diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php
index e984d13..6b20bf1 100644
--- a/core/lib/Drupal/Core/Form/FormBuilder.php
+++ b/core/lib/Drupal/Core/Form/FormBuilder.php
@@ -679,9 +679,13 @@ public function prepareForm($form_id, &$form, FormStateInterface &$form_state) {
       $form['#method'] = 'get';
     }
 
-    // Get forms should not get CSRF Tokens.
+    // GET forms should not use a CSRF token..
     if (isset($form['#method']) && $form['#method'] === 'get') {
-      $form['#token'] = FALSE;
+      // Merges in a default, this means if you've explicitly have set #token to
+      // the $form_id on a GET form, which we don't recommend, it will work.
+      $form += [
+        '#token' => FALSE,
+      ];
     }
 
     // Generate a new #build_id for this form, if none has been set already.