diff --git a/composer/Generator/Builder/DrupalCoreRecommendedBuilder.php b/composer/Generator/Builder/DrupalCoreRecommendedBuilder.php
index 216550f05de7a36d41dc8813286ffec4f0d29e17..28d543a44a07774a17862f468d320d62fb46ec10 100644
--- a/composer/Generator/Builder/DrupalCoreRecommendedBuilder.php
+++ b/composer/Generator/Builder/DrupalCoreRecommendedBuilder.php
@@ -30,7 +30,15 @@ public function getPackage() {
     }
 
     // Make a list of packages we do not want to put in the 'require' section.
-    $remove_list = ['drupal/core', 'wikimedia/composer-merge-plugin', 'composer/installers'];
+    $remove_list = [
+      'drupal/core',
+      'wikimedia/composer-merge-plugin',
+      'composer/installers',
+      // This package contains no code other than interfaces, so allow sites
+      // to use any compatible version without needing to switch off of
+      // drupal/core-recommended.
+      'psr/http-message',
+    ];
 
     // Copy the 'packages' section from the Composer lock into our 'require'
     // section. There is also a 'packages-dev' section, but we do not need
diff --git a/composer/Metapackage/CoreRecommended/composer.json b/composer/Metapackage/CoreRecommended/composer.json
index 2f5161c7c6fff29910afd1aebf9ee16e89ad1699..fbd23b297a6b6906b8379b7f3945df95fe485b92 100644
--- a/composer/Metapackage/CoreRecommended/composer.json
+++ b/composer/Metapackage/CoreRecommended/composer.json
@@ -28,7 +28,6 @@
         "psr/event-dispatcher": "~1.0.0",
         "psr/http-client": "~1.0.2",
         "psr/http-factory": "~1.0.2",
-        "psr/http-message": "~2.0",
         "psr/log": "~3.0.0",
         "ralouphie/getallheaders": "~3.0.3",
         "sebastian/diff": "~4.0.4",