diff --git a/enrol/category/tests/plugin_test.php b/enrol/category/tests/plugin_test.php
index 3d9ab460137..7e264fc36c0 100644
--- a/enrol/category/tests/plugin_test.php
+++ b/enrol/category/tests/plugin_test.php
@@ -42,33 +42,15 @@ class enrol_category_plugin_testcase extends advanced_testcase {
     }
 
     protected function enable_role_sync($roleid) {
-        global $DB;
-
         $syscontext = context_system::instance();
 
-        if ($rc = $DB->record_exists('role_capabilities', array('capability'=>'enrol/category:synchronised', 'roleid'=>$roleid, 'contextid'=>$syscontext->id))) {
-            if ($rc->permission != CAP_ALLOW) {
-                $rc->permission = CAP_ALLOW;
-                $DB->update_record('role_capabilities', $rc);
-            }
-        } else {
-            $rc = new stdClass();
-            $rc->capability = 'enrol/category:synchronised';
-            $rc->roleid = $roleid;
-            $rc->contextid = $syscontext->id;
-            $rc->permission = CAP_ALLOW;
-            $rc->timemodified = time();
-            $rc->modifierid = 0;
-            $DB->insert_record('role_capabilities', $rc);
-        }
+        assign_capability('enrol/category:synchronised', CAP_ALLOW, $roleid, $syscontext, true);
     }
 
     protected function disable_role_sync($roleid) {
-        global $DB;
-
         $syscontext = context_system::instance();
 
-        $DB->delete_records('role_capabilities', array('capability'=>'enrol/category:synchronised', 'roleid'=>$roleid, 'contextid'=>$syscontext->id));
+        unassign_capability('enrol/category:synchronised', $roleid, $syscontext);
     }
 
     /**
diff --git a/lib/accesslib.php b/lib/accesslib.php
index b846108269b..28cbd102156 100644
--- a/lib/accesslib.php
+++ b/lib/accesslib.php
@@ -5156,15 +5156,23 @@ abstract class context extends stdClass implements IteratorAggregate {
         require_once($CFG->dirroot.'/grade/grading/lib.php');
         grading_manager::delete_all_for_context($this->_id);
 
-        $ids = $DB->get_fieldset_select('role_capabilities', 'DISTINCT roleid', 'contextid = ?', array($this->_id));
-
         // now delete stuff from role related tables, role_unassign_all
         // and unenrol should be called earlier to do proper cleanup
         $DB->delete_records('role_assignments', array('contextid'=>$this->_id));
-        $DB->delete_records('role_capabilities', array('contextid'=>$this->_id));
         $DB->delete_records('role_names', array('contextid'=>$this->_id));
+        $this->delete_capabilities();
+    }
 
+    /**
+     * Unassign all capabilities from a context.
+     */
+    public function delete_capabilities() {
+        global $DB;
+
+        $ids = $DB->get_fieldset_select('role_capabilities', 'DISTINCT roleid', 'contextid = ?', array($this->_id));
         if ($ids) {
+            $DB->delete_records('role_capabilities', array('contextid' => $this->_id));
+
             // Reset any cache of these roles, including MUC.
             accesslib_clear_role_cache($ids);
         }
diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index f9886b3580a..2e921e7c7d6 100644
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -5349,11 +5349,9 @@ function reset_course_userdata($data) {
     if (!empty($data->reset_roles_overrides)) {
         $children = $context->get_child_contexts();
         foreach ($children as $child) {
-            $DB->delete_records('role_capabilities', array('contextid' => $child->id));
+            $child->delete_capabilities();
         }
-        $DB->delete_records('role_capabilities', array('contextid' => $context->id));
-        // Force refresh for logged in users.
-        $context->mark_dirty();
+        $context->delete_capabilities();
         $status[] = array('component' => $componentstr, 'item' => get_string('deletecourseoverrides', 'role'), 'error' => false);
     }
 
diff --git a/lib/upgrade.txt b/lib/upgrade.txt
index 70b6a59494b..c323968130e 100644
--- a/lib/upgrade.txt
+++ b/lib/upgrade.txt
@@ -121,6 +121,7 @@ information provided here is intended especially for developers.
   - phone1
   - phone2
   - address
+* New function \context->delete_capabilities() correctly handles caching when deleting all of a context's capabilities.
 
 === 3.5 ===