diff --git a/core/includes/update.inc b/core/includes/update.inc
index 9dd8456..d3b8822 100644
--- a/core/includes/update.inc
+++ b/core/includes/update.inc
@@ -1107,5 +1107,164 @@ function update_variables_to_config($config_name, array $variable_map) {
  */
 
 /**
+ * Returns a mail string for a variable name.
+ *
+ * @param string $key
+ *   The variable name that provides the mail text.
+ *
+ * @return
+ *   A string value containing the text for the variable.
+ */
+function update_user_mail_text($key) {
+  if ($admin_setting = update_variable_get('user_mail_' . $key, FALSE)) {
+    // An admin setting overrides the default string.
+    $text = $admin_setting;
+  }
+  else {
+    // No override, return default string.
+    switch ($key) {
+      case 'register_no_approval_required_subject':
+        $text = 'Account details for [user:name] at [site:name]';
+        break;
+      case 'register_no_approval_required_body':
+        $text = "[user:name],
+
+Thank you for registering at [site:name]. You may now log in by clicking this link or copying and pasting it to your browser:
+
+[user:one-time-login-url]
+
+This link can only be used once to log in and will lead you to a page where you can set your password.
+
+After setting your password, you will be able to log in at [site:login-url] in the future using:
+
+username: [user:name]
+password: Your password
+
+--  [site:name] team";
+        break;
+
+      case 'register_admin_created_subject':
+        $text = 'An administrator created an account for you at [site:name]';
+        break;
+      case 'register_admin_created_body':
+        $text = "[user:name],
+
+A site administrator at [site:name] has created an account for you. You may now log in by clicking this link or copying and pasting it to your browser:
+
+[user:one-time-login-url]
+
+This link can only be used once to log in and will lead you to a page where you can set your password.
+
+After setting your password, you will be able to log in at [site:login-url] in the future using:
+
+username: [user:name]
+password: Your password
+
+--  [site:name] team";
+        break;
+
+      case 'register_pending_approval_subject':
+      case 'register_pending_approval_admin_subject':
+        $text = 'Account details for [user:name] at [site:name] (pending admin approval)';
+        break;
+      case 'register_pending_approval_body':
+        $text = "[user:name],
+
+Thank you for registering at [site:name]. Your application for an account is currently pending approval. Once it has been approved, you will receive another e-mail containing information about how to log in, set your password, and other details.
+
+
+--  [site:name] team";
+        break;
+      case 'register_pending_approval_admin_body':
+        $text = "[user:name] has applied for an account.
+
+[user:edit-url]";
+        break;
+
+      case 'password_reset_subject':
+        $text = 'Replacement login information for [user:name] at [site:name]';
+        break;
+      case 'password_reset_body':
+        $text = "[user:name],
+
+A request to reset the password for your account has been made at [site:name].
+
+You may now log in by clicking this link or copying and pasting it to your browser:
+
+[user:one-time-login-url]
+
+This link can only be used once to log in and will lead you to a page where you can set your password. It expires after one day and nothing will happen if it's not used.
+
+--  [site:name] team";
+        break;
+
+      case 'status_activated_subject':
+        $text = 'Account details for [user:name] at [site:name] (approved)';
+        break;
+      case 'status_activated_body':
+        $text = "[user:name],
+
+Your account at [site:name] has been activated.
+
+You may now log in by clicking this link or copying and pasting it into your browser:
+
+[user:one-time-login-url]
+
+This link can only be used once to log in and will lead you to a page where you can set your password.
+
+After setting your password, you will be able to log in at [site:login-url] in the future using:
+
+username: [user:name]
+password: Your password
+
+--  [site:name] team";
+        break;
+
+      case 'status_blocked_subject':
+        $text = 'Account details for [user:name] at [site:name] (blocked)';
+        break;
+      case 'status_blocked_body':
+        $text = "[user:name],
+
+Your account on [site:name] has been blocked.
+
+--  [site:name] team";
+        break;
+
+      case 'cancel_confirm_subject':
+        $text = 'Account cancellation request for [user:name] at [site:name]';
+        break;
+      case 'cancel_confirm_body':
+        $text = "[user:name],
+
+A request to cancel your account has been made at [site:name].
+
+You may now cancel your account on [site:url-brief] by clicking this link or copying and pasting it into your browser:
+
+[user:cancel-url]
+
+NOTE: The cancellation of your account is not reversible.
+
+This link expires in one day and nothing will happen if it is not used.
+
+--  [site:name] team";
+        break;
+
+      case 'status_canceled_subject':
+        $text = 'Account details for [user:name] at [site:name] (canceled)';
+        break;
+      case 'status_canceled_body':
