diff --git a/base/comps/components.toml b/base/comps/components.toml
index cf47ecdc76a..caa1759cbcb 100644
--- a/base/comps/components.toml
+++ b/base/comps/components.toml
@@ -2080,7 +2080,6 @@ overlay-files = ["overlays/*.overlay.toml"]
 [components.mimalloc]
 [components.minicom]
 [components.miniz]
-[components.minizip-ng]
 [components.mint-themes]
 [components.mintlocale]
 [components.miopen]
diff --git a/base/comps/minizip-ng/minizip-ng.comp.toml b/base/comps/minizip-ng/minizip-ng.comp.toml
new file mode 100644
index 00000000000..143c39bf104
--- /dev/null
+++ b/base/comps/minizip-ng/minizip-ng.comp.toml
@@ -0,0 +1,34 @@
+[components.minizip-ng]
+
+# Remove the two password-protected (encrypted) libFuzzer seed-corpus zips that
+# fail the package-signing scan. The archive is repacked; the resulting hash is
+# pinned via the source-files entry.
+[[components.minizip-ng.overlays]]
+description = "Remove encrypted fuzz seed-corpus zips"
+type = "file-remove"
+archive = "minizip-ng-4.0.10.tar.gz"
+file = "test/fuzz/unzip_fuzzer_seed_corpus/encrypted_*.zip"
+[components.minizip-ng.overlays.metadata]
+category = "azl-security-compliance"
+upstream-status = "inapplicable"
+
+# Drop the two CTest cases that read the removed fixtures. The spec has no %check
+# so nothing runs them, but this keeps the test registration consistent.
+[[components.minizip-ng.overlays]]
+description = "Drop CTest cases that read the removed encrypted fuzz zips"
+type = "file-search-replace"
+archive = "minizip-ng-4.0.10.tar.gz"
+file = "CMakeLists.txt"
+regex = '(?s)\n +if\(MZ_PKCRYPT\)\n +add_test\(NAME unzip-pkcrypt.*?add_test\(NAME unzip-wzaes.*?\n +endif\(\)'
+[components.minizip-ng.overlays.metadata]
+category = "azl-security-compliance"
+upstream-status = "inapplicable"
+
+# Pin the post-overlay (repacked) tarball, replacing the upstream sources entry.
+[[components.minizip-ng.source-files]]
+filename = "minizip-ng-4.0.10.tar.gz"
+hash = "9cb38550aec5f7983d8f3afd7ed376a05c9d0d4347507f8aea426d75da2d5d90555a671da9dbdd7982d3916f0371b4cb1cb647ed2a641e8256202cd8d4737fd7"
+hash-type = "SHA512"
+origin = { type = "overlay" }
+replace-upstream = true
+replace-reason = "Removes test/fuzz/unzip_fuzzer_seed_corpus/encrypted_{pkcrypt,wzaes}.zip (password-protected fuzz seed-corpus fixtures) that fail the package-signing scan, and the two CTest cases that read them; test-only, not shipped in any binary RPM."
diff --git a/locks/minizip-ng.lock b/locks/minizip-ng.lock
index d60db203fe1..19c0a25fb07 100644
--- a/locks/minizip-ng.lock
+++ b/locks/minizip-ng.lock
@@ -3,5 +3,5 @@ version = 1
 import-commit = 'e0c98c9ec9570c6d92979b9b6cb03f7fa80e5a73'
 upstream-commit = 'e0c98c9ec9570c6d92979b9b6cb03f7fa80e5a73'
 manual-bump = 2
-input-fingerprint = 'sha256:f44df5edb628d3924096deff909eebfb062d6ba23719f119a4d35dbd4c3338e7'
+input-fingerprint = 'sha256:47f84d9c6de35182a7a68efc36ca009319aefc68e415e81a2297dc239d3c1514'
 resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
diff --git a/specs/m/minizip-ng/minizip-ng.spec b/specs/m/minizip-ng/minizip-ng.spec
index 0234e519301..e2b6b8e5d88 100644
--- a/specs/m/minizip-ng/minizip-ng.spec
+++ b/specs/m/minizip-ng/minizip-ng.spec
@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.8.3)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 5;
+    release_number = 6;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -196,6 +196,9 @@ _EOF_
 
 %changelog
 ## START: Generated by rpmautospec
+* Tue Aug 25 2026 Andrew Phelps <anphel@microsoft.com> - 4.0.10-6
+- fix: minizip-ng - remove flagged files
+
 * Wed Aug 19 2026 reuben olinsky <reubeno@users.noreply.github.com> - 4.0.10-5
 - build: mass rebuild auto-bumpable components
 
diff --git a/specs/m/minizip-ng/sources b/specs/m/minizip-ng/sources
index 01ce769d039..3638a7270e4 100644
--- a/specs/m/minizip-ng/sources
+++ b/specs/m/minizip-ng/sources
@@ -1 +1 @@
-SHA512 (minizip-ng-4.0.10.tar.gz) = a74386e2cf89f63d7fc9bf53527c8203ac78c46f2511e4883d17d949ec4e7d1b6c3707bcb13c3fc7cc4db8255b5f50ddb61bedba10e683acb18d112470676f62
+SHA512 (minizip-ng-4.0.10.tar.gz) = 9cb38550aec5f7983d8f3afd7ed376a05c9d0d4347507f8aea426d75da2d5d90555a671da9dbdd7982d3916f0371b4cb1cb647ed2a641e8256202cd8d4737fd7