.../src/Functional/EntityResource/Comment/CommentHalJsonTestBase.php | 2 +-
 core/modules/rest/src/EventSubscriber/ResourceResponseSubscriber.php | 5 +++--
 .../Functional/EntityResource/Comment/CommentResourceTestBase.php    | 2 +-
 .../tests/src/Functional/EntityResource/EntityResourceTestBase.php   | 3 +--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/core/modules/hal/tests/src/Functional/EntityResource/Comment/CommentHalJsonTestBase.php b/core/modules/hal/tests/src/Functional/EntityResource/Comment/CommentHalJsonTestBase.php
index f4b03af..7a40fd6 100644
--- a/core/modules/hal/tests/src/Functional/EntityResource/Comment/CommentHalJsonTestBase.php
+++ b/core/modules/hal/tests/src/Functional/EntityResource/Comment/CommentHalJsonTestBase.php
@@ -42,9 +42,9 @@
    * @todo fix in https://www.drupal.org/node/2824271
    */
   protected static $patchProtectedFieldNames = [
+    'status',
     'created',
     'changed',
-    'status',
     'thread',
     'entity_type',
     'field_name',
diff --git a/core/modules/rest/src/EventSubscriber/ResourceResponseSubscriber.php b/core/modules/rest/src/EventSubscriber/ResourceResponseSubscriber.php
index 34dff52..5cb887b 100644
--- a/core/modules/rest/src/EventSubscriber/ResourceResponseSubscriber.php
+++ b/core/modules/rest/src/EventSubscriber/ResourceResponseSubscriber.php
@@ -185,7 +185,7 @@ protected function flattenResponse(ResourceResponseInterface $response) {
     $final_response->setStatusCode($response->getStatusCode());
     $final_response->setProtocolVersion($response->getProtocolVersion());
     $final_response->setCharset($response->getCharset());
-    $final_response->headers->add($response->headers->all());
+    $final_response->headers = clone $response->headers;
     if ($final_response instanceof CacheableResponseInterface) {
       $final_response->addCacheableDependency($response->getCacheableMetadata());
     }
@@ -196,7 +196,8 @@ protected function flattenResponse(ResourceResponseInterface $response) {
    * {@inheritdoc}
    */
   public static function getSubscribedEvents() {
-    $events[KernelEvents::RESPONSE][] = ['onResponse'];
+    // Run shortly before \Drupal\Core\EventSubscriber\FinishResponseSubscriber.
+    $events[KernelEvents::RESPONSE][] = ['onResponse', 5];
     return $events;
   }
 
diff --git a/core/modules/rest/tests/src/Functional/EntityResource/Comment/CommentResourceTestBase.php b/core/modules/rest/tests/src/Functional/EntityResource/Comment/CommentResourceTestBase.php
index c4e45e1..b6935a1 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/Comment/CommentResourceTestBase.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/Comment/CommentResourceTestBase.php
@@ -28,6 +28,7 @@
    * {@inheritdoc}
    */
   protected static $patchProtectedFieldNames = [
+    'status',
     'pid',
     'entity_id',
     'uid',
@@ -35,7 +36,6 @@
     'homepage',
     'created',
     'changed',
-    'status',
     'thread',
     'entity_type',
     'field_name',
diff --git a/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php b/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
index 70b1de7..81cbdf5 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php
@@ -589,8 +589,7 @@ public function testPost() {
 
     // DX: 403 when entity contains field without 'edit' access.
     $response = $this->request('POST', $url, $request_options);
-    // @todo Add trailing period in https://www.drupal.org/node/2821013.
-    $this->assertResourceErrorResponse(403, "Access denied on creating field 'field_rest_test'", $response);
+    $this->assertResourceErrorResponse(403, "Access denied on creating field 'field_rest_test'.", $response);
 
 
     $request_options[RequestOptions::BODY] = $parseable_valid_request_body;