diff --git a/core/modules/workflows/src/WorkflowAccessControlHandler.php b/core/modules/workflows/src/WorkflowAccessControlHandler.php
index e3eb242..8cd9cb0 100644
--- a/core/modules/workflows/src/WorkflowAccessControlHandler.php
+++ b/core/modules/workflows/src/WorkflowAccessControlHandler.php
@@ -65,7 +65,7 @@ protected function checkAccess(EntityInterface $entity, $operation, AccountInter
         ->andIf(AccessResult::allowedIf(!$workflow_type->workflowStateHasData($entity, $workflow_type->getState($state_id))))
         ->addCacheableDependency($entity);
     }
-    if ($workflow_type->workflowHasData($entity)) {
+    if ($operation === 'delete' && $workflow_type->workflowHasData($entity)) {
       return AccessResult::neutral();
     }
     return parent::checkAccess($entity, $operation, $account);
diff --git a/core/modules/workflows/tests/src/Kernel/WorkflowAccessControlHandlerTest.php b/core/modules/workflows/tests/src/Kernel/WorkflowAccessControlHandlerTest.php
index 5108d94..2d97a50 100644
--- a/core/modules/workflows/tests/src/Kernel/WorkflowAccessControlHandlerTest.php
+++ b/core/modules/workflows/tests/src/Kernel/WorkflowAccessControlHandlerTest.php
@@ -251,6 +251,15 @@ public function checkAccessProvider() {
           ->addCacheContexts([]), // @todo, should these be uncacheable?
         ['foo' => FALSE],
       ],
+      'Admin can update workflow with data' => [
+        'with_data',
+        'adminUser',
+        'update',
+        AccessResult::allowed()
+          ->addCacheTags([])
+          ->addCacheContexts(['user.permissions']), // @todo, should these be uncacheable?
+        ['foo' => FALSE],
+      ],
     ];
   }