diff --git a/gcc/cp/pt.cc b/gcc/cp/pt.cc
index fcc8e0d1d571ce4f8887d7b94d57afe8825534a2..e065ace5c55c64bc13e8c154dd0f6e8bf84578d4 100644
--- a/gcc/cp/pt.cc
+++ b/gcc/cp/pt.cc
@@ -16232,7 +16232,6 @@ tsubst (tree t, tree args, tsubst_flags_t complain, tree in_decl)
 	  {
 	  case TEMPLATE_TYPE_PARM:
 	  case TEMPLATE_TEMPLATE_PARM:
-	  case BOUND_TEMPLATE_TEMPLATE_PARM:
 	    if (cp_type_quals (t))
 	      {
 		r = tsubst (TYPE_MAIN_VARIANT (t), args, complain, in_decl);
@@ -16274,24 +16273,6 @@ tsubst (tree t, tree args, tsubst_flags_t complain, tree in_decl)
 		       only instantiated during satisfaction.  */
 		    PLACEHOLDER_TYPE_CONSTRAINTS_INFO (r) = ci;
 
-		if (code == BOUND_TEMPLATE_TEMPLATE_PARM)
-		  {
-		    tree tinfo = TYPE_TEMPLATE_INFO (t);
-		    /* We might need to substitute into the types of non-type
-		       template parameters.  */
-		    tree tmpl = tsubst (TI_TEMPLATE (tinfo), args,
-					complain, in_decl);
-		    if (tmpl == error_mark_node)
-		      return error_mark_node;
-		    tree argvec = tsubst (TI_ARGS (tinfo), args,
-					  complain, in_decl);
-		    if (argvec == error_mark_node)
-		      return error_mark_node;
-
-		    TEMPLATE_TEMPLATE_PARM_TEMPLATE_INFO (r)
-		      = build_template_info (tmpl, argvec);
-		  }
-
 		if (TYPE_STRUCTURAL_EQUALITY_P (t))
 		  SET_TYPE_STRUCTURAL_EQUALITY (r);
 		else
@@ -16299,6 +16280,26 @@ tsubst (tree t, tree args, tsubst_flags_t complain, tree in_decl)
 	      }
 	    break;
 
+	  case BOUND_TEMPLATE_TEMPLATE_PARM:
+	    {
+	      tree tinfo = TYPE_TEMPLATE_INFO (t);
+	      /* We might need to substitute into the types of non-type
+		 template parameters.  This also lowers the level of
+		 the ttp appropriately.  */
+	      tree tmpl = tsubst (TI_TEMPLATE (tinfo), args,
+				  complain, in_decl);
+	      if (tmpl == error_mark_node)
+		return error_mark_node;
+	      tree argvec = tsubst (TI_ARGS (tinfo), args,
+				    complain, in_decl);
+	      if (argvec == error_mark_node)
+		return error_mark_node;
+	      r = lookup_template_class (tmpl, argvec, in_decl, NULL_TREE,
+					 /*entering_scope=*/false, complain);
+	      r = cp_build_qualified_type (r, cp_type_quals (t), complain);
+	      break;
+	    }
+
 	  case TEMPLATE_PARM_INDEX:
 	    /* OK, now substitute the type of the non-type parameter.  We
 	       couldn't do it earlier because it might be an auto parameter,
diff --git a/gcc/testsuite/g++.dg/template/canon-type-20.C b/gcc/testsuite/g++.dg/template/canon-type-20.C
new file mode 100644
index 0000000000000000000000000000000000000000..211ca1067ed3ff55b0c877726af5c9e58b12051b
--- /dev/null
+++ b/gcc/testsuite/g++.dg/template/canon-type-20.C
@@ -0,0 +1,18 @@
+// PR c++/109531
+// { dg-do compile { target c++11 } }
+// { dg-additional-options "--param=hash-table-verification-limit=1000" }
+
+template<class T>
+using A = int;
+
+struct B { using type = int; };
+struct C { using type = A<int>; };
+
+template<class T>
+struct D {
+  template<template<class> class TT>
+  TT<typename T::type> f();
+};
+
+template struct D<B>;
+template struct D<C>;
diff --git a/gcc/testsuite/g++.dg/template/ttp36.C b/gcc/testsuite/g++.dg/template/ttp36.C
new file mode 100644
index 0000000000000000000000000000000000000000..c329bb429489cee6dd22d0b90f88920620224fcc
--- /dev/null
+++ b/gcc/testsuite/g++.dg/template/ttp36.C
@@ -0,0 +1,12 @@
+// Verify we propagate cv-quals when level-lowering a bound ttp.
+
+template<class T>
+struct B {
+  template<template<class> class TT>
+  void f(TT<T>*);
+
+  template<template<class> class TT>
+  void f(const TT<T>*); // { dg-bogus "cannot be overloaded" }
+};
+
+template struct B<int>;