diff --git a/embargo.services.yml b/embargo.services.yml
index 4bcd728..f829a59 100644
--- a/embargo.services.yml
+++ b/embargo.services.yml
@@ -69,3 +69,7 @@ services:
       - '@entity_type.manager'
     tags:
       - { name: 'cache.context' }
+  embargo.page_cache_request_policy.deny_ip_dependent_response:
+    class: Drupal\embargo\PageCache\DenyIpDependentResponse
+    tags:
+      - { name: page_cache_response_policy }
diff --git a/modules/migrate_embargoes_to_embargo/src/Plugin/migrate/source/Entity.php b/modules/migrate_embargoes_to_embargo/src/Plugin/migrate/source/Entity.php
index 9ba8ddc..69d2d42 100644
--- a/modules/migrate_embargoes_to_embargo/src/Plugin/migrate/source/Entity.php
+++ b/modules/migrate_embargoes_to_embargo/src/Plugin/migrate/source/Entity.php
@@ -56,7 +56,7 @@ public static function create(
     array $configuration,
     $plugin_id,
     $plugin_definition,
-    MigrationInterface $migration = NULL,
+    ?MigrationInterface $migration = NULL,
   ) {
     return new static(
       $configuration,
diff --git a/src/Controller/IpRangeAccessExemptionController.php b/src/Controller/IpRangeAccessExemptionController.php
index 03e04fe..66d94d3 100644
--- a/src/Controller/IpRangeAccessExemptionController.php
+++ b/src/Controller/IpRangeAccessExemptionController.php
@@ -4,7 +4,6 @@
 
 use Drupal\Core\Cache\Cache;
 use Drupal\Core\Controller\ControllerBase;
-use Symfony\Component\DependencyInjection\ContainerInterface;
 use Symfony\Component\HttpFoundation\Request;
 
 /**
@@ -12,42 +11,20 @@
  */
 class IpRangeAccessExemptionController extends ControllerBase {
 
-  /**
-   * The HTTP request.
-   *
-   * @var \Symfony\Component\HttpFoundation\Request
-   */
-  protected $request;
-
-  /**
-   * Constructs an IP access denied controller.
-   *
-   * @param \Symfony\Component\HttpFoundation\Request|null $request
-   *   The current request.
-   */
-  public function __construct(Request $request = NULL) {
-    $this->request = $request;
-  }
-
-  /**
-   * {@inheritdoc}
-   */
-  public static function create(ContainerInterface $container) {
-    return new static(
-      $container->get('request_stack')->getCurrentRequest());
-  }
-
   /**
    * Formats a response for an IP access denied page.
    *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The request being served.
+   *
    * @return array
    *   Renderable array of markup for IP access denied.
    */
-  public function response() {
+  public function response(Request $request) : array {
     $ranges = [];
     $cache_tags = [];
     /** @var \Drupal\embargo\IpRangeInterface[] $entities */
-    $entities = $this->entityTypeManager()->getStorage('embargo_ip_range')->loadMultiple($this->request->query->all()['ranges'] ?? []);
+    $entities = $this->entityTypeManager()->getStorage('embargo_ip_range')->loadMultiple($request->query->all()['ranges'] ?? []);
     foreach ($entities as $entity) {
       $ranges[] = [
         'label' => $entity->label(),
@@ -58,7 +35,7 @@ public function response() {
 
     return [
       '#theme' => 'embargo_ip_access_exemption',
-      '#resources' => $this->request->query->all()['resources'] ?? [],
+      '#resources' => $request->query->all()['resources'] ?? [],
       '#ranges' => $ranges,
       '#contact_email' => $this->config('embargo.settings')->get('contact_email'),
       '#cache' => [
diff --git a/src/PageCache/DenyIpDependentResponse.php b/src/PageCache/DenyIpDependentResponse.php
new file mode 100644
index 0000000..e0f45f5
--- /dev/null
+++ b/src/PageCache/DenyIpDependentResponse.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace Drupal\embargo\PageCache;
+
+use Drupal\Core\Cache\RefinableCacheableDependencyInterface;
+use Drupal\Core\PageCache\ResponsePolicyInterface;
+use Drupal\Core\Routing\AccessAwareRouterInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Avoid page_cache when IP embargoes are in play.
+ *
+ * IP embargoes break the assumption made by page_cache that all anonymous
+ * requests are equivalent, so let's avoid allowing things to go to the
+ * page_cache for anonymous users when an access result has the
+ * `ip.embargo_range` (or wider `ip`) context.
+ */
+class DenyIpDependentResponse implements ResponsePolicyInterface {
+
+  /**
+   * Cache contexts of which the presence should suppress page_cache.
+   */
+  protected const IP_CONTEXTS = [
+    'ip.embargo_range',
+    // XXX: `ip.embargo_range` could be optimized away if the `ip` context
+    // itself is added, so let's also account for it.
+    'ip',
+  ];
+
+  /**
+   * {@inheritDoc}
+   */
+  public function check(Response $response, Request $request) : ?string {
+    if (!$request->attributes->has(AccessAwareRouterInterface::ACCESS_RESULT)) {
+      // No access result; unable to check.
+      return NULL;
+    }
+
+    /** @var \Drupal\Core\Access\AccessResultInterface $access_result */
+    $access_result = $request->attributes->get(AccessAwareRouterInterface::ACCESS_RESULT);
+
+    if (!($access_result instanceof RefinableCacheableDependencyInterface)) {
+      // Access result is not cacheable; unable to check cache contexts.
+      return NULL;
+    }
+
+    $cache_contexts = $access_result->getCacheContexts();
+
+    if (array_intersect(static::IP_CONTEXTS, $cache_contexts)) {
+      // Access result has relevant context; avoiding page cache.
+      return ResponsePolicyInterface::DENY;
+    }
+
+    // No candidate IP cache contexts present on access result; passing.
+    return NULL;
+  }
+
+}
diff --git a/src/Plugin/search_api/processor/EmbargoJoinProcessor.php b/src/Plugin/search_api/processor/EmbargoJoinProcessor.php
index 4083457..97718d5 100644
--- a/src/Plugin/search_api/processor/EmbargoJoinProcessor.php
+++ b/src/Plugin/search_api/processor/EmbargoJoinProcessor.php
@@ -104,7 +104,7 @@ public static function supportsIndex(IndexInterface $index) {
   /**
    * {@inheritdoc}
    */
-  public function getPropertyDefinitions(DatasourceInterface $datasource = NULL) : array {
+  public function getPropertyDefinitions(?DatasourceInterface $datasource = NULL) : array {
     $properties = [];
 
     if ($datasource === NULL) {
diff --git a/src/Plugin/search_api/processor/EmbargoProcessor.php b/src/Plugin/search_api/processor/EmbargoProcessor.php
index 6d31b28..5f9d3bf 100644
--- a/src/Plugin/search_api/processor/EmbargoProcessor.php
+++ b/src/Plugin/search_api/processor/EmbargoProcessor.php
@@ -88,7 +88,7 @@ public static function create(ContainerInterface $container, array $configuratio
   /**
    * {@inheritdoc}
    */
-  public function getPropertyDefinitions(DatasourceInterface $datasource = NULL) : array {
+  public function getPropertyDefinitions(?DatasourceInterface $datasource = NULL) : array {
     $properties = [];
 
     if ($datasource === NULL) {