diff --git a/plugins/permission-node/report.api.md b/plugins/permission-node/report.api.md
index 3859427ddf..adfeec0039 100644
--- a/plugins/permission-node/report.api.md
+++ b/plugins/permission-node/report.api.md
@@ -203,10 +203,17 @@ export function createPermissionResourceRef<TResource, TQuery>(): {
 export function createPermissionRule<
   TResource,
   TQuery,
+  TQueryOutput extends TQuery,
   TResourceType extends string,
   TParams extends PermissionRuleParams = undefined,
 >(
-  rule: CreatePermissionRuleOptions<TResource, TQuery, TResourceType, TParams>,
+  rule: CreatePermissionRuleOptions<
+    TResource,
+    TQuery,
+    TQueryOutput,
+    TResourceType,
+    TParams
+  >,
 ): PermissionRule<TResource, TQuery, TResourceType, TParams>;
 
 // @public @deprecated
@@ -223,15 +230,16 @@ export function createPermissionRule<
 export type CreatePermissionRuleOptions<
   TResource,
   TQuery,
+  TQueryOutput extends TQuery,
   TResourceType extends string,
-  TParams extends PermissionRuleParams = PermissionRuleParams,
+  TParams extends PermissionRuleParams,
 > = {
   name: string;
   description: string;
   resourceRef: PermissionResourceRef<TResource, TQuery, TResourceType>;
   paramsSchema?: z.ZodSchema<TParams>;
   apply(resource: TResource, params: NoInfer_2<TParams>): boolean;
-  toQuery(params: NoInfer_2<TParams>): PermissionCriteria<TQuery>;
+  toQuery(params: NoInfer_2<TParams>): PermissionCriteria<TQueryOutput>;
 };
 
 // @public
diff --git a/plugins/permission-node/src/integration/createPermissionRule.ts b/plugins/permission-node/src/integration/createPermissionRule.ts
index 2e9833c32e..4625fb5af8 100644
--- a/plugins/permission-node/src/integration/createPermissionRule.ts
+++ b/plugins/permission-node/src/integration/createPermissionRule.ts
@@ -29,8 +29,9 @@ import { NoInfer } from './util';
 export type CreatePermissionRuleOptions<
   TResource,
   TQuery,
+  TQueryOutput extends TQuery,
   TResourceType extends string,
-  TParams extends PermissionRuleParams = PermissionRuleParams,
+  TParams extends PermissionRuleParams,
 > = {
   name: string;
   description: string;
@@ -54,7 +55,7 @@ export type CreatePermissionRuleOptions<
    * can be used for loading a collection of resources efficiently with conditional criteria already
    * applied.
    */
-  toQuery(params: NoInfer<TParams>): PermissionCriteria<TQuery>;
+  toQuery(params: NoInfer<TParams>): PermissionCriteria<TQueryOutput>;
 };
 
 /**
@@ -65,10 +66,17 @@ export type CreatePermissionRuleOptions<
 export function createPermissionRule<
   TResource,
   TQuery,
+  TQueryOutput extends TQuery,
   TResourceType extends string,
   TParams extends PermissionRuleParams = undefined,
 >(
-  rule: CreatePermissionRuleOptions<TResource, TQuery, TResourceType, TParams>,
+  rule: CreatePermissionRuleOptions<
+    TResource,
+    TQuery,
+    TQueryOutput,
+    TResourceType,
+    TParams
+  >,
 ): PermissionRule<TResource, TQuery, TResourceType, TParams>;
 /**
  * Helper function to ensure that {@link PermissionRule} definitions are typed correctly.
@@ -87,12 +95,19 @@ export function createPermissionRule<
 export function createPermissionRule<
   TResource,
   TQuery,
+  TQueryOutput extends TQuery,
   TResourceType extends string,
   TParams extends PermissionRuleParams = undefined,
 >(
   rule:
     | PermissionRule<TResource, TQuery, TResourceType, TParams>
-    | CreatePermissionRuleOptions<TResource, TQuery, TResourceType, TParams>,
+    | CreatePermissionRuleOptions<
+        TResource,
+        TQuery,
+        TQueryOutput,
+        TResourceType,
+        TParams
+      >,
 ): PermissionRule<TResource, TQuery, TResourceType, TParams> {
   if ('resourceRef' in rule) {
     return { ...rule, resourceType: rule.resourceRef.resourceType };