diff --git a/core/modules/update/src/Routing/UpdateRouteSubscriber.php b/core/modules/update/src/Routing/UpdateRouteSubscriber.php
new file mode 100644
index 0000000000000000000000000000000000000000..9bffe435f080380547e76887151859e2097d645a
--- /dev/null
+++ b/core/modules/update/src/Routing/UpdateRouteSubscriber.php
@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\update\Routing;
+
+use Drupal\Core\Routing\RouteSubscriberBase;
+use Drupal\Core\Site\Settings;
+use Symfony\Component\Routing\RouteCollection;
+
+/**
+ * Route subscriber for Update module routes.
+ */
+class UpdateRouteSubscriber extends RouteSubscriberBase {
+
+  /**
+   * Constructs a new UpdateRouteSubscriber.
+   */
+  public function __construct(
+    protected Settings $settings,
+  ) {
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function alterRoutes(RouteCollection $collection) {
+    if ($this->settings->get('allow_authorize_operations', TRUE)) {
+      return;
+    }
+    $routes = [
+      'update.report_install',
+      'update.report_update',
+      'update.module_install',
+      'update.module_update',
+      'update.theme_install',
+      'update.theme_update',
+      'update.confirmation_page',
+    ];
+    foreach ($routes as $route) {
+      $route = $collection->get($route);
+      $route->setRequirement('_access', 'FALSE');
+    }
+  }
+
+}
diff --git a/core/modules/update/update.routing.yml b/core/modules/update/update.routing.yml
index b4502d1e5633645835cbc72784f838c4b82d0655..80faf6d5bb105019dc89287d69630074003aea4d 100644
--- a/core/modules/update/update.routing.yml
+++ b/core/modules/update/update.routing.yml
@@ -30,7 +30,6 @@ update.report_install:
     _title: 'Add new module or theme'
   requirements:
     _permission: 'administer software updates'
-    _access_update_manager: 'TRUE'
 
 update.report_update:
   path: '/admin/reports/updates/update'
@@ -39,7 +38,6 @@ update.report_update:
     _title: 'Update'
   requirements:
     _permission: 'administer software updates'
-    _access_update_manager: 'TRUE'
 
 update.module_install:
   path: '/admin/modules/install'
@@ -48,7 +46,6 @@ update.module_install:
     _title: 'Add new module'
   requirements:
     _permission: 'administer software updates'
-    _access_update_manager: 'TRUE'
 
 update.module_update:
   path: '/admin/modules/update'
@@ -57,7 +54,6 @@ update.module_update:
     _title: 'Update'
   requirements:
     _permission: 'administer software updates'
-    _access_update_manager: 'TRUE'
 
 update.theme_install:
   path: '/admin/theme/install'
@@ -66,7 +62,6 @@ update.theme_install:
     _title: 'Add new theme'
   requirements:
     _permission: 'administer software updates'
-    _access_update_manager: 'TRUE'
 
 update.theme_update:
   path: '/admin/appearance/update'
@@ -75,7 +70,6 @@ update.theme_update:
     _title: 'Update'
   requirements:
     _permission: 'administer software updates'
-    _access_update_manager: 'TRUE'
 
 # @todo Deprecate this route once
 #   https://www.drupal.org/project/drupal/issues/3159210 is fixed, or remove
@@ -97,4 +91,3 @@ update.confirmation_page:
     _title: 'Ready to update'
   requirements:
     _permission: 'administer software updates'
-    _access_update_manager: 'TRUE'
diff --git a/core/modules/update/update.services.yml b/core/modules/update/update.services.yml
index 465df135529a0e8e332285a2e30ee40cee48a64b..3f96c81b8baf521dff5a5f5e93d66689aed451fb 100644
--- a/core/modules/update/update.services.yml
+++ b/core/modules/update/update.services.yml
@@ -24,3 +24,6 @@ services:
   logger.channel.update:
     parent: logger.channel_base
     arguments: [ 'update' ]
+  update.route_subscriber:
+    class: Drupal\update\Routing\UpdateRouteSubscriber
+    arguments: ['@settings']