diff --git a/package_manager/tests/fixtures/updated_module/1.0.0/updated_module.permissions.yml b/package_manager/tests/fixtures/updated_module/1.0.0/updated_module.permissions.yml
new file mode 100644
index 0000000000000000000000000000000000000000..c0236005ef2735b631b10852a4e0e419eaace19e
--- /dev/null
+++ b/package_manager/tests/fixtures/updated_module/1.0.0/updated_module.permissions.yml
@@ -0,0 +1,4 @@
+changed permission:
+  title: 'permission'
+deleted permission:
+  title: 'deleted permission'
diff --git a/package_manager/tests/fixtures/updated_module/1.1.0/updated_module.permissions.yml b/package_manager/tests/fixtures/updated_module/1.1.0/updated_module.permissions.yml
new file mode 100644
index 0000000000000000000000000000000000000000..926a17a4123809ba9fec4224ebf46cb4cdbf37ff
--- /dev/null
+++ b/package_manager/tests/fixtures/updated_module/1.1.0/updated_module.permissions.yml
@@ -0,0 +1,4 @@
+changed permission:
+  title: 'changed permission'
+added permission:
+  title: 'added permission'
diff --git a/package_manager/tests/modules/package_manager_test_api/package_manager_test_api.services.yml b/package_manager/tests/modules/package_manager_test_api/package_manager_test_api.services.yml
index 76f8f38a8c40caba0f8523000825797179465458..6bf6af37d16d4aae2a28f04325ac3daaf8eaa262 100644
--- a/package_manager/tests/modules/package_manager_test_api/package_manager_test_api.services.yml
+++ b/package_manager/tests/modules/package_manager_test_api/package_manager_test_api.services.yml
@@ -5,5 +5,6 @@ services:
       - '@package_manager.path_locator'
       - '@state'
       - '@router.no_access_checks'
+      - '@user.permissions'
     tags:
       - { name: event_subscriber }
diff --git a/package_manager/tests/modules/package_manager_test_api/src/SystemChangeRecorder.php b/package_manager/tests/modules/package_manager_test_api/src/SystemChangeRecorder.php
index df1b7b018021afe3a09511c38122817b962ae57c..4738a3157c366930ce1f56ff2aa912a9fa2a5a07 100644
--- a/package_manager/tests/modules/package_manager_test_api/src/SystemChangeRecorder.php
+++ b/package_manager/tests/modules/package_manager_test_api/src/SystemChangeRecorder.php
@@ -8,6 +8,7 @@ use Drupal\package_manager\Event\PostDestroyEvent;
 use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\StageEvent;
 use Drupal\package_manager\PathLocator;
+use Drupal\user\PermissionHandlerInterface;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\Routing\RouterInterface;
 
@@ -37,6 +38,13 @@ class SystemChangeRecorder implements EventSubscriberInterface {
    */
   private $router;
 
+  /**
+   * The permission handler service.
+   *
+   * @var \Drupal\user\PermissionHandlerInterface
+   */
+  private $permissionHandler;
+
   /**
    * Constructs a SystemChangeRecorder object.
    *
@@ -46,11 +54,14 @@ class SystemChangeRecorder implements EventSubscriberInterface {
    *   The state service.
    * @param \Symfony\Component\Routing\RouterInterface $router
    *   The router service.
+   * @param \Drupal\user\PermissionHandlerInterface $permissionHandler
+   *   The permission handler service.
    */
-  public function __construct(PathLocator $path_locator, StateInterface $state, RouterInterface $router) {
+  public function __construct(PathLocator $path_locator, StateInterface $state, RouterInterface $router, PermissionHandlerInterface $permissionHandler) {
     $this->pathLocator = $path_locator;
     $this->state = $state;
     $this->router = $router;
+    $this->permissionHandler = $permissionHandler;
   }
 
   /**
@@ -78,6 +89,13 @@ class SystemChangeRecorder implements EventSubscriberInterface {
     // Check if a route added in the updated module is available.
     $results['new route exists'] = $route_collection->get('updated_module.added') ? 'exists' : 'not exists';
 
+    $permissions = $this->permissionHandler->getPermissions();
+    // Check if changes to an existing permission are picked up.
+    $results['title of changed permission'] = $permissions['changed permission']['title'];
+    // Check if a permission removed from the updated module is not available.
+    $results['deleted permission exists'] = array_key_exists('deleted permission', $permissions) ? 'exists' : 'not exists';
+    // Check if a permission added in the updated module is available.
+    $results['new permission exists'] = array_key_exists('added permission', $permissions) ? 'exists' : 'not exists';
     $phase = $event instanceof PreApplyEvent ? 'pre' : 'post';
     $this->state->set("system_changes:$phase", $results);
   }
diff --git a/package_manager/tests/src/Build/PackageUpdateTest.php b/package_manager/tests/src/Build/PackageUpdateTest.php
index 4b17c01c93fe725f8b6b67dc20c4d323e6724981..75c03353b95c836d72ae389d2ef28214d9f442f5 100644
--- a/package_manager/tests/src/Build/PackageUpdateTest.php
+++ b/package_manager/tests/src/Build/PackageUpdateTest.php
@@ -74,6 +74,9 @@ class PackageUpdateTest extends TemplateProjectTestBase {
       'path of changed route' => '/updated-module/changed/pre',
       'deleted route exists' => 'exists',
       'new route exists' => 'not exists',
+      'title of changed permission' => 'permission',
+      'deleted permission exists' => 'exists',
+      'new permission exists' => 'not exists',
     ];
     $this->assertSame($expected_pre_apply_results, $results['pre']);
 
@@ -88,6 +91,12 @@ class PackageUpdateTest extends TemplateProjectTestBase {
       'deleted route exists' => 'not exists',
       // Routes added to the updated module should be available.
       'new route exists' => 'exists',
+      // Title of the existing permission should be changed.
+      'title of changed permission' => 'changed permission',
+      // Permissions deleted from the updated module should not be available.
+      'deleted permission exists' => 'not exists',
+      // Permissions added to the updated module should be available.
+      'new permission exists' => 'exists',
     ];
     $this->assertSame($expected_post_apply_results, $results['post']);
   }