diff --git a/java/ql/lib/change-notes/2023-08-23-deprecated-sensitiveapi-predicates.md b/java/ql/lib/change-notes/2023-08-23-deprecated-sensitiveapi-predicates.md
new file mode 100644
index 0000000000000..8cd9524e151f7
--- /dev/null
+++ b/java/ql/lib/change-notes/2023-08-23-deprecated-sensitiveapi-predicates.md
@@ -0,0 +1,4 @@
+---
+category: deprecated
+---
+* In `SensitiveApi.qll`, `javaApiCallablePasswordParam`, `javaApiCallableUsernameParam`, `javaApiCallableCryptoKeyParam`, and `otherApiCallableCredentialParam` predicates have been deprecated. They have been replaced with a new class `CredentialSinkNode` and its child classes `PasswordSink`, `UsernameSink`, and `CryptoKeySink`.