diff --git a/syft/pkg/cataloger/debian/parse_deb_archive_test.go b/syft/pkg/cataloger/debian/parse_deb_archive_test.go
index 7afa0a455..ad8c00ddf 100644
--- a/syft/pkg/cataloger/debian/parse_deb_archive_test.go
+++ b/syft/pkg/cataloger/debian/parse_deb_archive_test.go
@@ -375,7 +375,7 @@ func Test_processDataTar_capsCopyrightFiles(t *testing.T) {
 func Test_decompressionStream_failsEarlyInsteadOfBuffering(t *testing.T) {
 	const expanded = 512 * intFile.MB
 
-	// a few KB of input expanding to 512MB, so heap is what separates a streaming bound from a
+	// well under 1% of input expanding to 512MB, so heap is what separates a streaming bound from a
 	// bound checked after the read completes
 	var gz bytes.Buffer
 	gw := gzip.NewWriter(&gz)
@@ -386,7 +386,9 @@ func Test_decompressionStream_failsEarlyInsteadOfBuffering(t *testing.T) {
 		remaining -= int64(n)
 	}
 	require.NoError(t, gw.Close())
-	require.Less(t, gz.Len(), 1024*1024, "compressed payload should be tiny relative to what it expands to")
+	// a ratio rather than a fixed size: deflate output for zeros is toolchain dependent (about 510KB on
+	// go1.26, about 1MB on go1.27), and only the ratio matters to the test
+	require.Less(t, gz.Len(), expanded/100, "compressed payload should be tiny relative to what it expands to")
 
 	// both arms use io.ReadAll on purpose. The stream itself never holds much whatever the cap says,
 	// so copying to io.Discard measures nothing; what the cap actually protects is a consumer that