diff --git a/base/comps/components.toml b/base/comps/components.toml
index 97f2eeadc6f..0b00b20688c 100644
--- a/base/comps/components.toml
+++ b/base/comps/components.toml
@@ -6580,7 +6580,6 @@ overlay-files = ["overlays/*.overlay.toml"]
 [components.sgpio]
 [components.sgx-rpm-macros]
 [components.shaderc]
-[components.shadow-utils]
 [components.shake]
 [components.shapelib]
 [components.shared-mime-info]
diff --git a/base/comps/shadow-utils/overlays/0001-configure-cis-account-aging.overlay.toml b/base/comps/shadow-utils/overlays/0001-configure-cis-account-aging.overlay.toml
new file mode 100644
index 00000000000..3845bedc2d7
--- /dev/null
+++ b/base/comps/shadow-utils/overlays/0001-configure-cis-account-aging.overlay.toml
@@ -0,0 +1,23 @@
+[metadata]
+category = "azl-security-compliance"
+upstream-status = "inapplicable"
+bugs = [
+    { url = "https://dev.azure.com/mariner-org/mariner/_workitems/edit/22929" },
+    { url = "https://dev.azure.com/mariner-org/mariner/_workitems/edit/22930" },
+]
+
+# These defaults apply only when useradd creates an account; existing platform
+# accounts retain their current aging policy.
+[[overlays]]
+description = "Set the CIS maximum password age for new accounts"
+type = "file-search-replace"
+file = "shadow-utils.login.defs"
+regex = '(?m)^PASS_MAX_DAYS\s+\d+$'
+replacement = "PASS_MAX_DAYS\t365"
+
+[[overlays]]
+description = "Lock inactive password accounts after the CIS grace period"
+type = "file-search-replace"
+file = "shadow-utils.useradd"
+regex = '(?m)^INACTIVE=-?\d+$'
+replacement = "INACTIVE=30"
diff --git a/base/comps/shadow-utils/shadow-utils.comp.toml b/base/comps/shadow-utils/shadow-utils.comp.toml
new file mode 100644
index 00000000000..a9e84b57ff1
--- /dev/null
+++ b/base/comps/shadow-utils/shadow-utils.comp.toml
@@ -0,0 +1 @@
+[components.shadow-utils]
diff --git a/locks/shadow-utils.lock b/locks/shadow-utils.lock
index f907e937e57..e211b7d6fed 100644
--- a/locks/shadow-utils.lock
+++ b/locks/shadow-utils.lock
@@ -3,5 +3,5 @@ version = 1
 import-commit = 'b75f74d3f1b086fd5e699e55f131ae9e1beca525'
 upstream-commit = 'b75f74d3f1b086fd5e699e55f131ae9e1beca525'
 manual-bump = 2
-input-fingerprint = 'sha256:150fe6edc893cb2948b25784f202abee5da23bd9d96b628db616e0aa8d57d71c'
+input-fingerprint = 'sha256:57dd9d454cf706a01ee62266029fdb35365a122cc1f03df45a8c0ac93f8eba5a'
 resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
diff --git a/specs/s/shadow-utils/shadow-utils.login.defs b/specs/s/shadow-utils/shadow-utils.login.defs
index e84c7ab2386..71abfcb0b85 100644
--- a/specs/s/shadow-utils/shadow-utils.login.defs
+++ b/specs/s/shadow-utils/shadow-utils.login.defs
@@ -128,7 +128,7 @@ HOME_MODE	0700
 #	PASS_MIN_LEN	Minimum acceptable password length.
 #	PASS_WARN_AGE	Number of days warning given before a password expires.
 #
-PASS_MAX_DAYS	99999
+PASS_MAX_DAYS	365
 PASS_MIN_DAYS	0
 PASS_MIN_LEN	8
 PASS_WARN_AGE	7
diff --git a/specs/s/shadow-utils/shadow-utils.spec b/specs/s/shadow-utils/shadow-utils.spec
index eac01a65e17..da33fbc1b3b 100644
--- a/specs/s/shadow-utils/shadow-utils.spec
+++ b/specs/s/shadow-utils/shadow-utils.spec
@@ -4,7 +4,7 @@
 Summary: Utilities for managing accounts and shadow password files
 Name: shadow-utils
 Version: 4.18.0
-Release: 6%{?dist}
+Release: 7%{?dist}
 Epoch: 2
 License: BSD-3-Clause AND GPL-2.0-or-later
 URL: https://github.com/shadow-maint/shadow
diff --git a/specs/s/shadow-utils/shadow-utils.useradd b/specs/s/shadow-utils/shadow-utils.useradd
index 4e811469e1f..16b0886cc81 100644
--- a/specs/s/shadow-utils/shadow-utils.useradd
+++ b/specs/s/shadow-utils/shadow-utils.useradd
@@ -1,7 +1,7 @@
 # useradd defaults file
 GROUP=100
 HOME=/home
-INACTIVE=-1
+INACTIVE=30
 EXPIRE=
 SHELL=/bin/bash
 SKEL=/etc/skel