diff --git a/core/modules/image/src/Controller/ImageStyleDownloadController.php b/core/modules/image/src/Controller/ImageStyleDownloadController.php
index 2b2d89f..838c18c 100644
--- a/core/modules/image/src/Controller/ImageStyleDownloadController.php
+++ b/core/modules/image/src/Controller/ImageStyleDownloadController.php
@@ -118,7 +118,15 @@ public function deliver(Request $request, $scheme, ImageStyleInterface $image_st
     // control access to the file.
     if ($scheme == 'private') {
       if (file_exists($derivative_uri)) {
-        return parent::download($request, $scheme);
+        $response = parent::download($request, $scheme);
+
+        if ($response instanceof BinaryFileResponse) {
+          $response->headers->add([
+            'Cache-Control' => 'private, must-revalidate',
+            'Expires' => \DateTime::createFromFormat('j-M-Y H:i:s T', '19-Nov-1978 05:00:00 GMT')->format('D, d M Y H:i:s T'),
+          ]);
+        }
+        return $response;
       }
       else {
         $headers = $this->moduleHandler()->invokeAll('file_download', array($image_uri));
diff --git a/core/modules/image/src/Tests/ImageFieldDisplayTest.php b/core/modules/image/src/Tests/ImageFieldDisplayTest.php
index ac9eebc..1e1d798 100644
--- a/core/modules/image/src/Tests/ImageFieldDisplayTest.php
+++ b/core/modules/image/src/Tests/ImageFieldDisplayTest.php
@@ -136,7 +136,7 @@ function _testImageFieldFormatters($scheme) {
       // Only verify HTTP headers when using private scheme and the headers are
       // sent by Drupal.
       $this->assertEqual($this->drupalGetHeader('Content-Type'), 'image/png', 'Content-Type header was sent.');
-      $this->assertTrue(strstr($this->drupalGetHeader('Cache-Control'),'public') !== FALSE, 'Cache-Control header was sent.');
+      $this->assertTrue(strstr($this->drupalGetHeader('Cache-Control'),'private') !== FALSE, 'Cache-Control header was sent.');
 
       // Log out and try to access the file.
       $this->drupalLogout();
diff --git a/core/modules/image/tests/modules/image_module_test/image_module_test.module b/core/modules/image/tests/modules/image_module_test/image_module_test.module
index 7be617e..df71375 100644
--- a/core/modules/image/tests/modules/image_module_test/image_module_test.module
+++ b/core/modules/image/tests/modules/image_module_test/image_module_test.module
@@ -10,11 +10,7 @@
 function image_module_test_file_download($uri) {
   $default_uri = \Drupal::state()->get('image.test_file_download') ?: FALSE;
   if ($default_uri == $uri) {
-    return [
-      'X-Image-Owned-By' => 'image_module_test',
-      'Cache-Control' => 'no-cache, must-revalidate, post-check=0, pre-check=0',
-      'Expires' => \DateTime::createFromFormat('j-M-Y H:i:s T', '19-Nov-1978 05:00:00 GMT')->format('D, d M Y H:i:s T'),
-    ];
+    return array('X-Image-Owned-By' => 'image_module_test');
   }
 }
 
diff --git a/core/modules/responsive_image/src/Tests/ResponsiveImageFieldDisplayTest.php b/core/modules/responsive_image/src/Tests/ResponsiveImageFieldDisplayTest.php
index f8357b1..410bd89 100644
--- a/core/modules/responsive_image/src/Tests/ResponsiveImageFieldDisplayTest.php
+++ b/core/modules/responsive_image/src/Tests/ResponsiveImageFieldDisplayTest.php
@@ -228,7 +228,7 @@ protected function doTestResponsiveImageFieldFormatters($scheme, $empty_styles =
       // Only verify HTTP headers when using private scheme and the headers are
       // sent by Drupal.
       $this->assertEqual($this->drupalGetHeader('Content-Type'), 'image/png', 'Content-Type header was sent.');
-      $this->assertTrue(strstr($this->drupalGetHeader('Cache-Control'), 'public') !== FALSE, 'Cache-Control header was sent.');
+      $this->assertTrue(strstr($this->drupalGetHeader('Cache-Control'), 'private') !== FALSE, 'Cache-Control header was sent.');
 
       // Log out and try to access the file.
       $this->drupalLogout();