diff --git a/config b/config
index e629ac2cd..8aba8a06d 160000
--- a/config
+++ b/config
@@ -1 +1 @@
-Subproject commit e629ac2cd268c4d556aa5f3ca48dad669e72853d
+Subproject commit 8aba8a06dd876afd1a446c0393f72190d796ad61
diff --git a/src/apps/geoserver/wfs/src/main/java/org/geoserver/cloud/wfs/config/WfsSecurityOverridesAutoconfiguration.java b/src/apps/geoserver/wfs/src/main/java/org/geoserver/cloud/wfs/config/WfsSecurityOverridesAutoconfiguration.java
new file mode 100644
index 000000000..ca0b76ca1
--- /dev/null
+++ b/src/apps/geoserver/wfs/src/main/java/org/geoserver/cloud/wfs/config/WfsSecurityOverridesAutoconfiguration.java
@@ -0,0 +1,31 @@
+/*
+ * (c) 2024 Open Source Geospatial Foundation - all rights reserved This code is licensed under the
+ * GPL 2.0 license, available at the root application directory.
+ */
+package org.geoserver.cloud.wfs.config;
+
+import lombok.extern.slf4j.Slf4j;
+
+import org.geoserver.cloud.autoconfigure.catalog.backend.core.GeoServerBackendAutoConfiguration;
+import org.geoserver.cloud.wfs.security.NoopLayerGroupContainmentCache;
+import org.geoserver.security.impl.LayerGroupContainmentCache;
+import org.springframework.boot.autoconfigure.AutoConfiguration;
+import org.springframework.context.annotation.Bean;
+
+/**
+ * Runs before {@link GeoServerBackendAutoConfiguration} to provide a {@link
+ * NoopLayerGroupContainmentCache} before {@link CoreBackendConfiguration's} {@code
+ * layerGroupContainmentCache()} does.
+ *
+ * @since 1.8.2
+ */
+@AutoConfiguration(before = GeoServerBackendAutoConfiguration.class)
+@Slf4j(topic = "org.geoserver.cloud.wfs.config")
+public class WfsSecurityOverridesAutoconfiguration {
+
+    @Bean
+    LayerGroupContainmentCache layerGroupContainmentCache() {
+        log.info("wfs-service is using a no-op LayerGroupContainmentCache");
+        return new NoopLayerGroupContainmentCache();
+    }
+}
diff --git a/src/apps/geoserver/wfs/src/main/java/org/geoserver/cloud/wfs/security/NoopLayerGroupContainmentCache.java b/src/apps/geoserver/wfs/src/main/java/org/geoserver/cloud/wfs/security/NoopLayerGroupContainmentCache.java
new file mode 100644
index 000000000..edec98b6f
--- /dev/null
+++ b/src/apps/geoserver/wfs/src/main/java/org/geoserver/cloud/wfs/security/NoopLayerGroupContainmentCache.java
@@ -0,0 +1,26 @@
+/*
+ * (c) 2024 Open Source Geospatial Foundation - all rights reserved This code is licensed under the
+ * GPL 2.0 license, available at the root application directory.
+ */
+package org.geoserver.cloud.wfs.security;
+
+import org.geoserver.catalog.LayerGroupInfo;
+import org.geoserver.catalog.impl.CatalogImpl;
+import org.geoserver.security.impl.LayerGroupContainmentCache;
+
+/**
+ * A no-op {@link LayerGroupContainmentCache}, since the WFS service does not deal with {@link
+ * LayerGroupInfo layer groups} at all, then avoid the starup overhead.
+ *
+ * @since 1.8.2
+ */
+public class NoopLayerGroupContainmentCache extends LayerGroupContainmentCache {
+
+    /**
+     * Since {@link LayerGroupContainmentCache} is a class and the initialization methods are
+     * private, we give it an empty in-memory catalog and call it a day
+     */
+    public NoopLayerGroupContainmentCache() {
+        super(new CatalogImpl());
+    }
+}
diff --git a/src/apps/geoserver/wfs/src/main/resources/META-INF/spring.factories b/src/apps/geoserver/wfs/src/main/resources/META-INF/spring.factories
index 7d1b69979..bbcd8a12b 100644
--- a/src/apps/geoserver/wfs/src/main/resources/META-INF/spring.factories
+++ b/src/apps/geoserver/wfs/src/main/resources/META-INF/spring.factories
@@ -1,2 +1,3 @@
 org.springframework.boot.autoconfigure.EnableAutoConfiguration=\
-org.geoserver.cloud.wfs.config.WfsAutoConfiguration
+org.geoserver.cloud.wfs.config.WfsAutoConfiguration,\
+org.geoserver.cloud.wfs.config.WfsSecurityOverridesAutoconfiguration
diff --git a/src/apps/geoserver/wfs/src/test/java/org/geoserver/cloud/wfs/app/WfsApplicationTest.java b/src/apps/geoserver/wfs/src/test/java/org/geoserver/cloud/wfs/app/WfsApplicationTest.java
index ac2c1166d..60b2b9dfd 100644
--- a/src/apps/geoserver/wfs/src/test/java/org/geoserver/cloud/wfs/app/WfsApplicationTest.java
+++ b/src/apps/geoserver/wfs/src/test/java/org/geoserver/cloud/wfs/app/WfsApplicationTest.java
@@ -4,11 +4,17 @@
  */
 package org.geoserver.cloud.wfs.app;
 
