diff --git a/src/jdk.internal.vm.ci/share/classes/jdk/vm/ci/meta/ResolvedJavaType.java b/src/jdk.internal.vm.ci/share/classes/jdk/vm/ci/meta/ResolvedJavaType.java
index c951d43b3de..14589c2bca4 100644
--- a/src/jdk.internal.vm.ci/share/classes/jdk/vm/ci/meta/ResolvedJavaType.java
+++ b/src/jdk.internal.vm.ci/share/classes/jdk/vm/ci/meta/ResolvedJavaType.java
@@ -258,12 +258,13 @@ default ResolvedJavaType getElementalType() {
      * whether a type is a direct or indirect permitted subtype. The order of the results matches
      * that of {@link Class#getPermittedSubclasses()}.
      * <p>
-     * If the type is not sealed, returns {@code null}.
+     * If this type is not sealed, returns {@code null}. Returning a list with length 0 means
+     * this type is sealed and has no permitted subclasses. That is, it is effectively final.
      *
      * @return unmodifiable list of permitted subtypes, or {@code null} if this type is not sealed
      * @see Class#getPermittedSubclasses()
      */
-    List<JavaType> getPermittedSubclasses();
+    List<? extends JavaType> getPermittedSubclasses();
 
     /**
      * Returns {@code true} if and only if this type represents a sealed class or
diff --git a/test/hotspot/jtreg/compiler/jvmci/jdk.vm.ci.runtime.test/src/jdk/vm/ci/runtime/test/TestResolvedJavaType.java b/test/hotspot/jtreg/compiler/jvmci/jdk.vm.ci.runtime.test/src/jdk/vm/ci/runtime/test/TestResolvedJavaType.java
index f67832407b8..041748f05fd 100644
--- a/test/hotspot/jtreg/compiler/jvmci/jdk.vm.ci.runtime.test/src/jdk/vm/ci/runtime/test/TestResolvedJavaType.java
+++ b/test/hotspot/jtreg/compiler/jvmci/jdk.vm.ci.runtime.test/src/jdk/vm/ci/runtime/test/TestResolvedJavaType.java
@@ -740,7 +740,7 @@ public void getPermittedSubclassesTest() {
     private void assertGetPermittedSubclasses(Class<?> clazz) {
         ResolvedJavaType type = metaAccess.lookupJavaType(clazz);
         assertEquals("Sealed status mismatch for class '" + clazz.getName(), clazz.isSealed(), type.isSealed());
-        List<JavaType> actual = type.getPermittedSubclasses();
+        List<? extends JavaType> actual = type.getPermittedSubclasses();
         Class<?>[] expected = clazz.getPermittedSubclasses();
         if (expected == null) {
             assertNull(actual);
@@ -1356,7 +1356,7 @@ public void getAnnotationDataTest() throws Exception {
         "getElementalType",
         "getEnclosingType",
         "lookupType",
-        "isSealed", // tested with getPermittedSubsclasses
+        "isSealed", // tested with getPermittedSubclasses
         "resolveField",
         "$jacocoInit"
     };