+        $text = "[user:name],
+
+Your account on [site:name] has been canceled.
+
+--  [site:name] team";
+        break;
+    }
+  }
+  return $text;
+}
+
+/**
  * @} End of "defgroup update-api-7.x-to-8.x".
  */
diff --git a/core/modules/user/config/user.mail.yml b/core/modules/user/config/user.mail.yml
new file mode 100644
index 0000000..edd78b9
--- /dev/null
+++ b/core/modules/user/config/user.mail.yml
@@ -0,0 +1,24 @@
+cancel_confirm:
+  body: "[user:name],\n\nA request to cancel your account has been made at [site:name].\n\nYou may now cancel your account on [site:url-brief] by clicking this link or copying and pasting it into your browser:\n\n[user:cancel-url]\n\nNOTE: The cancellation of your account is not reversible.\n\nThis link expires in one day and nothing will happen if it is not used.\n\n--  [site:name] team"
+  subject: 'Account cancellation request for [user:name] at [site:name]'
+password_reset:
+  body: "[user:name],\n\nA request to reset the password for your account has been made at [site:name].\n\nYou may now log in by clicking this link or copying and pasting it to your browser:\n\n[user:one-time-login-url]\n\nThis link can only be used once to log in and will lead you to a page where you can set your password. It expires after one day and nothing will happen if it's not used.\n\n--  [site:name] team"
+  subject: 'Replacement login information for [user:name] at [site:name]'
+register_admin_created:
+  body: "[user:name],\n\nA site administrator at [site:name] has created an account for you. You may now log in by clicking this link or copying and pasting it to your browser:\n\n[user:one-time-login-url]\n\nThis link can only be used once to log in and will lead you to a page where you can set your password.\n\nAfter setting your password, you will be able to log in at [site:login-url] in the future using:\n\nusername: [user:name]\npassword: Your password\n\n--  [site:name] team"
+  subject: 'An administrator created an account for you at [site:name]'
+register_no_approval_required:
+  body: "[user:name],\n\nThank you for registering at [site:name]. You may now log in by clicking this link or copying and pasting it to your browser:\n\n[user:one-time-login-url]\n\nThis link can only be used once to log in and will lead you to a page where you can set your password.\n\nAfter setting your password, you will be able to log in at [site:login-url] in the future using:\n\nusername: [user:name]\npassword: Your password\n\n--  [site:name] team"
+  subject: 'Account details for [user:name] at [site:name]'
+register_pending_approval:
+  body: "[user:name],\n\nThank you for registering at [site:name]. Your application for an account is currently pending approval. Once it has been approved, you will receive another e-mail containing information about how to log in, set your password, and other details.\n\n\n--  [site:name] team"
+  subject: 'Account details for [user:name] at [site:name] (pending admin approval)'
+status_activated:
+  body: "[user:name],\n\nYour account at [site:name] has been activated.\n\nYou may now log in by clicking this link or copying and pasting it into your browser:\n\n[user:one-time-login-url]\n\nThis link can only be used once to log in and will lead you to a page where you can set your password.\n\nAfter setting your password, you will be able to log in at [site:login-url] in the future using:\n\nusername: [user:name]\npassword: Your password\n\n--  [site:name] team"
+  subject: 'Account details for [user:name] at [site:name] (approved)'
+status_blocked:
+  body: "[user:name],\n\nYour account on [site:name] has been blocked.\n\n--  [site:name] team"
+  subject: 'Account details for [user:name] at [site:name] (blocked)'
+status_canceled:
+  body: "[user:name],\n\nYour account on [site:name] has been canceled.\n\n--  [site:name] team"
+  subject: 'Account details for [user:name] at [site:name] (canceled)'
diff --git a/core/modules/user/user.admin.inc b/core/modules/user/user.admin.inc
index 3c39f24..f9b1c23 100644
--- a/core/modules/user/user.admin.inc
+++ b/core/modules/user/user.admin.inc
@@ -262,6 +262,8 @@ function user_admin_account_validate($form, &$form_state) {
  */
 function user_admin_settings($form, &$form_state) {
   $config = config('user.settings');
+  $mail_config = config('user.mail');
+
   // Settings for anonymous users.
   $form['anonymous_settings'] = array(
     '#type' => 'fieldset',
@@ -441,13 +443,13 @@ function user_admin_settings($form, &$form_state) {
   $form['email_admin_created']['user_mail_register_admin_created_subject'] = array(
     '#type' => 'textfield',
     '#title' => t('Subject'),
-    '#default_value' => _user_mail_text('register_admin_created_subject', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('register_admin_created.subject'),
     '#maxlength' => 180,
   );
   $form['email_admin_created']['user_mail_register_admin_created_body'] = array(
     '#type' => 'textarea',
     '#title' => t('Body'),
-    '#default_value' => _user_mail_text('register_admin_created_body', NULL, array(), FALSE),
+    '#default_value' =>  $mail_config->get('register_admin_created.body'),
     '#rows' => 15,
   );
 
