diff --git a/src/Microsoft.AspNet.DataProtection/DataProtectionConfiguration.cs b/src/Microsoft.AspNet.DataProtection/DataProtectionConfiguration.cs
index 71864269d4..c8af02a98d 100644
--- a/src/Microsoft.AspNet.DataProtection/DataProtectionConfiguration.cs
+++ b/src/Microsoft.AspNet.DataProtection/DataProtectionConfiguration.cs
@@ -82,7 +82,7 @@ namespace Microsoft.AspNet.DataProtection
         /// Registrations are additive. The factory is registered as <see cref="ServiceLifetime.Singleton"/>.
         /// </remarks>
         public DataProtectionConfiguration AddKeyEscrowSink<TImplementation>()
-            where TImplementation : IKeyEscrowSink
+            where TImplementation : class, IKeyEscrowSink
         {
             Services.AddSingleton<IKeyEscrowSink, TImplementation>();
             return this;