core/modules/big_pipe/big_pipe.module                            | 6 +++---
 core/modules/big_pipe/src/Render/Placeholder/BigPipeStrategy.php | 7 +++++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/core/modules/big_pipe/big_pipe.module b/core/modules/big_pipe/big_pipe.module
index 724cd1c..0fdda3d 100644
--- a/core/modules/big_pipe/big_pipe.module
+++ b/core/modules/big_pipe/big_pipe.module
@@ -10,7 +10,7 @@
  */
 
 use Drupal\Core\Form\FormStateInterface;
-use Drupal\Core\Render\SafeString;
+use Drupal\Core\Render\Markup;
 
 /**
  * Implements hook_js_settings_alter().
@@ -47,8 +47,8 @@ function big_pipe_form_after_build($form, FormStateInterface $form_state) {
   // big_pipe_has_js is send with '0', else it is not send at all and FAPI falls
   // back to the default value, which is '1'.
   $form['big_pipe_has_js']['#value'] = '0';
-  $form['big_pipe_has_js']['#prefix'] = SafeString::create('<noscript>');
-  $form['big_pipe_has_js']['#suffix'] = SafeString::create('</noscript>');
+  $form['big_pipe_has_js']['#prefix'] = Markup::create('<noscript>');
+  $form['big_pipe_has_js']['#suffix'] = Markup::create('</noscript>');
   return $form;
 }
 
diff --git a/core/modules/big_pipe/src/Render/Placeholder/BigPipeStrategy.php b/core/modules/big_pipe/src/Render/Placeholder/BigPipeStrategy.php
index 2cfacf5..c0f469e 100644
--- a/core/modules/big_pipe/src/Render/Placeholder/BigPipeStrategy.php
+++ b/core/modules/big_pipe/src/Render/Placeholder/BigPipeStrategy.php
@@ -60,14 +60,17 @@ public function processPlaceholders(array $placeholders) {
       // Blacklist some #lazy_builder callbacks.
       // @todo Use #create_placeholder_options instead.
       if (isset($placeholder_elements['#lazy_builder'][0])) {
-        // Route CSRF tokens and form actions are (part of) HTML attributes, not
-        // HTML.
+        // Route CSRF tokens, form CSRF token and form actions are (part of)
+        // HTML attributes, not HTML.
         if ($placeholder_elements['#lazy_builder'][0] == 'route_processor_csrf:renderPlaceholderCsrfToken') {
           continue;
         }
         elseif ($placeholder_elements['#lazy_builder'][0] == 'form_builder:renderPlaceholderFormAction') {
           continue;
         }
+        elseif ($placeholder_elements['#lazy_builder'][0] == 'form_builder:renderFormTokenPlaceholder') {
+          continue;
+        }
         // The messages element is not able to update the session when BigPipe runs.
         elseif ($placeholder_elements['#lazy_builder'][0] == 'Drupal\Core\Render\Element\StatusMessages::renderMessages') {
           continue;