@@ -462,13 +464,13 @@ function user_admin_settings($form, &$form_state) {
   $form['email_pending_approval']['user_mail_register_pending_approval_subject'] = array(
     '#type' => 'textfield',
     '#title' => t('Subject'),
-    '#default_value' => _user_mail_text('register_pending_approval_subject', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('register_pending_approval.subject'),
     '#maxlength' => 180,
   );
   $form['email_pending_approval']['user_mail_register_pending_approval_body'] = array(
     '#type' => 'textarea',
     '#title' => t('Body'),
-    '#default_value' => _user_mail_text('register_pending_approval_body', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('register_pending_approval.body'),
     '#rows' => 8,
   );
 
@@ -483,13 +485,13 @@ function user_admin_settings($form, &$form_state) {
   $form['email_no_approval_required']['user_mail_register_no_approval_required_subject'] = array(
     '#type' => 'textfield',
     '#title' => t('Subject'),
-    '#default_value' => _user_mail_text('register_no_approval_required_subject', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('register_no_approval_required.subject'),
     '#maxlength' => 180,
   );
   $form['email_no_approval_required']['user_mail_register_no_approval_required_body'] = array(
     '#type' => 'textarea',
     '#title' => t('Body'),
-    '#default_value' => _user_mail_text('register_no_approval_required_body', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('register_no_approval_required.body'),
     '#rows' => 15,
   );
 
@@ -505,13 +507,13 @@ function user_admin_settings($form, &$form_state) {
   $form['email_password_reset']['user_mail_password_reset_subject'] = array(
     '#type' => 'textfield',
     '#title' => t('Subject'),
-    '#default_value' => _user_mail_text('password_reset_subject', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('password_reset.subject'),
     '#maxlength' => 180,
   );
   $form['email_password_reset']['user_mail_password_reset_body'] = array(
     '#type' => 'textarea',
     '#title' => t('Body'),
-    '#default_value' => _user_mail_text('password_reset_body', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('password_reset.body'),
     '#rows' => 12,
   );
 
@@ -540,13 +542,13 @@ function user_admin_settings($form, &$form_state) {
   $form['email_activated']['settings']['user_mail_status_activated_subject'] = array(
     '#type' => 'textfield',
     '#title' => t('Subject'),
-    '#default_value' => _user_mail_text('status_activated_subject', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('status_activated.subject'),
     '#maxlength' => 180,
   );
   $form['email_activated']['settings']['user_mail_status_activated_body'] = array(
     '#type' => 'textarea',
     '#title' => t('Body'),
-    '#default_value' => _user_mail_text('status_activated_body', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('status_activated.body'),
     '#rows' => 15,
   );
 
@@ -575,13 +577,13 @@ function user_admin_settings($form, &$form_state) {
   $form['email_blocked']['settings']['user_mail_status_blocked_subject'] = array(
     '#type' => 'textfield',
     '#title' => t('Subject'),
-    '#default_value' => _user_mail_text('status_blocked_subject', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('status_blocked.subject'),
     '#maxlength' => 180,
   );
   $form['email_blocked']['settings']['user_mail_status_blocked_body'] = array(
     '#type' => 'textarea',
     '#title' => t('Body'),
-    '#default_value' => _user_mail_text('status_blocked_body', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('status_blocked.body'),
     '#rows' => 3,
   );
 
