.../src/EventSubscriber/SmartCacheSubscriber.php        | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/core/modules/smart_cache/src/EventSubscriber/SmartCacheSubscriber.php b/core/modules/smart_cache/src/EventSubscriber/SmartCacheSubscriber.php
index 9f9fe33..2639134 100644
--- a/core/modules/smart_cache/src/EventSubscriber/SmartCacheSubscriber.php
+++ b/core/modules/smart_cache/src/EventSubscriber/SmartCacheSubscriber.php
@@ -178,10 +178,25 @@ public function onResponse(FilterResponseEvent $event) {
       return;
     }
 
+    // Don't cache the HTML response if SmartCache's request subscriber did not
+    // fire, because that means it's impossible to have a SmartCache cache hit.
+    // (This can happen when the master request is for example a 403 or 404, in
+    // which case a subrequest is performed by the router. In that case, it is
+    // the subrequest's response that is cached by SmartCache, because the
+    // routing happens in a request subscriber earlier than SmartCache's and
+    // immediately sets a response, i.e. the one returned by the subrequest, and
+    // thus causes SmartCache's request subscriber to not fire for the master
+    // request.)
+    // @see \Drupal\Core\Routing\AccessAwareRouter::checkAccess()
+    // @see \Drupal\Core\EventSubscriber\DefaultExceptionHtmlSubscriber::on403()
+    $request = $event->getRequest();
+    if (!$request->attributes->has(self::ATTRIBUTE_REQUEST_POLICY_RESULT)) {
+      return;
+    }
+
     // Don't cache the HTML response if the SmartCache request & response
     // policies are not met.
     // @see onRouteMatch()
-    $request = $event->getRequest();
     if ($request->attributes->get(self::ATTRIBUTE_REQUEST_POLICY_RESULT) === RequestPolicyInterface::DENY || $this->responsePolicy->check($response, $request) === ResponsePolicyInterface::DENY) {
       return;
     }