core/lib/Drupal/Core/CoreServiceProvider.php       |  3 ++
 .../Compiler/CacheabilitySafeguardsPass.php        | 49 ++++++++++++++++++++++
 core/modules/node/node.services.yml                |  1 +
 core/modules/node/src/NodeServiceProvider.php      | 40 ------------------
 4 files changed, 53 insertions(+), 40 deletions(-)

diff --git a/core/lib/Drupal/Core/CoreServiceProvider.php b/core/lib/Drupal/Core/CoreServiceProvider.php
index 7b83fc2..6fab50d 100644
--- a/core/lib/Drupal/Core/CoreServiceProvider.php
+++ b/core/lib/Drupal/Core/CoreServiceProvider.php
@@ -10,6 +10,7 @@
 use Drupal\Core\Cache\Context\CacheContextsPass;
 use Drupal\Core\Cache\ListCacheBinsPass;
 use Drupal\Core\DependencyInjection\Compiler\BackendCompilerPass;
+use Drupal\Core\DependencyInjection\Compiler\CacheabilitySafeguardsPass;
 use Drupal\Core\DependencyInjection\Compiler\GuzzleMiddlewarePass;
 use Drupal\Core\DependencyInjection\Compiler\ContextProvidersPass;
 use Drupal\Core\DependencyInjection\Compiler\ProxyServicesPass;
@@ -100,6 +101,8 @@ public function register(ContainerBuilder $container) {
     $container->addCompilerPass(new PluginManagerPass());
 
     $container->addCompilerPass(new DependencySerializationTraitPass());
+
+    $container->addCompilerPass(new CacheabilitySafeguardsPass(), PassConfig::TYPE_BEFORE_REMOVING);
   }
 
   /**
diff --git a/core/lib/Drupal/Core/DependencyInjection/Compiler/CacheabilitySafeguardsPass.php b/core/lib/Drupal/Core/DependencyInjection/Compiler/CacheabilitySafeguardsPass.php
new file mode 100644
index 0000000..ffe70e0
--- /dev/null
+++ b/core/lib/Drupal/Core/DependencyInjection/Compiler/CacheabilitySafeguardsPass.php
@@ -0,0 +1,49 @@
+<?php
+
+/**
+ * @file
+ * Contains \Drupal\Core\DependencyInjection\Compiler\TaggedHandlersPass.
+ */
+
+namespace Drupal\Core\DependencyInjection\Compiler;
+
+use Symfony\Component\DependencyInjection\Compiler\CompilerPassInterface;
+use Symfony\Component\DependencyInjection\ContainerBuilder;
+use Symfony\Component\DependencyInjection\Reference;
+
+/**
+ * Decorates the 'cacheability_safeguard'-tagged services.
+ */
+class CacheabilitySafeguardsPass implements CompilerPassInterface {
+
+  /**
+   * {@inheritdoc}
+   *
+   * Always ensures a non-safeguarded service is available, so that modules can
+   * rely on the non-bubbling service being present, if they are already taking
+   * care of ensuring correct cacheability.
+   */
+  public function process(ContainerBuilder $container) {
+    // Allow sites to opt out from the cacheability safeguards.
+    $guard_down = $container->hasParameter('renderer.cacheability_safeguards') && $container->getParameter('renderer.cacheability_safeguards') === FALSE;
+
+    foreach ($container->findTaggedServiceIds('cacheability_safeguard') as $id => $attributes) {
+      $decorated = $id . '.non_bubbling';
+
+      if ($guard_down) {
+        // Provide an aliases to the non-safeguarded (non-bubbling) service, to
+        // ensure the non-bubbling service is always available.
+        $container->setAlias($decorated, $id);
+      }
+      else {
+        $container->setDefinition($decorated, $container->getDefinition($id))
+          ->setPublic(FALSE);
+        $container->register($id)
+          ->setClass($attributes[0]['class'])
+          ->addArgument(new Reference($decorated))
+          ->addMethodCall('setContainer', [new Reference('service_container')]);
+      }
+    }
+  }
+
+}
diff --git a/core/modules/node/node.services.yml b/core/modules/node/node.services.yml
index 2ff32c3..829f46c 100644
--- a/core/modules/node/node.services.yml
+++ b/core/modules/node/node.services.yml
@@ -8,6 +8,7 @@ services:
     arguments: ['@database', '@module_handler', '@language_manager']
     tags:
       - { name: backend_overridable }
+      - { name: cacheability_safeguard, class: 'Drupal\node\CacheabilityBubblingNodeGrantStorage' }
   access_check.node.revision:
     class: Drupal\node\Access\NodeRevisionAccessCheck
     arguments: ['@entity.manager']
diff --git a/core/modules/node/src/NodeServiceProvider.php b/core/modules/node/src/NodeServiceProvider.php
deleted file mode 100644
index b1f18c9..0000000
--- a/core/modules/node/src/NodeServiceProvider.php
+++ /dev/null
@@ -1,40 +0,0 @@
-<?php
-
-/**
- * @file
- * Contains \Drupal\node\NodeServiceProvider.
- */
-
-namespace Drupal\node;
-
-use Drupal\Core\DependencyInjection\ContainerBuilder;
-use Drupal\Core\DependencyInjection\ServiceModifierInterface;
-use Symfony\Component\DependencyInjection\Reference;
-
-/**
- * Decorates the node grants storage service to bubble cacheability metadata.
- */
-class NodeServiceProvider implements ServiceModifierInterface {
-
-  /**
-   * {@inheritdoc}
-   */
-  public function alter(ContainerBuilder $container) {
-    $container->setAlias('node.grant_storage.non_bubbling', 'node.grant_storage');
-
-    // Allow sites to opt out from the cacheability safeguards.
-    if ($container->hasParameter('renderer.cacheability_safeguards') && $container->getParameter('renderer.cacheability_safeguards') === FALSE) {
-      return;
-    }
-
-    // Automatically bubble the 'user.node_grants:$op' cache context.
-    $container->setDefinition('node.grant_storage.non_bubbling', $container->getDefinition('node.grant_storage'))
-      ->setPublic(FALSE);
-    $container->register('node.grant_storage')
-      ->setClass('\Drupal\node\CacheabilityBubblingNodeGrantStorage')
-      ->addArgument(new Reference('node.grant_storage.non_bubbling'))
-      ->addMethodCall('setContainer', [new Reference('service_container')]);
-  }
-
-}
-