@@ -596,13 +598,13 @@ function user_admin_settings($form, &$form_state) {
   $form['email_cancel_confirm']['user_mail_cancel_confirm_subject'] = array(
     '#type' => 'textfield',
     '#title' => t('Subject'),
-    '#default_value' => _user_mail_text('cancel_confirm_subject', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('cancel_confirm.subject'),
     '#maxlength' => 180,
   );
   $form['email_cancel_confirm']['user_mail_cancel_confirm_body'] = array(
     '#type' => 'textarea',
     '#title' => t('Body'),
-    '#default_value' => _user_mail_text('cancel_confirm_body', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('cancel_confirm.body'),
     '#rows' => 3,
   );
 
@@ -631,13 +633,13 @@ function user_admin_settings($form, &$form_state) {
   $form['email_canceled']['settings']['user_mail_status_canceled_subject'] = array(
     '#type' => 'textfield',
     '#title' => t('Subject'),
-    '#default_value' => _user_mail_text('status_canceled_subject', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('status_canceled.subject'),
     '#maxlength' => 180,
   );
   $form['email_canceled']['settings']['user_mail_status_canceled_body'] = array(
     '#type' => 'textarea',
     '#title' => t('Body'),
-    '#default_value' => _user_mail_text('status_canceled_body', NULL, array(), FALSE),
+    '#default_value' => $mail_config->get('status_canceled.body'),
     '#rows' => 3,
   );
 
@@ -658,6 +660,24 @@ function user_admin_settings_submit($form, &$form_state) {
     ->set('notify.status_blocked', $form_state['values']['user_mail_status_blocked_notify'])
     ->set('notify.status_canceled', $form_state['values']['user_mail_status_canceled_notify'])
     ->save();
+  config('user.mail')
+    ->set('cancel_confirm.body', $form_state['values']['user_mail_cancel_confirm_body'])
+    ->set('cancel_confirm.subject', $form_state['values']['user_mail_cancel_confirm_subject'])
+    ->set('password_reset.body', $form_state['values']['user_mail_password_reset_body'])
+    ->set('password_reset.subject', $form_state['values']['user_mail_password_reset_subject'])
+    ->set('register_admin_created.body', $form_state['values']['user_mail_register_admin_created_body'])
+    ->set('register_admin_created.subject', $form_state['values']['user_mail_register_admin_created_subject'])
+    ->set('register_no_approval_required.body', $form_state['values']['user_mail_register_no_approval_required_body'])
+    ->set('register_no_approval_required.subject', $form_state['values']['user_mail_register_no_approval_required_subject'])
+    ->set('register_pending_approval.body', $form_state['values']['user_mail_register_pending_approval_body'])
+    ->set('register_pending_approval.subject', $form_state['values']['user_mail_register_pending_approval_subject'])
+    ->set('status_activated.body', $form_state['values']['user_mail_status_activated_body'])
+    ->set('status_activated.subject', $form_state['values']['user_mail_status_activated_subject'])
+    ->set('status_blocked.body', $form_state['values']['user_mail_status_blocked_body'])
+    ->set('status_blocked.subject', $form_state['values']['user_mail_status_blocked_subject'])
+    ->set('status_canceled.body', $form_state['values']['user_mail_status_canceled_body'])
+    ->set('status_canceled.subject', $form_state['values']['user_mail_status_canceled_subject'])
+    ->save();
 }
 
