core/modules/shortcut/shortcut.module |  4 +-
 core/modules/toolbar/toolbar.module   | 89 ++++++++++++++++++++++++-----------
 core/modules/user/user.module         |  5 +-
 3 files changed, 64 insertions(+), 34 deletions(-)

diff --git a/core/modules/shortcut/shortcut.module b/core/modules/shortcut/shortcut.module
index e9d1619..89ee73e 100644
--- a/core/modules/shortcut/shortcut.module
+++ b/core/modules/shortcut/shortcut.module
@@ -413,10 +413,8 @@ function shortcut_preprocess_page(&$variables) {
  */
 function shortcut_toolbar() {
   $callback = 'shortcut_post_render_cache_render_toolbar_tray';
-  $token = \Drupal\Component\Utility\Crypt::randomBytesBase64(55);
   $context = array(
-    // @todo replace with drupal_render_cache_generate_token() after https://drupal.org/node/2099131 lands.
-    'token' => $token,
+    'token' => drupal_render_cache_generate_token(),
   );
 
   $items['shortcuts'] = array(
diff --git a/core/modules/toolbar/toolbar.module b/core/modules/toolbar/toolbar.module
index c013bf5..81d2e87 100644
--- a/core/modules/toolbar/toolbar.module
+++ b/core/modules/toolbar/toolbar.module
@@ -5,6 +5,7 @@
  * Administration toolbar for quick access to top level administration items.
  */
 
+use Drupal\Component\Utility\NestedArray;
 use Drupal\Core\Cache\Cache;
 use Drupal\Core\Language\Language;
 use Drupal\Core\Render\Element;
@@ -358,6 +359,59 @@ function toolbar_toolbar() {
     '#weight' => -20,
   );
 
+  // The administration element has a link that is themed to correspond to
+  // a toolbar tray. The tray contains the full administrative menu of the site.
+  $callback = 'toolbar_post_render_cache_render_toolbar_administration_tray';
+  $context = array(
+    'token' => drupal_render_cache_generate_token(),
+  );
+  $items['administration'] = array(
+    '#type' => 'toolbar_item',
+    'tab' => array(
+      '#type' => 'link',
+      '#title' => t('Manage'),
+      '#href' => 'admin',
+      '#attributes' => array(
+        'title' => t('Admin menu'),
+        'class' => array('toolbar-icon', 'toolbar-icon-menu'),
+        // A data attribute that indicates to the client to defer loading of
+        // the admin menu subtrees until this tab is activated. Admin menu
+        // subtrees will not render to the DOM if this attribute is removed.
+        // The value of the attribute is intentionally left blank. Only the
+        // presence of the attribute is necessary.
+        'data-drupal-subtrees' => '',
+      ),
+    ),
+    'tray' => array(
+      '#heading' => t('Administration menu'),
+      '#post_render_cache' => array(
+        $callback => array(
+          $context,
+        ),
+      ),
+      '#markup' => drupal_render_cache_generate_placeholder($callback, $context, $context['token']),
+    ),
+    '#weight' => -15,
+  );
+
+  return $items;
+}
+
+/**
+ * #post_render_cache callback; replaces placeholder with administration tray.
+ *
+ * Renders the administration toolbar tray.
+ *
+ * @param array $element
+ *   The renderable array containing the placeholder.
+ * @param array $context
+ *   An array with the following keys:
+ *   - token: the token to uniquely identify the placeholder
+ *
+ * @return array
+ *   The updated renderable array.
+ */
+function toolbar_post_render_cache_render_toolbar_administration_tray(array $element, array $context) {
   // Retrieve the administration menu from the database.
   $tree = toolbar_get_menu_tree();
 
@@ -367,8 +421,7 @@ function toolbar_toolbar() {
   /** @var \Drupal\menu_link\MenuTreeInterface $menu_tree */
   $menu_tree = \Drupal::service('menu_link.tree');
 
-  $menu = array(
-    '#heading' => t('Administration menu'),
+  $tray = array(
     'toolbar_administration' => array(
       '#type' => 'container',
       '#attributes' => array(
@@ -377,6 +430,11 @@ function toolbar_toolbar() {
       'administration_menu' => $menu_tree->renderTree($tree),
     ),
   );
+  $markup = drupal_render($tray);
+
+  $placeholder = drupal_render_cache_generate_placeholder(__FUNCTION__, $context, $context['token']);
+  $element['#markup'] = str_replace($placeholder, $markup, $element['#markup']);
+  $element['#cache']['tags'] = NestedArray::mergeDeep($element['#cache']['tags'], $tray['#cache']['tags']);
 
   // To conserve bandwidth, we only include the top-level links in the HTML.
   // The subtrees are fetched through a JSONP script that is generated at the
@@ -384,7 +442,7 @@ function toolbar_toolbar() {
   // script here with the hash parameter that is needed for that route.
   // @see toolbar_subtrees_jsonp()
   $langcode = \Drupal::languageManager()->getCurrentLanguage()->id;
-  $menu['toolbar_administration']['#attached']['js'][] = array(
+  $element['#attached']['js'][] = array(
     'type' => 'setting',
     'data' => array('toolbar' => array(
       'subtreesHash' => _toolbar_get_subtrees_hash($langcode),
@@ -392,30 +450,7 @@ function toolbar_toolbar() {
     )),
   );
 
-  // The administration element has a link that is themed to correspond to
-  // a toolbar tray. The tray contains the full administrative menu of the site.
-  $items['administration'] = array(
-    '#type' => 'toolbar_item',
-    'tab' => array(
-      '#type' => 'link',
-      '#title' => t('Manage'),
-      '#href' => 'admin',
-      '#attributes' => array(
-        'title' => t('Admin menu'),
-        'class' => array('toolbar-icon', 'toolbar-icon-menu'),
-        // A data attribute that indicates to the client to defer loading of
-        // the admin menu subtrees until this tab is activated. Admin menu
-        // subtrees will not render to the DOM if this attribute is removed.
-        // The value of the attribute is intentionally left blank. Only the
-        // presence of the attribute is necessary.
-        'data-drupal-subtrees' => '',
-      ),
-    ),
-    'tray' => $menu,
-    '#weight' => -15,
-  );
-
-  return $items;
+  return $element;
 }
 
 /**
diff --git a/core/modules/user/user.module b/core/modules/user/user.module
index 674868f..bb7fcbb 100644
--- a/core/modules/user/user.module
+++ b/core/modules/user/user.module
@@ -1604,15 +1604,12 @@ function user_file_download_access($field, EntityInterface $entity, File $file)
  */
 function user_toolbar() {
   $user = \Drupal::currentUser();
-  $tray = array();
 
   // Add logout & user account links or login link.
   if ($user->isAuthenticated()) {
     $callback = 'user_post_render_cache_render_toolbar_tray';
-    $token = \Drupal\Component\Utility\Crypt::randomBytesBase64(55);
     $context = array(
-      // @todo replace with drupal_render_cache_generate_token() after https://drupal.org/node/2099131 lands.
-      'token' => $token,
+      'token' => drupal_render_cache_generate_token(),
     );
 
     $tray = array(