diff --git a/syft/pkg/cataloger/binary/classifiers.go b/syft/pkg/cataloger/binary/classifiers.go
index afd4c7536..58c1e3e46 100644
--- a/syft/pkg/cataloger/binary/classifiers.go
+++ b/syft/pkg/cataloger/binary/classifiers.go
@@ -898,7 +898,13 @@ func DefaultClassifiers() []binutils.Classifier {
 		{
 			Class:    "gzip-binary",
 			FileGlob: "**/gzip",
+			// GNU gzip assembles its version banner at runtime from argv[0], so the version is stored as a
+			// bare NUL-delimited token with nothing to anchor against. Require a gzip-specific string
+			// elsewhere in the file before trusting that token, otherwise any binary reachable by a path
+			// named "gzip" (such as the busybox multicall binary, which provides a gzip applet by symlink)
+			// is reported as GNU gzip with an arbitrary version.
 			EvidenceMatcher: m.FileContentsVersionMatcher(
+				`not in gzip format|bug-gzip@gnu\.org|GZIP environment variable`,
 				`\x00(?P<version>[0-9]+\.[0-9]+)\x00`,
 			),
 			Package: "gzip",
diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip b/syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip
new file mode 100644
index 000000000..cb82dd439
Binary files /dev/null and b/syft/pkg/cataloger/binary/testdata/classifiers/negative/gzip differ
diff --git a/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip b/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip
index 64510d6c4..4fd3dbe2b 100644
Binary files a/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip and b/syft/pkg/cataloger/binary/testdata/classifiers/snippets/gzip/1.12/linux-amd64/gzip differ