 /**
diff --git a/core/modules/user/user.install b/core/modules/user/user.install
index 67957da..4418170 100644
--- a/core/modules/user/user.install
+++ b/core/modules/user/user.install
@@ -525,6 +525,42 @@ function user_update_8005() {
   );
   db_add_field('users', 'preferred_admin_langcode', $spec);
 }
+
+/**
+ * Moves user mail settings from variable to config.
+ *
+ * @ingroup config_upgrade
+ */
+function user_update_8006() {
+  $config = config('user.mail');
+  $conversion_variable_to_key = array(
+    'register_admin_created_subject' => 'register_admin_created.subject',
+    'register_admin_created_body' => 'register_admin_created.body',
+    'register_pending_approval_subject' => 'register_pending_approval.subject',
+    'register_pending_approval_body' => 'register_pending_approval.body',
+    'register_no_approval_required_subject' => 'register_no_approval_required.subject',
+    'register_no_approval_required_body' => 'register_no_approval_required.body',
+    'password_reset_subject' => 'password_reset.subject',
+    'password_reset_body' => 'password_reset.body',
+    'status_activated_subject' => 'status_activated.subject',
+    'status_activated_body' => 'status_activated.body',
+    'status_blocked_subject' => 'status_blocked.subject',
+    'status_blocked_body' => 'status_blocked.body',
+    'cancel_confirm_subject' => 'cancel_confirm.subject',
+    'cancel_confirm_body' => 'cancel_confirm.body',
+    'status_canceled_subject' => 'status_canceled.subject',
+    'status_canceled_body' => 'status_canceled.body',
+  );
+
+  foreach ($conversion_variable_to_key as $variable_name => $config_key) {
+    // Potentially the only place the current user mail text is defined is as
+    // a hardcoded value. Call update_user_mail_text() to get the value.
+    $config->set($config_key, update_user_mail_text($variable_name));
+    // If the variable exists delete it. This will fail silently.
+    update_variable_del($variable_name);
+  }
+  $config->save();
+}
 /**
  * @} End of "addtogroup updates-7.x-to-8.x".
  */
diff --git a/core/modules/user/user.module b/core/modules/user/user.module
index 9dd47da..fdeebd7 100644
--- a/core/modules/user/user.module
+++ b/core/modules/user/user.module
@@ -2124,172 +2124,28 @@ function user_build_content($account, $view_mode = 'full', $langcode = NULL) {
 function user_mail($key, &$message, $params) {
   $language = $message['language'];
   $variables = array('user' => $params['account']);
-  $message['subject'] .= _user_mail_text($key . '_subject', $language, $variables);
-  $message['body'][] = _user_mail_text($key . '_body', $language, $variables);
+  $message['subject'] .= _user_mail_text($key . '.subject', $language, $variables);
+  $message['body'][] = _user_mail_text($key . '.body', $language, $variables);
 }
 
