core/core.services.yml                             |  1 +
 .../cacheability_safeguards.info.yml               |  7 -----
 .../config/src/Tests/ConfigImportAllTest.php       |  2 +-
 .../src/CacheabilityBubblingNodeGrantStorage.php   |  5 ++--
 .../src/NodeServiceProvider.php}                   | 32 +++++++---------------
 .../Tests/NodeAccessCacheabilitySafeguardTest.php  |  7 ++---
 .../node_access_test_auto_bubbling.info.yml        |  0
 .../node_access_test_auto_bubbling.routing.yml     |  0
 .../NodeAccessTestAutoBubblingController.php       |  0
 core/modules/system/system.install                 |  7 -----
 core/modules/user/src/UserServiceProvider.php      | 15 ++++++++++
 sites/default/default.services.yml                 |  2 ++
 12 files changed, 34 insertions(+), 44 deletions(-)

diff --git a/core/core.services.yml b/core/core.services.yml
index b3f4195..fc2695f 100644
--- a/core/core.services.yml
+++ b/core/core.services.yml
@@ -14,6 +14,7 @@ parameters:
       max-age: 0
       contexts: ['session', 'user']
       tags: []
+  cacheability_safeguards: true
   factory.keyvalue:
     default: keyvalue.database
   factory.keyvalue.expirable:
diff --git a/core/modules/cacheability_safeguards/cacheability_safeguards.info.yml b/core/modules/cacheability_safeguards/cacheability_safeguards.info.yml
deleted file mode 100644
index 94f3498..0000000
--- a/core/modules/cacheability_safeguards/cacheability_safeguards.info.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-name: Cacheability Safeguards
-type: module
-package: Core
-core: 8.x
-required: true
-hidden: true
-version: VERSION
diff --git a/core/modules/config/src/Tests/ConfigImportAllTest.php b/core/modules/config/src/Tests/ConfigImportAllTest.php
index 25099a9..6e1aaea 100644
--- a/core/modules/config/src/Tests/ConfigImportAllTest.php
+++ b/core/modules/config/src/Tests/ConfigImportAllTest.php
@@ -102,7 +102,7 @@ public function testInstallUninstall() {
 
     // Ensure that only core required modules and the install profile can not be uninstalled.
     $validation_reasons = \Drupal::service('module_installer')->validateUninstall(array_keys($all_modules));
-    $this->assertEqual(['cacheability_safeguards', 'standard', 'system', 'user'], array_keys($validation_reasons));
+    $this->assertEqual(['standard', 'system', 'user'], array_keys($validation_reasons));
 
     $modules_to_uninstall = array_filter($all_modules, function ($module) use ($validation_reasons) {
       // Filter required and not enabled modules.
diff --git a/core/modules/cacheability_safeguards/src/CacheabilityBubblingNodeGrantStorage.php b/core/modules/node/src/CacheabilityBubblingNodeGrantStorage.php
similarity index 96%
rename from core/modules/cacheability_safeguards/src/CacheabilityBubblingNodeGrantStorage.php
rename to core/modules/node/src/CacheabilityBubblingNodeGrantStorage.php
index 890e968..f543310 100644
--- a/core/modules/cacheability_safeguards/src/CacheabilityBubblingNodeGrantStorage.php
+++ b/core/modules/node/src/CacheabilityBubblingNodeGrantStorage.php
@@ -5,12 +5,10 @@
  * Contains \Drupal\cacheability_safeguards\CacheabilityBubblingNodeGrantStorage.
  */
 
-namespace Drupal\cacheability_safeguards;
+namespace Drupal\node;
 
 use Drupal\Core\DependencyInjection\DependencySerializationTrait;
 use Drupal\Core\Session\AccountInterface;
-use Drupal\node\NodeGrantDatabaseStorageInterface;
-use Drupal\node\NodeInterface;
 use Symfony\Component\DependencyInjection\ContainerAwareInterface;
 use Symfony\Component\DependencyInjection\ContainerAwareTrait;
 
