diff --git a/iiif_presentation_api.services.yml b/iiif_presentation_api.services.yml
index 82c9e63..35cc516 100644
--- a/iiif_presentation_api.services.yml
+++ b/iiif_presentation_api.services.yml
@@ -54,3 +54,8 @@ services:
     class: Drupal\iiif_presentation_api\FieldMapper
     tags:
       - { name: iiif_presentation_api_mapper, base: iiif_presentation_api_map, version: v3 }
+
+  iiif_presentation_api.revalidation_directive_subscriber:
+    class: Drupal\iiif_presentation_api\EventSubscriber\RevalidationDirective
+    tags:
+      - { name: event_subscriber }
diff --git a/src/Controller/V3/ManifestController.php b/src/Controller/V3/ManifestController.php
index 50d9422..b3226f3 100644
--- a/src/Controller/V3/ManifestController.php
+++ b/src/Controller/V3/ManifestController.php
@@ -8,6 +8,7 @@
 use Drupal\Core\Render\RenderContext;
 use Drupal\Core\Render\RendererInterface;
 use Drupal\Core\Routing\RouteMatchInterface;
+use Drupal\iiif_presentation_api\EventSubscriber\RevalidationDirective;
 use Drupal\serialization\Normalizer\CacheableNormalizerInterface;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 use Symfony\Component\Serializer\SerializerInterface;
@@ -63,7 +64,7 @@ public function build(string $parameter_name, RouteMatchInterface $route_match)
         CacheableNormalizerInterface::SERIALIZATION_CONTEXT_CACHEABILITY => $cache_meta,
       ];
       $serialized = $this->serializer->serialize($_entity, 'iiif-p-v3', $context);
-      return (new CacheableJsonResponse(
+      $response = (new CacheableJsonResponse(
         $serialized,
         200,
         [
@@ -73,6 +74,10 @@ public function build(string $parameter_name, RouteMatchInterface $route_match)
         ],
         TRUE
       ))->addCacheableDependency($cache_meta);
+
+      $response->headers->set(RevalidationDirective::HEADER, TRUE);
+
+      return $response;
     });
 
     if (!$context->isEmpty()) {
diff --git a/src/EventSubscriber/RevalidationDirective.php b/src/EventSubscriber/RevalidationDirective.php
new file mode 100644
index 0000000..d8db033
--- /dev/null
+++ b/src/EventSubscriber/RevalidationDirective.php
@@ -0,0 +1,53 @@
+<?php
+
+namespace Drupal\iiif_presentation_api\EventSubscriber;
+
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpKernel\Event\ResponseEvent;
+use Symfony\Component\HttpKernel\KernelEvents;
+
+/**
+ * Add 'Cache-Control: no-cache' to IIIF-P manifests.
+ *
+ * This is done such that access control actions should take effect sooner, at
+ * the expense of more load on the server during general use.
+ *
+ * Note: This is explicitly weighted/prioritized such that it should run _after_
+ * Drupal's `FinishResponseSubscriber` runs to add its base cache headers.
+ *
+ * @see \Drupal\Core\EventSubscriber\FinishResponseSubscriber::getSubscribedEvents()
+ */
+class RevalidationDirective implements EventSubscriberInterface {
+
+  const HEADER = 'X-iiif_presentation_api_revalidate';
+
+  /**
+   * {@inheritDoc}
+   */
+  public static function getSubscribedEvents() : array {
+    return [
+      KernelEvents::RESPONSE => [['doRevalidation', -10]],
+    ];
+  }
+
+  /**
+   * Event callback; add in 'must_revalidate' for our controller response.
+   *
+   * @param \Symfony\Component\HttpKernel\Event\ResponseEvent $event
+   *   The response on which to act.
+   */
+  public function doRevalidation(ResponseEvent $event) : void {
+    $response = $event->getResponse();
+
+    if (!$response->headers->has(static::HEADER)) {
+      return;
+    }
+
+    $response->headers->remove(static::HEADER);
+
+    if ($response->isCacheable()) {
+      $response->setCache(['no_cache' => TRUE]);
+    }
+  }
+
+}
diff --git a/src/EventSubscriber/V3/BaseImageBodyEventSubscriber.php b/src/EventSubscriber/V3/BaseImageBodyEventSubscriber.php
index 64f01de..379eee1 100644
--- a/src/EventSubscriber/V3/BaseImageBodyEventSubscriber.php
+++ b/src/EventSubscriber/V3/BaseImageBodyEventSubscriber.php
@@ -16,7 +16,7 @@ class BaseImageBodyEventSubscriber implements EventSubscriberInterface {
    * Constructor.
    */
   public function __construct(
-    protected PluginManagerInterface $idPluginManager
+    protected PluginManagerInterface $idPluginManager,
   ) {
   }