 /**
  * Returns a mail string for a variable name.
  *
- * Used by user_mail() and the settings forms to retrieve strings.
+ * @param string $key
+ *   The config key that provides the mail text.
+ * @param object $language
+ *   A language object.
+ * @param array $variables
+ *   An array of token keys and values.
+ *
+ * @return
+ *   A string value containing the text for the user.mail config key.
  */
-function _user_mail_text($key, $language = NULL, $variables = array(), $replace = TRUE) {
+function _user_mail_text($key, $language = NULL, $variables = array()) {
   $langcode = isset($language) ? $language->langcode : NULL;
-
-  if ($admin_setting = variable_get('user_mail_' . $key, FALSE)) {
-    // An admin setting overrides the default string.
-    $text = $admin_setting;
-  }
-  else {
-    // No override, return default string.
-    switch ($key) {
-      case 'register_no_approval_required_subject':
-        $text = t('Account details for [user:name] at [site:name]', array(), array('langcode' => $langcode));
-        break;
-      case 'register_no_approval_required_body':
-        $text = t("[user:name],
-
-Thank you for registering at [site:name]. You may now log in by clicking this link or copying and pasting it to your browser:
-
-[user:one-time-login-url]
-
-This link can only be used once to log in and will lead you to a page where you can set your password.
-
-After setting your password, you will be able to log in at [site:login-url] in the future using:
-
-username: [user:name]
-password: Your password
-
---  [site:name] team", array(), array('langcode' => $langcode));
-        break;
-
-      case 'register_admin_created_subject':
-        $text = t('An administrator created an account for you at [site:name]', array(), array('langcode' => $langcode));
-        break;
-      case 'register_admin_created_body':
-        $text = t("[user:name],
-
-A site administrator at [site:name] has created an account for you. You may now log in by clicking this link or copying and pasting it to your browser:
-
-[user:one-time-login-url]
-
-This link can only be used once to log in and will lead you to a page where you can set your password.
-
-After setting your password, you will be able to log in at [site:login-url] in the future using:
-
-username: [user:name]
-password: Your password
-
---  [site:name] team", array(), array('langcode' => $langcode));
-        break;
-
-      case 'register_pending_approval_subject':
-      case 'register_pending_approval_admin_subject':
-        $text = t('Account details for [user:name] at [site:name] (pending admin approval)', array(), array('langcode' => $langcode));
-        break;
-      case 'register_pending_approval_body':
-        $text = t("[user:name],
-
-Thank you for registering at [site:name]. Your application for an account is currently pending approval. Once it has been approved, you will receive another e-mail containing information about how to log in, set your password, and other details.
-
-
---  [site:name] team", array(), array('langcode' => $langcode));
-        break;
-      case 'register_pending_approval_admin_body':
-        $text = t("[user:name] has applied for an account.
-
-[user:edit-url]", array(), array('langcode' => $langcode));
-        break;
-
-      case 'password_reset_subject':
-        $text = t('Replacement login information for [user:name] at [site:name]', array(), array('langcode' => $langcode));
-        break;
-      case 'password_reset_body':
-        $text = t("[user:name],
-
-A request to reset the password for your account has been made at [site:name].
-
-You may now log in by clicking this link or copying and pasting it to your browser:
-
-[user:one-time-login-url]
-
-This link can only be used once to log in and will lead you to a page where you can set your password. It expires after one day and nothing will happen if it's not used.
-
---  [site:name] team", array(), array('langcode' => $langcode));
-        break;
-
-      case 'status_activated_subject':
-        $text = t('Account details for [user:name] at [site:name] (approved)', array(), array('langcode' => $langcode));
-        break;
-      case 'status_activated_body':
-        $text = t("[user:name],
-
-Your account at [site:name] has been activated.
-
-You may now log in by clicking this link or copying and pasting it into your browser:
-
-[user:one-time-login-url]
-
-This link can only be used once to log in and will lead you to a page where you can set your password.
-
-After setting your password, you will be able to log in at [site:login-url] in the future using:
-
-username: [user:name]
-password: Your password
-
---  [site:name] team", array(), array('langcode' => $langcode));
-        break;
-
-      case 'status_blocked_subject':
-        $text = t('Account details for [user:name] at [site:name] (blocked)', array(), array('langcode' => $langcode));
-        break;
-      case 'status_blocked_body':
-        $text = t("[user:name],
-
-Your account on [site:name] has been blocked.
-
---  [site:name] team", array(), array('langcode' => $langcode));
-        break;
-
-      case 'cancel_confirm_subject':
-        $text = t('Account cancellation request for [user:name] at [site:name]', array(), array('langcode' => $langcode));
-        break;
-      case 'cancel_confirm_body':
-        $text = t("[user:name],
-
-A request to cancel your account has been made at [site:name].
-
-You may now cancel your account on [site:url-brief] by clicking this link or copying and pasting it into your browser:
-
-[user:cancel-url]
-
-NOTE: The cancellation of your account is not reversible.
-
-This link expires in one day and nothing will happen if it is not used.
-
---  [site:name] team", array(), array('langcode' => $langcode));
-        break;
-
-      case 'status_canceled_subject':
-        $text = t('Account details for [user:name] at [site:name] (canceled)', array(), array('langcode' => $langcode));
-        break;
-      case 'status_canceled_body':
-        $text = t("[user:name],
-
-Your account on [site:name] has been canceled.
-
---  [site:name] team", array(), array('langcode' => $langcode));
-        break;
-    }
-  }
-
-  if ($replace) {
-    // We do not sanitize the token replacement, since the output of this
-    // replacement is intended for an e-mail message, not a web browser.
-    return token_replace($text, $variables, array('langcode' => $langcode, 'callback' => 'user_mail_tokens', 'sanitize' => FALSE, 'clear' => TRUE));
-  }
-
-  return $text;
+  // We do not sanitize the token replacement, since the output of this
+  // replacement is intended for an e-mail message, not a web browser.
+  return token_replace(config('user.mail')->get($key), $variables, array('langcode' => $langcode, 'callback' => 'user_mail_tokens', 'sanitize' => FALSE, 'clear' => TRUE));
 }
 
 /**