+import static org.assertj.core.api.Assertions.assertThat;
+
+import org.geoserver.cloud.wfs.security.NoopLayerGroupContainmentCache;
+import org.geoserver.security.impl.LayerGroupContainmentCache;
 import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.context.SpringBootTest.WebEnvironment;
 import org.springframework.boot.test.web.client.TestRestTemplate;
 import org.springframework.boot.test.web.server.LocalServerPort;
+import org.springframework.context.ApplicationContext;
 import org.xmlunit.assertj3.XmlAssert;
 
 import java.util.Map;
@@ -18,6 +24,8 @@ abstract class WfsApplicationTest {
 
     protected TestRestTemplate restTemplate = new TestRestTemplate("admin", "geoserver");
 
+    @Autowired protected ApplicationContext appContext;
+
     @Test
     void owsGetCapabilitiesSmokeTest(@LocalServerPort int servicePort) {
         String url =
@@ -41,4 +49,10 @@ void wfsGetCapabilitiesSmokeTest(@LocalServerPort int servicePort) {
                 .withNamespaceContext(nscontext)
                 .hasXPath("/wfs:WFS_Capabilities");
     }
+
+    @Test
+    void noopLayerGroupContainmentCache() {
+        var lgcc = appContext.getBean(LayerGroupContainmentCache.class);
+        assertThat(lgcc).isInstanceOf(NoopLayerGroupContainmentCache.class);
+    }
 }
diff --git a/src/catalog/backends/common/src/main/java/org/geoserver/cloud/config/catalog/backend/core/CoreBackendConfiguration.java b/src/catalog/backends/common/src/main/java/org/geoserver/cloud/config/catalog/backend/core/CoreBackendConfiguration.java
index eadede695..271c58683 100644
--- a/src/catalog/backends/common/src/main/java/org/geoserver/cloud/config/catalog/backend/core/CoreBackendConfiguration.java
+++ b/src/catalog/backends/common/src/main/java/org/geoserver/cloud/config/catalog/backend/core/CoreBackendConfiguration.java
@@ -128,6 +128,7 @@ DefaultResourceAccessManager defaultResourceAccessManager( //
      * Update: as of geoserver 2.23.2, {@code LayerGroupContainmentCache} implements {@code ApplicationListener<ContextRefreshedEvent>}
      */
     @Bean
+    @ConditionalOnMissingBean
     LayerGroupContainmentCache layerGroupContainmentCache(
             @Qualifier("rawCatalog") Catalog rawCatalog) {
         return new LayerGroupContainmentCache(rawCatalog);
diff --git a/src/catalog/backends/pgconfig/src/main/java/org/geoserver/cloud/backend/pgconfig/catalog/repository/CatalogInfoRowMapper.java b/src/catalog/backends/pgconfig/src/main/java/org/geoserver/cloud/backend/pgconfig/catalog/repository/CatalogInfoRowMapper.java
index a04582e11..026bab5aa 100644
--- a/src/catalog/backends/pgconfig/src/main/java/org/geoserver/cloud/backend/pgconfig/catalog/repository/CatalogInfoRowMapper.java
+++ b/src/catalog/backends/pgconfig/src/main/java/org/geoserver/cloud/backend/pgconfig/catalog/repository/CatalogInfoRowMapper.java
@@ -39,7 +39,7 @@
 /**
  * @since 1.4
  */
-@Slf4j(topic = "org.geoserver.cloud.backend.pgconfig.catalog.repository")
+@Slf4j(topic = "org.geoserver.cloud.backend.pgconfig.catalog.repository.rowmapper")
 public final class CatalogInfoRowMapper {
 
     protected static final ObjectMapper objectMapper = PgconfigObjectMapper.newObjectMapper();