@@ -33,6 +31,7 @@
  * @todo Remove before Drupal 9.0.0.
  *
  * @ingroup node_access
+ * @ingroup cacheability_safeguards
  */
 class CacheabilityBubblingNodeGrantStorage implements NodeGrantDatabaseStorageInterface, ContainerAwareInterface {
 
diff --git a/core/modules/cacheability_safeguards/src/CacheabilitySafeguardsServiceProvider.php b/core/modules/node/src/NodeServiceProvider.php
similarity index 32%
rename from core/modules/cacheability_safeguards/src/CacheabilitySafeguardsServiceProvider.php
rename to core/modules/node/src/NodeServiceProvider.php
index 78a8b37..8a0f6a2 100644
--- a/core/modules/cacheability_safeguards/src/CacheabilitySafeguardsServiceProvider.php
+++ b/core/modules/node/src/NodeServiceProvider.php
@@ -2,19 +2,19 @@
 
 /**
  * @file
- * Contains \Drupal\cacheability_safeguards\CacheContextSafeguardsServiceProvider.
+ * Contains \Drupal\node\NodeServiceProvider.
  */
 
-namespace Drupal\cacheability_safeguards;
+namespace Drupal\node;
 
 use Drupal\Core\DependencyInjection\ContainerBuilder;
 use Drupal\Core\DependencyInjection\ServiceModifierInterface;
 use Symfony\Component\DependencyInjection\Reference;
 
 /**
- * …
+ * Decorates the node grants storage service to bubble cacheability metadata.
  */
-class CacheabilitySafeguardsServiceProvider implements ServiceModifierInterface {
+class NodeServiceProvider implements ServiceModifierInterface {
 
   /**
    * {@inheritdoc}
@@ -25,25 +25,13 @@ public function alter(ContainerBuilder $container) {
       return;
     }
 
-    // Also make the 'user.permissions' cache context required.
-    if ($container->hasParameter('renderer.config')) {
-      $renderer_config = $container->getParameter('renderer.config');
-      if (!in_array('user.permissions', $renderer_config['required_cache_contexts'])) {
-        $renderer_config['required_cache_contexts'][] = 'user.permissions';
-        sort($renderer_config['required_cache_contexts']);
-      }
-      $container->setParameter('renderer.config', $renderer_config);
-    }
-
     // Automatically bubble the 'user.node_grants:$op' cache context.
-    if ($container->has('node.grant_storage')) {
-      $container->setDefinition('node.grant_storage.non_bubbling', $container->getDefinition('node.grant_storage'))
-        ->setPublic(FALSE);
-      $container->register('node.grant_storage')
-        ->setClass('\Drupal\cacheability_safeguards\CacheabilityBubblingNodeGrantStorage')
-        ->addArgument(new Reference('node.grant_storage.non_bubbling'))
-        ->addMethodCall('setContainer', [new Reference('service_container')]);
-    }
+    $container->setDefinition('node.grant_storage.non_bubbling', $container->getDefinition('node.grant_storage'))
+      ->setPublic(FALSE);
+    $container->register('node.grant_storage')
+      ->setClass('\Drupal\node\CacheabilityBubblingNodeGrantStorage')
+      ->addArgument(new Reference('node.grant_storage.non_bubbling'))
+      ->addMethodCall('setContainer', [new Reference('service_container')]);
   }
 
 }
diff --git a/core/modules/cacheability_safeguards/src/Tests/NodeAccessCacheabilitySafeguardTest.php b/core/modules/node/src/Tests/NodeAccessCacheabilitySafeguardTest.php
similarity index 91%
rename from core/modules/cacheability_safeguards/src/Tests/NodeAccessCacheabilitySafeguardTest.php
rename to core/modules/node/src/Tests/NodeAccessCacheabilitySafeguardTest.php
index 97628f1..b2f930e 100644
--- a/core/modules/cacheability_safeguards/src/Tests/NodeAccessCacheabilitySafeguardTest.php
+++ b/core/modules/node/src/Tests/NodeAccessCacheabilitySafeguardTest.php
@@ -2,20 +2,19 @@
 
 /**
  * @file
- * Contains \Drupal\cacheability_safeguards\Tests\NodeAccessCacheabilitySafeguardTest.
+ * Contains \Drupal\node\Tests\NodeAccessCacheabilitySafeguardTest.
  */
 
-namespace Drupal\cacheability_safeguards\Tests;
+namespace Drupal\node\Tests;
 
 use Drupal\Core\Url;
-use Drupal\node\Tests\NodeTestBase;
 
