diff --git a/java/ql/integration-tests/java/buildless-paths/codescanning-config.yml b/java/ql/integration-tests/java/buildless-paths/codescanning-config.yml
new file mode 100644
index 000000000000..9baea12fdfe5
--- /dev/null
+++ b/java/ql/integration-tests/java/buildless-paths/codescanning-config.yml
@@ -0,0 +1,4 @@
+paths:
+ - include
+paths-ignore:
+ - include/exclude
diff --git a/java/ql/integration-tests/java/buildless-paths/include/ShouldAppear2.java b/java/ql/integration-tests/java/buildless-paths/include/ShouldAppear2.java
new file mode 100644
index 000000000000..09e2bc29dcce
--- /dev/null
+++ b/java/ql/integration-tests/java/buildless-paths/include/ShouldAppear2.java
@@ -0,0 +1 @@
+public class ShouldAppear2 { }
diff --git a/java/ql/integration-tests/java/buildless-paths/include/ShouldAppear2.xml b/java/ql/integration-tests/java/buildless-paths/include/ShouldAppear2.xml
new file mode 100644
index 000000000000..5c2795036a0c
--- /dev/null
+++ b/java/ql/integration-tests/java/buildless-paths/include/ShouldAppear2.xml
@@ -0,0 +1 @@
+
diff --git a/java/ql/integration-tests/java/buildless-paths/include/exclude/ShouldNotAppear3.java b/java/ql/integration-tests/java/buildless-paths/include/exclude/ShouldNotAppear3.java
new file mode 100644
index 000000000000..164b0c1d1d80
--- /dev/null
+++ b/java/ql/integration-tests/java/buildless-paths/include/exclude/ShouldNotAppear3.java
@@ -0,0 +1 @@
+public class ShouldNotAppear3 { }
diff --git a/java/ql/integration-tests/java/buildless-paths/include/exclude/ShouldNotAppear3.xml b/java/ql/integration-tests/java/buildless-paths/include/exclude/ShouldNotAppear3.xml
new file mode 100644
index 000000000000..5c2795036a0c
--- /dev/null
+++ b/java/ql/integration-tests/java/buildless-paths/include/exclude/ShouldNotAppear3.xml
@@ -0,0 +1 @@
+
diff --git a/java/ql/integration-tests/java/buildless-paths/sibling/ShouldNotAppear1.java b/java/ql/integration-tests/java/buildless-paths/sibling/ShouldNotAppear1.java
new file mode 100644
index 000000000000..55a0b62aa88b
--- /dev/null
+++ b/java/ql/integration-tests/java/buildless-paths/sibling/ShouldNotAppear1.java
@@ -0,0 +1 @@
+public class ShouldNotAppear1 { }
diff --git a/java/ql/integration-tests/java/buildless-paths/sibling/ShouldNotAppear1.xml b/java/ql/integration-tests/java/buildless-paths/sibling/ShouldNotAppear1.xml
new file mode 100644
index 000000000000..5c2795036a0c
--- /dev/null
+++ b/java/ql/integration-tests/java/buildless-paths/sibling/ShouldNotAppear1.xml
@@ -0,0 +1 @@
+
diff --git a/java/ql/integration-tests/java/buildless-paths/test.expected b/java/ql/integration-tests/java/buildless-paths/test.expected
new file mode 100644
index 000000000000..95b59dab6b15
--- /dev/null
+++ b/java/ql/integration-tests/java/buildless-paths/test.expected
@@ -0,0 +1,4 @@
+javaFiles
+| include/ShouldAppear2.java:0:0:0:0 | ShouldAppear2 |
+#select
+| include/ShouldAppear2.xml:0:0:0:0 | include/ShouldAppear2.xml |
diff --git a/java/ql/integration-tests/java/buildless-paths/test.py b/java/ql/integration-tests/java/buildless-paths/test.py
new file mode 100644
index 000000000000..bbbf14aaa2c3
--- /dev/null
+++ b/java/ql/integration-tests/java/buildless-paths/test.py
@@ -0,0 +1,5 @@
+import os
+import os.path
+
+def test(codeql, java):
+ codeql.database.create(build_mode = "none", codescanning_config = "codescanning-config.yml")
diff --git a/java/ql/integration-tests/java/buildless-paths/test.ql b/java/ql/integration-tests/java/buildless-paths/test.ql
new file mode 100644
index 000000000000..3023403edfcd
--- /dev/null
+++ b/java/ql/integration-tests/java/buildless-paths/test.ql
@@ -0,0 +1,6 @@
+import java
+
+query predicate javaFiles(File f) { f.isJavaSourceFile() }
+
+from XmlFile f
+select f
diff --git a/java/ql/lib/change-notes/2025-12-16-java-xml-paths.md b/java/ql/lib/change-notes/2025-12-16-java-xml-paths.md
new file mode 100644
index 000000000000..877d0e7e2edd
--- /dev/null
+++ b/java/ql/lib/change-notes/2025-12-16-java-xml-paths.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* When a code-scanning configuration specifies the `paths:` and/or `paths-ignore:` settings, these are now taken into account by the Java extractor's search for XML and properties files.