diff --git a/src/Security/Authentication/Core/src/AuthenticationBuilder.cs b/src/Security/Authentication/Core/src/AuthenticationBuilder.cs
index 401b1f488c..d4efd0c847 100644
--- a/src/Security/Authentication/Core/src/AuthenticationBuilder.cs
+++ b/src/Security/Authentication/Core/src/AuthenticationBuilder.cs
@@ -25,9 +25,8 @@ namespace Microsoft.AspNetCore.Authentication
         /// </summary>
         public virtual IServiceCollection Services { get; }
 
-
         private AuthenticationBuilder AddSchemeHelper<TOptions, THandler>(string authenticationScheme, string displayName, Action<TOptions> configureOptions)
-            where TOptions : class, new()
+            where TOptions : AuthenticationSchemeOptions, new()
             where THandler : class, IAuthenticationHandler
         {
             Services.Configure<AuthenticationOptions>(o =>
@@ -41,6 +40,10 @@ namespace Microsoft.AspNetCore.Authentication
             {
                 Services.Configure(authenticationScheme, configureOptions);
             }
+            Services.AddOptions<TOptions>(authenticationScheme).Validate(o => {
+                o.Validate(authenticationScheme);
+                return true;
+            });
             Services.AddTransient<THandler>();
             return this;
         }
diff --git a/src/Security/Authentication/Core/src/AuthenticationHandler.cs b/src/Security/Authentication/Core/src/AuthenticationHandler.cs
index 5c9a6473f1..5f8a8d588f 100644
--- a/src/Security/Authentication/Core/src/AuthenticationHandler.cs
+++ b/src/Security/Authentication/Core/src/AuthenticationHandler.cs
@@ -82,8 +82,7 @@ namespace Microsoft.AspNetCore.Authentication
             Scheme = scheme;
             Context = context;
 
-            Options = OptionsMonitor.Get(Scheme.Name) ?? new TOptions();
-            Options.Validate(Scheme.Name);
+            Options = OptionsMonitor.Get(Scheme.Name);
 
             await InitializeEventsAsync();
             await InitializeHandlerAsync();