src/Controller/RequestHandler.php         | 1 +
 tests/src/Functional/ResourceTestBase.php | 5 ++---
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/Controller/RequestHandler.php b/src/Controller/RequestHandler.php
index d0e301a..b7444a6 100644
--- a/src/Controller/RequestHandler.php
+++ b/src/Controller/RequestHandler.php
@@ -88,6 +88,7 @@ class RequestHandler implements ContainerAwareInterface, ContainerInjectionInter
       ->executeInRenderContext($context, function () use ($resource, $action, $parameters, $extra_parameters) {
         return call_user_func_array([$resource, $action], array_merge($parameters, $extra_parameters));
       });
+    $response->getCacheableMetadata()->addCacheContexts(static::$requiredCacheContexts);
     if (!$context->isEmpty()) {
       $response->addCacheableDependency($context->pop());
     }
diff --git a/tests/src/Functional/ResourceTestBase.php b/tests/src/Functional/ResourceTestBase.php
index dcfa79c..902bc6c 100644
--- a/tests/src/Functional/ResourceTestBase.php
+++ b/tests/src/Functional/ResourceTestBase.php
@@ -306,8 +306,7 @@ abstract class ResourceTestBase extends BrowserTestBase {
       'url.query_args:sort',
       // Drupal defaults.
       'url.site',
-      // @todo Figure out why this is no longer among the response's cache contexts.
-      // 'user.permissions',
+      'user.permissions',
     ];
   }
 
@@ -615,7 +614,7 @@ abstract class ResourceTestBase extends BrowserTestBase {
     ];
     $this->assertResourceResponse(403, Json::encode($expected), $response);
     /* $this->assertResourceErrorResponse(403, "The current user is not allowed to GET the selected resource." . (strlen($reason) ? ' ' . $reason : ''), $response, '/data'); */
-    // @todo investigate this more (cache tags + contexts), cfr https://www.drupal.org/project/drupal/issues/2626298 + https://www.drupal.org/project/jsonapi/issues/2933939
+    // @todo Uncomment in https://www.drupal.org/project/jsonapi/issues/2929428.
     /* $this->assertResourceResponse(403, Json::encode($expected), $response, $expected_403_cacheability->getCacheTags(), $expected_403_cacheability->getCacheContexts(), FALSE, 'MISS'); */
     $this->assertArrayNotHasKey('Link', $response->getHeaders());