diff -u b/paragraphs.install b/paragraphs.install
--- b/paragraphs.install
+++ b/paragraphs.install
@@ -26,16 +26,14 @@
 function paragraphs_update_8002(&$sandbox) {
   if (!isset($sandbox['progress'])) {
 
-    // Little trick to get the columns we need besides the ID.
-    $query = \Drupal::entityQueryAggregate('paragraph')
-      ->groupby('revision_id')
+    $query = \Drupal::entityQuery('paragraph')
       ->allRevisions();
 
     $paragraph_ids = $query->execute();
 
     $sandbox['progress'] = 0;
     $sandbox['max'] = count($paragraph_ids);
-    $sandbox['items'] = array_values($paragraph_ids);
+    $sandbox['items'] = array_keys($paragraph_ids);
     $sandbox['entity_types'] = array();
 
     $field_storage_configs = \Drupal::entityManager()->getStorage('field_storage_config')->loadByProperties(array('type' => 'entity_reference_revisions'));
@@ -58,7 +56,7 @@
     /* @var Paragraph $paragraph_revision */
     $paragraph_revision = \Drupal::entityManager()
       ->getStorage('paragraph')
-      ->loadRevision($handle_item['revision_id']);
+      ->loadRevision($handle_item);
 
     // Do a reverse lookup to find the matching entity.
     // This works by checking all entity_reference_revisions fields to
diff -u b/src/Entity/Paragraph.php b/src/Entity/Paragraph.php
--- b/src/Entity/Paragraph.php
+++ b/src/Entity/Paragraph.php
@@ -381,9 +381,8 @@
           // Host entity allows revision, load specific revision
           if ($revision_id_key) {
 
-            // Little trick to get the revision id.
-            $query = \Drupal::entityQueryAggregate($host_entity_type)
-              ->groupby($revision_id_key)
+            // Find the specific entity revision that's referencing our revision.
+            $query = \Drupal::entityQuery($host_entity_type)
               ->condition($host_entity_field_name . '.target_id', $this->id())
               ->condition($host_entity_field_name . '.target_revision_id', $this->getRevisionId())
               ->allRevisions()
@@ -391,15 +390,16 @@
 
             $host_ids = $query->execute();
             if (count($host_ids)) {
-              $host_id = reset($host_ids);
-              $host_entity = $controller->loadRevision($host_id[$revision_id_key]);
+              $revision_ids = array_keys($host_ids);
+              $host_revision_id = reset($revision_ids);
+              $host_entity = $controller->loadRevision($host_revision_id);
               if ($host_entity) {
                 $this->hostEntity = $host_entity;
                 $this->fetchedHostEntityDetails = TRUE;
               }
             }
           } else {
-            // No revisions, just lookup ID.
+            // No revisions, just find the entity that's referencing us.
             $query = \Drupal::entityQuery($host_entity_type)
               ->condition($host_entity_field_name . '.target_id', $this->id())
               ->condition($host_entity_field_name . '.target_revision_id', $this->getRevisionId())
diff -u b/src/ParagraphAccessControlHandler.php b/src/ParagraphAccessControlHandler.php
--- b/src/ParagraphAccessControlHandler.php
+++ b/src/ParagraphAccessControlHandler.php
@@ -29,14 +29,15 @@
 
     /* @var Paragraph $entity */
 
+    $parent_access = parent::checkAccess($entity, $operation, $account);
     // If parent says forbidden, don't even try anything else.
-    if (parent::checkAccess($entity, $operation, $account)->isForbidden()) {
-      return AccessResult::forbidden()->cacheUntilEntityChanges($entity);
+    if ($parent_access->isForbidden()) {
+      return $parent_access->addCacheableDependency($entity);
     }
 
     // If parent says allowed, don't even try anything else.
-    if (parent::checkAccess($entity, $operation, $account)->isAllowed()) {
-      return AccessResult::allowed()->cacheUntilEntityChanges($entity);
+    if ($parent_access->isAllowed()) {
+      return $parent_access->addCacheableDependency($entity);
     }
 
     // If neutral, continue checking.
@@ -57,13 +58,10 @@
       }
 
       // Check access on host entity.
-      if ($host_entity->access($check_parent_operation, $account)) {
-        return AccessResult::allowed()->cacheUntilEntityChanges($entity)->cacheUntilEntityChanges($host_entity);
-      } else {
-        return AccessResult::forbidden()->cacheUntilEntityChanges($entity)->cacheUntilEntityChanges($host_entity);
-      }
+      $host_entity_access = $host_entity->access($check_parent_operation, $account, TRUE);
+      return $host_entity_access->addCacheableDependency($entity);
     } else {
-      return AccessResult::forbidden()->cacheUntilEntityChanges($entity);
+      return AccessResult::forbidden()->addCacheableDependency($entity);
     }
   }
 
@@ -72,14 +70,16 @@
    */
   protected function checkCreateAccess(AccountInterface $account, array $context, $entity_bundle = NULL) {
 
+    $parent_access = parent::checkCreateAccess($account, $context, $entity_bundle);
+
     // If parent says forbidden, don't even try anything else.
-    if (parent::checkCreateAccess($account, $context, $entity_bundle)->isForbidden()) {
-      return AccessResult::forbidden();
+    if ($parent_access->isForbidden()) {
+      return $parent_access;
     }
 
     // If parent says allowed, don't even try anything else.
-    if (parent::checkCreateAccess($account, $context, $entity_bundle)->isAllowed()) {
-      return AccessResult::allowed();
+    if ($parent_access->isAllowed()) {
+      return $parent_access;
     }
 
     // If neutral, continue checking.
@@ -97,11 +97,7 @@
       }
 
       // Check access on host entity.
-      if ($host_entity->access($check_parent_operation, $account)) {
-        return AccessResult::allowed()->cacheUntilEntityChanges($host_entity);
-      } else {
-        return AccessResult::forbidden()->cacheUntilEntityChanges($host_entity);
-      }
+      return $host_entity->access($check_parent_operation, $account, TRUE);
 
     } else {