Index: src/wp-admin/customize.php
===================================================================
--- src/wp-admin/customize.php	(revision 36678)
+++ src/wp-admin/customize.php	(working copy)
@@ -55,6 +55,9 @@
 wp_enqueue_script( 'customize-controls' );
 wp_enqueue_style( 'customize-controls' );
 
+// Setup heartbeat to keep nonces up to date.
+wp_enqueue_script( 'heartbeat' );
+
 /**
  * Enqueue Customizer control scripts.
  *
Index: src/wp-admin/includes/admin-filters.php
===================================================================
--- src/wp-admin/includes/admin-filters.php	(revision 36678)
+++ src/wp-admin/includes/admin-filters.php	(working copy)
@@ -80,6 +80,10 @@
 // Theme hooks.
 add_action( 'customize_controls_print_footer_scripts', 'customize_themes_print_templates' );
 
+// Customizer hooks: refresh the customizer nonces using the hearbeat api.
+add_filter( 'heartbeat_received', 'wp_refresh_customizer_nonces', 10,  3 );
+
+
 // Theme Install hooks.
 // add_action('install_themes_dashboard', 'install_themes_dashboard');
 // add_action('install_themes_upload', 'install_themes_upload', 10, 0);
Index: src/wp-admin/includes/ajax-actions.php
===================================================================
--- src/wp-admin/includes/ajax-actions.php	(revision 36678)
+++ src/wp-admin/includes/ajax-actions.php	(working copy)
@@ -2707,7 +2707,6 @@
 			wp_send_json( $response );
 		}
 	}
-
 	if ( ! empty( $data ) ) {
 		/**
 		 * Filter the Heartbeat response received.
Index: src/wp-admin/includes/misc.php
===================================================================
--- src/wp-admin/includes/misc.php	(revision 36678)
+++ src/wp-admin/includes/misc.php	(working copy)
@@ -843,6 +843,30 @@
 	return $response;
 }
 
+	/**
+	 * Return refreshed customizer nonces when needed.
+	 *
+	 * @since 4.5.0
+	 */
+function wp_refresh_customizer_nonces( $response, $data, $screen_id ) {
+
+	if ( array_key_exists( 'wp-refresh-customizer-nonce', $data ) ) {
+
+		// Bootstrap the customizer.
+		require_once ABSPATH . WPINC . '/class-wp-customize-manager.php';
+		$GLOBALS['wp_customize'] = new WP_Customize_Manager();
+		$wp_customize            = $GLOBALS['wp_customize'];
+
+		$received = $data['wp-refresh-customizer-nonce'];
+
+		if ( 2 === wp_verify_nonce( $received['save'], 'save-customize_' . $wp_customize->get_stylesheet() ) ) {
+			$response['wp-refresh-customizer-nonce'] = $wp_customize->get_nonces();
+		}
+	}
+
+	return $response;
+}
+
 /**
  * Disable suspension of Heartbeat on the Add/Edit Post screens.
  *
Index: src/wp-admin/js/customize-controls.js
===================================================================
--- src/wp-admin/js/customize-controls.js	(revision 36678)
+++ src/wp-admin/js/customize-controls.js	(working copy)
@@ -2946,6 +2946,18 @@
 				active: $.Deferred()
 			};
 
+			// When the heartbeat returns a refreshed nonce array, apply it.
+			$( document ).on( 'heartbeat-tick.wp-refresh-nonces', function( e, data ) {
+				if ( 'undefined' !== typeof data['wp-refresh-customizer-nonce'] ) {
+					api.trigger( 'nonce-refresh', data['wp-refresh-customizer-nonce'] );
+				}
+			} );
+
+			// Attach our existing nonce to the heartbeat request, so it can be checked for expiration.
+			$( document ).on( 'heartbeat-send.wp-refresh-nonces', function( e, data ) {
+				data['wp-refresh-customizer-nonce'] = api.settings.nonce;
+			} );
+
 			/*
 			 * Wrap this.refresh to prevent it from hammering the servers:
 			 *