diff --git a/core/modules/media/media.install b/core/modules/media/media.install
index b16b348cd413ddaa4c829b232e0c34ca07273154..87aeb360a0c295d3b244c4d3e6e46dc368dccf42 100644
--- a/core/modules/media/media.install
+++ b/core/modules/media/media.install
@@ -5,6 +5,8 @@
  * Install, uninstall and update hooks for Media module.
  */
 
+use \Drupal\user\RoleInterface;
+
 /**
  * Implements hook_install().
  */
@@ -17,6 +19,12 @@ function media_install() {
   foreach ($files as $file) {
     file_unmanaged_copy($file->uri, $destination, FILE_EXISTS_ERROR);
   }
+
+  // Grant the "view media" permission to all users by default.
+  if (\Drupal::moduleHandler()->moduleExists('user')) {
+    user_role_grant_permissions(RoleInterface::ANONYMOUS_ID, ['view media']);
+    user_role_grant_permissions(RoleInterface::AUTHENTICATED_ID, ['view media']);
+  }
 }
 
 /**
diff --git a/core/modules/media/tests/src/Functional/MediaAccessTest.php b/core/modules/media/tests/src/Functional/MediaAccessTest.php
index 090beacfd1ce91ae281c0296a232b920d9945532..2ccf0b5cc289c9fae5a9fe0d81b9470cfc1afbd5 100644
--- a/core/modules/media/tests/src/Functional/MediaAccessTest.php
+++ b/core/modules/media/tests/src/Functional/MediaAccessTest.php
@@ -56,6 +56,7 @@ public function testMediaAccess() {
     $role = Role::load(RoleInterface::AUTHENTICATED_ID);
 
     // Test 'view media' permission.
+    user_role_revoke_permissions($role->id(), ['view media']);
     $this->drupalGet('media/' . $media->id());
     $this->assertCacheContext('user.permissions');
     $assert_session->statusCodeEquals(403);
diff --git a/core/modules/media/tests/src/Functional/MediaCacheTagsTest.php b/core/modules/media/tests/src/Functional/MediaCacheTagsTest.php
index cdbfc292a1ffe9007ccdc768df6e880277bad8a7..8da814b9d3a195dd5f389c0e6efb60cd367d4f6b 100644
--- a/core/modules/media/tests/src/Functional/MediaCacheTagsTest.php
+++ b/core/modules/media/tests/src/Functional/MediaCacheTagsTest.php
@@ -5,8 +5,6 @@
 use Drupal\Core\Entity\EntityInterface;
 use Drupal\media\Entity\Media;
 use Drupal\system\Tests\Entity\EntityWithUriCacheTagsTestBase;
-use Drupal\user\Entity\Role;
-use Drupal\user\RoleInterface;
 
 /**
  * Tests the media entity's cache tags.
@@ -25,19 +23,6 @@ class MediaCacheTagsTest extends EntityWithUriCacheTagsTestBase {
     'media_test_source',
   ];
 
-  /**
-   * {@inheritdoc}
-   */
-  protected function setUp() {
-    parent::setUp();
-
-    // Give anonymous users permission to view media, so that we can
-    // verify the cache tags of cached versions of media items.
-    $user_role = Role::load(RoleInterface::ANONYMOUS_ID);
-    $user_role->grantPermission('view media');
-    $user_role->save();
-  }
-
   /**
    * {@inheritdoc}
    */