diff --git a/selfservice/flow/login/handler.go b/selfservice/flow/login/handler.go
index 9c4f7934fd86..bfb0e55026af 100644
--- a/selfservice/flow/login/handler.go
+++ b/selfservice/flow/login/handler.go
@@ -852,7 +852,9 @@ func (h *Handler) updateLoginFlow(w http.ResponseWriter, r *http.Request, _ http
 	}
 
 continueLogin:
-	if err := h.d.LoginHookExecutor().AfterSubmitLoginHook(w, r, f); err != nil {
+	// Fandom-start [SPLAT-638]: propagate session to webhook
+	if err := h.d.LoginHookExecutor().AfterSubmitLoginHook(w, r, f, sess); err != nil {
+		// Fandom-end [SPLAT-638]
 		h.d.LoginFlowErrorHandler().WriteFlowError(w, r, f, node.DefaultGroup, err)
 		return
 	}
diff --git a/selfservice/flow/login/hook.go b/selfservice/flow/login/hook.go
index 8402c2e078f6..09dda5dd2262 100644
--- a/selfservice/flow/login/hook.go
+++ b/selfservice/flow/login/hook.go
@@ -34,7 +34,7 @@ type (
 	}
 
 	AfterSubmitHookExecutor interface {
-		ExecuteAfterSubmitLoginHook(w http.ResponseWriter, r *http.Request, a *Flow) error
+		ExecuteAfterSubmitLoginHook(w http.ResponseWriter, r *http.Request, a *Flow, sess *session.Session) error
 	}
 
 	PostHookExecutor interface {
@@ -342,9 +342,10 @@ func (e *HookExecutor) PostLoginHook(
 	return nil
 }
 
-func (e *HookExecutor) AfterSubmitLoginHook(w http.ResponseWriter, r *http.Request, a *Flow) error {
+// Fandom-start [SPLAT-638]: propagate session to webhook
+func (e *HookExecutor) AfterSubmitLoginHook(w http.ResponseWriter, r *http.Request, a *Flow, sess *session.Session) error {
 	for _, executor := range e.d.AfterSubmitLoginHooks(r.Context()) {
-		if err := executor.ExecuteAfterSubmitLoginHook(w, r, a); err != nil {
+		if err := executor.ExecuteAfterSubmitLoginHook(w, r, a, sess); err != nil {
 			return err
 		}
 	}
@@ -352,6 +353,8 @@ func (e *HookExecutor) AfterSubmitLoginHook(w http.ResponseWriter, r *http.Reque
 	return nil
 }
 
+// Fandom-end [SPLAT-638]
+
 func (e *HookExecutor) PreLoginHook(w http.ResponseWriter, r *http.Request, a *Flow) error {
 	for _, executor := range e.d.PreLoginHooks(r.Context()) {
 		if err := executor.ExecuteLoginPreHook(w, r, a); err != nil {
diff --git a/selfservice/flow/login/hook_test.go b/selfservice/flow/login/hook_test.go
index ffbd75b650ef..7ba5f31ebdca 100644
--- a/selfservice/flow/login/hook_test.go
+++ b/selfservice/flow/login/hook_test.go
@@ -59,7 +59,7 @@ func TestLoginExecutor(t *testing.T) {
 				router.GET("/login/submit", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
 					loginFlow, err := login.NewFlow(conf, time.Minute, "", r, ft)
 					require.NoError(t, err)
-					if testhelpers.SelfServiceHookLoginErrorHandler(t, w, r, reg.LoginHookExecutor().AfterSubmitLoginHook(w, r, loginFlow)) {
+					if testhelpers.SelfServiceHookLoginErrorHandler(t, w, r, reg.LoginHookExecutor().AfterSubmitLoginHook(w, r, loginFlow, session.NewInactiveSession())) {
 						_, _ = w.Write([]byte("ok"))
 					}
 				})
diff --git a/selfservice/hook/error.go b/selfservice/hook/error.go
index 8ce35c967212..49fb4b325176 100644
--- a/selfservice/hook/error.go
+++ b/selfservice/hook/error.go
@@ -72,7 +72,7 @@ func (e Error) ExecuteLoginPreHook(w http.ResponseWriter, r *http.Request, a *lo
 	return e.err("ExecuteLoginPreHook", login.ErrHookAbortFlow)
 }
 
-func (e Error) ExecuteAfterSubmitLoginHook(w http.ResponseWriter, r *http.Request, a *login.Flow) error {
+func (e Error) ExecuteAfterSubmitLoginHook(w http.ResponseWriter, r *http.Request, a *login.Flow, sess *session.Session) error {
 	return e.err("ExecuteAfterSubmitLoginHook", login.ErrHookAbortFlow)
 }
 
diff --git a/selfservice/hook/web_hook.go b/selfservice/hook/web_hook.go
index 86961d696dea..39a9adac5407 100644
--- a/selfservice/hook/web_hook.go
+++ b/selfservice/hook/web_hook.go
@@ -153,7 +153,8 @@ func (e *WebHook) ExecuteLoginPreHook(_ http.ResponseWriter, req *http.Request,
 	})
 }
 
-func (e *WebHook) ExecuteAfterSubmitLoginHook(_ http.ResponseWriter, req *http.Request, flow *login.Flow) error {
+// Fandom-start [SPLAT-638]: propagate session to webhook
+func (e *WebHook) ExecuteAfterSubmitLoginHook(_ http.ResponseWriter, req *http.Request, flow *login.Flow, sess *session.Session) error {
 	if req.Body != nil {
 		if err := req.ParseForm(); err != nil {
 			return errors.WithStack(err)
@@ -162,6 +163,7 @@ func (e *WebHook) ExecuteAfterSubmitLoginHook(_ http.ResponseWriter, req *http.R
 
 	return otelx.WithSpan(req.Context(), "selfservice.hook.WebHook.ExecuteAfterSubmitLoginHook", func(ctx context.Context) error {
 		return e.execute(ctx, &templateContext{
+			Identity:       &identity.Identity{ID: sess.IdentityID},
 			Flow:           flow,
 			RequestHeaders: req.Header,
 			RequestMethod:  req.Method,
@@ -172,6 +174,8 @@ func (e *WebHook) ExecuteAfterSubmitLoginHook(_ http.ResponseWriter, req *http.R
 	})
 }
 
+// Fandom-end [SPLAT-638]
+
 func (e *WebHook) ExecuteLoginPostHook(_ http.ResponseWriter, req *http.Request, _ node.UiNodeGroup, flow *login.Flow, session *session.Session) error {
 	// fandom-start
 	if req.Body != nil {