diff --git a/core/modules/user/config/user.password_reset.yml b/core/modules/user/config/user.password_reset.yml
new file mode 100644
index 0000000..74b71b2
--- /dev/null
+++ b/core/modules/user/config/user.password_reset.yml
@@ -0,0 +1 @@
+timeout: '86400'
diff --git a/core/modules/user/lib/Drupal/user/Tests/UserPasswordResetTest.php b/core/modules/user/lib/Drupal/user/Tests/UserPasswordResetTest.php
index 96ac5de..cc9a431 100644
--- a/core/modules/user/lib/Drupal/user/Tests/UserPasswordResetTest.php
+++ b/core/modules/user/lib/Drupal/user/Tests/UserPasswordResetTest.php
@@ -41,10 +41,8 @@ function testUserPasswordReset() {
    * Attempts login using an expired password reset link.
    */
   function testUserPasswordResetExpired() {
-    // Set password reset timeout variable to 43200 seconds = 12 hours.
-    $timeout = 43200;
-    variable_set('user_password_reset_timeout', $timeout);
-
+    // Set password reset timeout to 43200 seconds = 12 hours.
+    config('user.password_reset')->set('timeout', 43200)->save();
     // Create a user.
     $account = $this->drupalCreateUser();
     $this->drupalLogin($account);
@@ -54,7 +52,8 @@ function testUserPasswordResetExpired() {
 
     // To attempt an expired password reset, create a password reset link as if
     // its request time was 60 seconds older than the allowed limit of timeout.
-    $bogus_timestamp = REQUEST_TIME - variable_get('user_password_reset_timeout', 86400) - 60;
+    $timeout = config('user.password_reset')->get('timeout');
+    $bogus_timestamp = REQUEST_TIME - $timeout - 60;
     $this->drupalGet("user/reset/$account->uid/$bogus_timestamp/" . user_pass_rehash($account->pass, $bogus_timestamp, $account->login));
     $this->assertText(t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'), 'Expired password reset request rejected.');
   }
diff --git a/core/modules/user/user.install b/core/modules/user/user.install
index 492f1e0..cb08ee2 100644
--- a/core/modules/user/user.install
+++ b/core/modules/user/user.install
@@ -599,5 +599,16 @@ function user_update_8009(&$sandbox) {
 }
 
 /**
+ * Updates user_password_reset_timeout variable to config.
+ *
+ * @ingroup config_upgrade
+ */
+function user_update_8010() {
+  update_variables_to_config('user.password_reset', array(
+    'user_password_reset_timeout' => 'timeout',
+  ));
+}
+
+/**
  * @} End of "addtogroup updates-7.x-to-8.x".
  */
diff --git a/core/modules/user/user.pages.inc b/core/modules/user/user.pages.inc
index 90d804e..bb5af60 100644
--- a/core/modules/user/user.pages.inc
+++ b/core/modules/user/user.pages.inc
@@ -119,9 +119,8 @@ function user_pass_reset($form, &$form_state, $uid, $timestamp, $hashed_pass, $a
     drupal_goto();
   }
   else {
-    // Time out, in seconds, until login URL expires. Defaults to 24 hours =
-    // 86400 seconds.
-    $timeout = variable_get('user_password_reset_timeout', 86400);
+    // Time out, in seconds, until login URL expires.
+    $timeout = config('user.password_reset')->get('timeout');
     $current = REQUEST_TIME;
     $account = user_load($uid);
     // Verify that the user exists and is active.