 /**
  * Tests the node access cacheability safeguard.
  *
- * @group cacheability_safeguards
  * @group node
  * @group Cache
+ * @group cacheability_safeguards
  */
 class NodeAccessCacheabilitySafeguardTest extends NodeTestBase {
 
diff --git a/core/modules/cacheability_safeguards/tests/node_access_test_auto_bubbling/node_access_test_auto_bubbling.info.yml b/core/modules/node/tests/node_access_test_auto_bubbling/node_access_test_auto_bubbling.info.yml
similarity index 100%
rename from core/modules/cacheability_safeguards/tests/node_access_test_auto_bubbling/node_access_test_auto_bubbling.info.yml
rename to core/modules/node/tests/node_access_test_auto_bubbling/node_access_test_auto_bubbling.info.yml
diff --git a/core/modules/cacheability_safeguards/tests/node_access_test_auto_bubbling/node_access_test_auto_bubbling.routing.yml b/core/modules/node/tests/node_access_test_auto_bubbling/node_access_test_auto_bubbling.routing.yml
similarity index 100%
rename from core/modules/cacheability_safeguards/tests/node_access_test_auto_bubbling/node_access_test_auto_bubbling.routing.yml
rename to core/modules/node/tests/node_access_test_auto_bubbling/node_access_test_auto_bubbling.routing.yml
diff --git a/core/modules/cacheability_safeguards/tests/node_access_test_auto_bubbling/src/Controller/NodeAccessTestAutoBubblingController.php b/core/modules/node/tests/node_access_test_auto_bubbling/src/Controller/NodeAccessTestAutoBubblingController.php
similarity index 100%
rename from core/modules/cacheability_safeguards/tests/node_access_test_auto_bubbling/src/Controller/NodeAccessTestAutoBubblingController.php
rename to core/modules/node/tests/node_access_test_auto_bubbling/src/Controller/NodeAccessTestAutoBubblingController.php
diff --git a/core/modules/system/system.install b/core/modules/system/system.install
index 29a28c7..ce06b7a 100644
--- a/core/modules/system/system.install
+++ b/core/modules/system/system.install
@@ -1268,10 +1268,3 @@ function system_update_8004() {
     $manager->updateEntityType($manager->getEntityType($entity_type_id));
   }
 }
-
-/**
- * Install the cache_context_safeguards module.
- */
-function system_update_8005() {
-  \Drupal::service('module_installer')->install(['cache_context_safeguards']);
-}
diff --git a/core/modules/user/src/UserServiceProvider.php b/core/modules/user/src/UserServiceProvider.php
index 9b61097..a8d5adb 100644
--- a/core/modules/user/src/UserServiceProvider.php
+++ b/core/modules/user/src/UserServiceProvider.php
@@ -25,6 +25,21 @@ class UserServiceProvider implements ServiceModifierInterface {
   public function alter(ContainerBuilder $container) {
     $container->setDefinition('password_original', $container->getDefinition('password'));
     $container->setDefinition('password', $container->getDefinition('password_migrate'));
+
+    // Allow sites to opt out from the cacheability safeguards.
+    if ($container->hasParameter('cacheability_safeguards') && $container->getParameter('cacheability_safeguards') === FALSE) {
+      return;
+    }
+
+    // Make the 'user.permissions' cache context required.
+    if ($container->hasParameter('renderer.config')) {
+      $renderer_config = $container->getParameter('renderer.config');
+      if (!in_array('user.permissions', $renderer_config['required_cache_contexts'])) {
+        $renderer_config['required_cache_contexts'][] = 'user.permissions';
+        sort($renderer_config['required_cache_contexts']);
+      }
+      $container->setParameter('renderer.config', $renderer_config);
+    }
   }
 
 }
diff --git a/sites/default/default.services.yml b/sites/default/default.services.yml
index 4ab0662..39c89b2 100644
--- a/sites/default/default.services.yml
+++ b/sites/default/default.services.yml
@@ -115,6 +115,8 @@ parameters:
       #
       # @default []
       tags: []
+  # Whether cacheability safeguards should be enabled or not.
+  cacheability_safeguards: true
   factory.keyvalue:
     {}
     # Default key/value storage service to use.