diff --git a/gcc/cp/ChangeLog b/gcc/cp/ChangeLog
index 6460a666e98..0467ca27761 100644
--- a/gcc/cp/ChangeLog
+++ b/gcc/cp/ChangeLog
@@ -1,3 +1,9 @@
+2018-12-14  Jason Merrill <jason@redhat.com>
+
+	PR c++/86823
+	* parser.c (cp_parser_template_id): Rearrange deferred access
+	checks into the firewall.
+
 2018-12-14  Jakub Jelinek  <jakub@redhat.com>
 
 	PR c++/82294
diff --git a/gcc/cp/parser.c b/gcc/cp/parser.c
index 7ff113f3c0f..b57e35d04c5 100644
--- a/gcc/cp/parser.c
+++ b/gcc/cp/parser.c
@@ -16187,16 +16187,18 @@ cp_parser_template_id (cp_parser *parser,
 				   is_declaration,
 				   tag_type,
 				   &is_identifier);
+
+  /* Push any access checks inside the firewall we're about to create.  */
+  vec<deferred_access_check, va_gc> *checks = get_deferred_access_checks ();
+  pop_deferring_access_checks ();
   if (templ == error_mark_node || is_identifier)
-    {
-      pop_deferring_access_checks ();
-      return templ;
-    }
+    return templ;
 
   /* Since we're going to preserve any side-effects from this parse, set up a
      firewall to protect our callers from cp_parser_commit_to_tentative_parse
      in the template arguments.  */
   tentative_firewall firewall (parser);
+  reopen_deferring_access_checks (checks);
 
   /* If we find the sequence `[:' after a template-name, it's probably
      a digraph-typo for `< ::'. Substitute the tokens and check if we can
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 1374be13f0e..4af1cf9423d 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,8 @@
+2018-12-14  Alexandre Oliva <aoliva@redhat.com>
+
+	PR c++/86823
+	* g++.dg/pr86823.C: New.
+
 2018-12-14  Jakub Jelinek  <jakub@redhat.com>
 
 	PR c++/82294
diff --git a/gcc/testsuite/g++.dg/pr86823.C b/gcc/testsuite/g++.dg/pr86823.C
new file mode 100644
index 00000000000..18914b00aa8
--- /dev/null
+++ b/gcc/testsuite/g++.dg/pr86823.C
@@ -0,0 +1,15 @@
+// { dg-do compile }
+
+struct X {
+private:
+  template<typename T>
+  struct Y {
+    int data;
+  };
+public:
+  int value;
+};
+
+int main() {
+  typename X::Y<int> a; // { dg-error "private" }
+}