core/modules/node/node.module                      |  10 --
 core/modules/node/node.services.yml                |   7 +-
 .../src/CacheabilityBubblingNodeGrantStorage.php   | 122 +++++++++++++++++++++
 .../NodeAccessTestAutoBubblingController.php       |   7 +-
 4 files changed, 133 insertions(+), 13 deletions(-)

diff --git a/core/modules/node/node.module b/core/modules/node/node.module
index 9dfed9a..7c371d6 100644
--- a/core/modules/node/node.module
+++ b/core/modules/node/node.module
@@ -1064,16 +1064,6 @@ function node_query_node_access_alter(AlterableInterface $query) {
 
   // Update the query for the given storage method.
   \Drupal::service('node.grant_storage')->alterQuery($query, $tables, $op, $account, $base_table);
-
-  // Bubble the 'user.node_grants:$op' cache context to the current render
-  // context.
-  // @see \Drupal\Core\Render\MetadataBubblingUrlGenerator::bubble()
-  // @todo Remove before Drupal 9.0.0.
-  $renderer = \Drupal::service('renderer');
-  if ($renderer->hasRenderContext()) {
-    $build = ['#cache' => ['contexts' => ['user.node_grants:' . $op]]];
-    $renderer->render($build);
-  }
 }
 
 /**
diff --git a/core/modules/node/node.services.yml b/core/modules/node/node.services.yml
index 2ff32c3..fcf2866 100644
--- a/core/modules/node/node.services.yml
+++ b/core/modules/node/node.services.yml
@@ -3,11 +3,16 @@ services:
     class: Drupal\node\Routing\RouteSubscriber
     tags:
       - { name: event_subscriber }
-  node.grant_storage:
+  node.grant_storage.non_bubbling:
     class: Drupal\node\NodeGrantDatabaseStorage
     arguments: ['@database', '@module_handler', '@language_manager']
+    public: false
     tags:
       - { name: backend_overridable }
+  node.grant_storage:
+    class: Drupal\node\CacheabilityBubblingNodeGrantStorage
+    parent: container.trait
+    arguments: ['@node.grant_storage.non_bubbling']
   access_check.node.revision:
     class: Drupal\node\Access\NodeRevisionAccessCheck
     arguments: ['@entity.manager']
diff --git a/core/modules/node/src/CacheabilityBubblingNodeGrantStorage.php b/core/modules/node/src/CacheabilityBubblingNodeGrantStorage.php
new file mode 100644
index 0000000..60b6d90
--- /dev/null
+++ b/core/modules/node/src/CacheabilityBubblingNodeGrantStorage.php
@@ -0,0 +1,122 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\node\NodeGrantDatabaseStorage.
+ */
+
+namespace Drupal\node;
+
+use Drupal\Core\DependencyInjection\DependencySerializationTrait;
+use Drupal\Core\Session\AccountInterface;
+use Symfony\Component\DependencyInjection\ContainerAwareInterface;
+use Symfony\Component\DependencyInjection\ContainerAwareTrait;
+
+/**
+ * Decorator for node grants storage, which bubbles access grants cacheability.
+ *
+ * Code that performs a node_access query should explicitly add the
+ * 'user.node_grants:$op' cache context to the render element or
+ * \Drupal\Core\Cache\CacheableDependencyInterface object that is affected by
+ * the query. Doing so ensures that the context is attached to the most
+ * appropriate element or object. However, since cache contexts are new to
+ * Drupal 8, to safeguard route controllers or other code that forget to do
+ * this, this decorator also adds it to the current render context.
+ *
+ * The renderer is not injected to avoid initializing the render and theme
+ * system for REST routes. Instead, this service is container-aware.
+ *
+ * @see \Drupal\Core\Render\MetadataBubblingUrlGenerator
+ *
+ * @todo Remove before Drupal 9.0.0.
+ *
+ * @ingroup node_access
+ */
+class CacheabilityBubblingNodeGrantStorage implements NodeGrantDatabaseStorageInterface, ContainerAwareInterface {
+
+  use ContainerAwareTrait;
+  use DependencySerializationTrait;
+
+  /**
+   * The non-bubbling node grant storage.
+   *
+   * @var \Drupal\node\NodeGrantDatabaseStorageInterface
+   */
+  protected $nodeGrantStorage;
+
+  /**
+   * Constructs a CacheabilityBubblingNodeGrantStorage object.
+   *
+   * @param \Drupal\node\NodeGrantDatabaseStorageInterface $node_grant_storage
+   *   The non-bubbling node grant storage.
+   */
+  public function __construct(NodeGrantDatabaseStorageInterface $node_grant_storage) {
+    $this->nodeGrantStorage = $node_grant_storage;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function access(NodeInterface $node, $operation, $langcode, AccountInterface $account) {
+    return $this->nodeGrantStorage->access($node, $operation, $langcode, $account);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function checkAll(AccountInterface $account) {
+    return $this->nodeGrantStorage->checkAll($account);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function alterQuery($query, array $tables, $op, AccountInterface $account, $base_table) {
+    // Bubble the 'user.node_grants:$op' cache context to the current render
+    // context.
+    /** @var \Drupal\Core\Render\RendererInterface $renderer */
+    $renderer = $this->container->get('renderer');
+    if ($renderer->hasRenderContext()) {
+      $build = ['#cache' => ['contexts' => ['user.node_grants:' . $op]]];
+      $renderer->render($build);
+    }
+
+    return $this->nodeGrantStorage->alterQuery($query, $tables, $op, $account, $base_table);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function write(NodeInterface $node, array $grants, $realm = NULL, $delete = TRUE) {
+    return $this->nodeGrantStorage->write($node, $grants, $realm, $delete);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function delete() {
+    return $this->nodeGrantStorage->delete();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function writeDefault() {
+    return $this->nodeGrantStorage->writeDefault();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function count() {
+    return $this->nodeGrantStorage->count();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function deleteNodeRecords(array $nids) {
+    return $this->nodeGrantStorage->deleteNodeRecords($nids);
+  }
+
+}
diff --git a/core/modules/node/tests/modules/node_access_test_auto_bubbling/src/Controller/NodeAccessTestAutoBubblingController.php b/core/modules/node/tests/modules/node_access_test_auto_bubbling/src/Controller/NodeAccessTestAutoBubblingController.php
index 4549f91..c7788d0 100644
--- a/core/modules/node/tests/modules/node_access_test_auto_bubbling/src/Controller/NodeAccessTestAutoBubblingController.php
+++ b/core/modules/node/tests/modules/node_access_test_auto_bubbling/src/Controller/NodeAccessTestAutoBubblingController.php
@@ -44,7 +44,10 @@ public static function create(ContainerInterface $container) {
   }
 
   /**
-   * Lists the three latest node IDs.
+   * Lists the three latest published node IDs.
+   *
+   * @return array
+   *   A render array.
    */
   public function latest() {
     $nids = $this->entityQuery->get('node')
@@ -53,7 +56,7 @@ public function latest() {
       ->range(0, 3)
       ->addTag('node_access')
       ->execute();
-    return ['#markup' => $this->t('The five latest nodes are: !nids.', ['!nids' => implode(', ', $nids)])];
+    return ['#markup' => $this->t('The three latest nodes are: !nids.', ['!nids' => implode(', ', $nids)])];
   }
 
 }