EntityResource.php b/src/Resource/EntityResource.php
index 5b8d7c4..4ccda94 100644
--- a/src/Resource/EntityResource.php
+++ b/src/Resource/EntityResource.php
@@ -262,6 +262,11 @@ class EntityResource implements EntityResourceInterface {
     }
     $entity_collection = new EntityCollection(array_column($collection_data, 'entity'));
     $response = $this->buildWrappedResponse($entity_collection);
+
+    $access_info = array_column($collection_data, 'access');
+    array_walk($access_info, function ($access) use ($response) {
+      $response->addCacheableDependency($access);
+    });
     // $response does not contain the entity list cache tag. We add the
     // cacheable metadata for the finite list of entities in the relationship.
     $response->addCacheableDependency($cacheable_metadata);