diff --git a/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java b/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java
index 9c87b916f0d..6e6b285304d 100644
--- a/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java
+++ b/spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/EndpointRequest.java
@@ -100,7 +100,7 @@ public final class EndpointRequest {
 
 		private final List<Object> excludes;
 
-		private RequestMatcher delegate;
+		private volatile RequestMatcher delegate;
 
 		private EndpointRequestMatcher() {
 			this(Collections.emptyList(), Collections.emptyList());
diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/PathRequest.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/PathRequest.java
index 023c9f84215..562aef52094 100644
--- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/PathRequest.java
+++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/PathRequest.java
@@ -64,7 +64,7 @@ public final class PathRequest {
 	public static final class H2ConsoleRequestMatcher
 			extends ApplicationContextRequestMatcher<H2ConsoleProperties> {
 
-		private RequestMatcher delegate;
+		private volatile RequestMatcher delegate;
 
 		private H2ConsoleRequestMatcher() {
 			super(H2ConsoleProperties.class);
diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/StaticResourceRequest.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/StaticResourceRequest.java
index eafc839db6a..7e3d3d3f2d6 100644
--- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/StaticResourceRequest.java
+++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/StaticResourceRequest.java
@@ -100,7 +100,7 @@ public final class StaticResourceRequest {
 
 		private final Set<StaticResourceLocation> locations;
 
-		private RequestMatcher delegate;
+		private volatile RequestMatcher delegate;
 
 		private StaticResourceRequestMatcher(Set<StaticResourceLocation> locations) {
 			super(ServerProperties.class);
diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcher.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcher.java
index 84441b3eb4d..11d29b1d25a 100644
--- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcher.java
+++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcher.java
@@ -69,8 +69,9 @@ public abstract class ApplicationContextRequestMatcher<C> implements RequestMatc
 		if (this.context == null) {
 			synchronized (this.contextLock) {
 				if (this.context == null) {
-					this.context = createContext(request);
-					initialized(this.context);
+					Supplier<C> createdContext = createContext(request);
+					initialized(createdContext);
+					this.context = createdContext;
 				}
 			}
 		}