diff --git a/java/ql/lib/change-notes/2026-04-23-hibernate-queryproducer-sinks.md b/java/ql/lib/change-notes/2026-04-23-hibernate-queryproducer-sinks.md
new file mode 100644
index 000000000000..018ce8d348e7
--- /dev/null
+++ b/java/ql/lib/change-notes/2026-04-23-hibernate-queryproducer-sinks.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added `sql-injection` sink models for the Hibernate `org.hibernate.query.QueryProducer` methods `createNativeMutationQuery`, `createMutationQuery`, and `createSelectionQuery`.
diff --git a/java/ql/lib/ext/org.hibernate.query.model.yml b/java/ql/lib/ext/org.hibernate.query.model.yml
index bb6232c1fcdd..5eccefd0dfa0 100644
--- a/java/ql/lib/ext/org.hibernate.query.model.yml
+++ b/java/ql/lib/ext/org.hibernate.query.model.yml
@@ -4,5 +4,8 @@ extensions:
       extensible: sinkModel
     data:
       - ["org.hibernate.query", "QueryProducer", True, "createNativeQuery", "", "", "Argument[0]", "sql-injection", "manual"]
+      - ["org.hibernate.query", "QueryProducer", True, "createNativeMutationQuery", "", "", "Argument[0]", "sql-injection", "manual"]
       - ["org.hibernate.query", "QueryProducer", True, "createQuery", "", "", "Argument[0]", "sql-injection", "manual"]
+      - ["org.hibernate.query", "QueryProducer", True, "createMutationQuery", "", "", "Argument[0]", "sql-injection", "manual"]
+      - ["org.hibernate.query", "QueryProducer", True, "createSelectionQuery", "", "", "Argument[0]", "sql-injection", "manual"]
       - ["org.hibernate.query", "QueryProducer", True, "createSQLQuery", "", "", "Argument[0]", "sql-injection", "manual"]
diff --git a/java/ql/test/query-tests/security/CWE-089/semmle/examples/Hibernate.java b/java/ql/test/query-tests/security/CWE-089/semmle/examples/Hibernate.java
new file mode 100644
index 000000000000..ae61f60e0d06
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-089/semmle/examples/Hibernate.java
@@ -0,0 +1,25 @@
+import org.hibernate.Session;
+import org.hibernate.SharedSessionContract;
+import org.hibernate.query.QueryProducer;
+
+public class Hibernate {
+
+  public static String source() { return null; }
+
+  public static void test(
+      Session session, SharedSessionContract sharedSessionContract, QueryProducer queryProducer) {
+    session.createQuery(source()); // $ sqlInjection
+    session.createSQLQuery(source()); // $ sqlInjection
+
+    sharedSessionContract.createQuery(source()); // $ sqlInjection
+    sharedSessionContract.createSQLQuery(source()); // $ sqlInjection
+
+    queryProducer.createNativeQuery(source()); // $ sqlInjection
+    queryProducer.createNativeMutationQuery(source()); // $ sqlInjection
+    queryProducer.createQuery(source()); // $ sqlInjection
+    queryProducer.createMutationQuery(source()); // $ sqlInjection
+    queryProducer.createSelectionQuery(source()); // $ sqlInjection
+    queryProducer.createSelectionQuery(source(), Object.class); // $ sqlInjection
+    queryProducer.createSQLQuery(source()); // $ sqlInjection
+  }
+}
diff --git a/java/ql/test/query-tests/security/CWE-089/semmle/examples/options b/java/ql/test/query-tests/security/CWE-089/semmle/examples/options
index 8f5ee4913cc8..223a083bc767 100644
--- a/java/ql/test/query-tests/security/CWE-089/semmle/examples/options
+++ b/java/ql/test/query-tests/security/CWE-089/semmle/examples/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/mongodbClient:${testdir}/../../../../../stubs/couchbaseClient:${testdir}/../../../../../stubs/springframework-5.8.x:${testdir}/../../../../../stubs/apache-hive:${testdir}/../../../../../stubs/jakarta-persistence-api-3.2.0 --release 21
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/mongodbClient:${testdir}/../../../../../stubs/couchbaseClient:${testdir}/../../../../../stubs/springframework-5.8.x:${testdir}/../../../../../stubs/apache-hive:${testdir}/../../../../../stubs/jakarta-persistence-api-3.2.0:${testdir}/../../../../../stubs/hibernate-5.x --release 21
diff --git a/java/ql/test/stubs/hibernate-5.x/org/hibernate/Session.java b/java/ql/test/stubs/hibernate-5.x/org/hibernate/Session.java
new file mode 100644
index 000000000000..80b3553e70bf
--- /dev/null
+++ b/java/ql/test/stubs/hibernate-5.x/org/hibernate/Session.java
@@ -0,0 +1,10 @@
+package org.hibernate;
+
+import org.hibernate.query.Query;
+
+public interface Session extends SharedSessionContract {
+
+  Query createQuery(String queryString);
+
+  Query createSQLQuery(String queryString);
+}
diff --git a/java/ql/test/stubs/hibernate-5.x/org/hibernate/SharedSessionContract.java b/java/ql/test/stubs/hibernate-5.x/org/hibernate/SharedSessionContract.java
new file mode 100644
index 000000000000..dbc196749716
--- /dev/null
+++ b/java/ql/test/stubs/hibernate-5.x/org/hibernate/SharedSessionContract.java
@@ -0,0 +1,11 @@
+package org.hibernate;
+
+import org.hibernate.query.Query;
+import org.hibernate.query.QueryProducer;
+
+public interface SharedSessionContract extends QueryProducer {
+
+  Query createQuery(String queryString);
+
+  Query createSQLQuery(String queryString);
+}
diff --git a/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/MutationQuery.java b/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/MutationQuery.java
new file mode 100644
index 000000000000..cb7004932e03
--- /dev/null
+++ b/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/MutationQuery.java
@@ -0,0 +1,4 @@
+package org.hibernate.query;
+
+public interface MutationQuery {
+}
diff --git a/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/Query.java b/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/Query.java
new file mode 100644
index 000000000000..8aa3f169bf2b
--- /dev/null
+++ b/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/Query.java
@@ -0,0 +1,4 @@
+package org.hibernate.query;
+
+public interface Query {
+}
diff --git a/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/QueryProducer.java b/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/QueryProducer.java
new file mode 100644
index 000000000000..364dc30dd634
--- /dev/null
+++ b/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/QueryProducer.java
@@ -0,0 +1,18 @@
+package org.hibernate.query;
+
+public interface QueryProducer {
+
+  Query createNativeQuery(String sqlString);
+
+  MutationQuery createNativeMutationQuery(String sqlString);
+
+  Query createQuery(String queryString);
+
+  MutationQuery createMutationQuery(String hqlString);
+
+  SelectionQuery<?> createSelectionQuery(String hqlString);
+
+  <R> SelectionQuery<R> createSelectionQuery(String hqlString, Class<R> resultType);
+
+  Query createSQLQuery(String queryString);
+}
diff --git a/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/SelectionQuery.java b/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/SelectionQuery.java
new file mode 100644
index 000000000000..9eb9fddf5968
--- /dev/null
+++ b/java/ql/test/stubs/hibernate-5.x/org/hibernate/query/SelectionQuery.java
@@ -0,0 +1,4 @@
+package org.hibernate.query;
+
+public interface SelectionQuery<R> {
+}