diff --git a/syft/pkg/cataloger/binary/classifiers.go b/syft/pkg/cataloger/binary/classifiers.go
index 78f6e18ed..26fd9ce7f 100644
--- a/syft/pkg/cataloger/binary/classifiers.go
+++ b/syft/pkg/cataloger/binary/classifiers.go
@@ -899,6 +899,11 @@ func DefaultClassifiers() []binutils.Classifier {
 			Class:    "gzip-binary",
 			FileGlob: "**/gzip",
 			EvidenceMatcher: m.FileContentsVersionMatcher(
+				// GNU gzip keeps the version as a bare NUL-delimited token, so require an identifying
+				// string from the program as well. Without it any binary that happens to be named gzip
+				// (such as the busybox multicall binary behind a gzip applet symlink) would have an
+				// arbitrary NUL-delimited "N.N" token reported as a GNU gzip version.
+				`%s: %s: not in gzip format`,
 				`\x00(?P<version>[0-9]+\.[0-9]+)\x00`,
 			),
 			Package: "gzip",
diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip b/syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip
new file mode 100644
index 000000000..e6c2a242f
Binary files /dev/null and b/syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip differ
diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip b/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip
index 64510d6c4..16433fd67 100644
Binary files a/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip and b/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip differ