From 55a3fb1025f505350740b93ceb98e5322db4e3da Mon Sep 17 00:00:00 2001
From: Nan Liu <liunan@microsoft.com>
Date: Wed, 1 Jul 2026 20:39:54 +0000
Subject: [PATCH 1/3] chore(comps): annotate azl-pruning overlays with metadata

Migrate all azl-pruning components to the per-file overlay layout with
file-level metadata (category = "azl-pruning"). A handful of migrated
components carry sibling overlays in other categories, which move with
them and keep their own metadata: azl-release-management,
azl-disable-unsupported-tests, azl-compatibility,
azl-dep-missing-workaround, azl-security-compliance,
azl-platform-adaptation, and azl-branding-policy (notably systemd, which
spans several).

46 qemu overlays are consolidated into a single overlay
file using TOML 1.1.0 multi-line inline tables to preserve their exact
interleaved apply order and section comments.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../GraphicsMagick/GraphicsMagick.comp.toml   |  14 -
 ...drop-libheif-build-dependency.overlay.toml |  17 +
 base/comps/SDL2_image/SDL2_image.comp.toml    |  12 -
 ...e-libavif-devel-buildrequires.overlay.toml |  15 +
 base/comps/SDL3_image/SDL3_image.comp.toml    |  26 --
 ...e-cmake-libavif-buildrequires.overlay.toml |  29 ++
 base/comps/anaconda/anaconda.comp.toml        |  25 --
 ...rop-requires-flatpak-anaconda.overlay.toml |  23 ++
 ...0002-guard-gi-require-version.overlay.toml |   8 +
 base/comps/coin-or-Cbc/coin-or-Cbc.comp.toml  |  24 --
 ...able-highs-buildrequires-coin.overlay.toml |  27 ++
 base/comps/curl/curl.comp.toml                |  14 -
 ...ython3-impacket-buildrequires.overlay.toml |   9 +
 .../0002-annotate-now-empty-if.overlay.toml   |  13 +
 base/comps/dogtag-pki/dogtag-pki.comp.toml    |  36 --
 ...01-retarget-java-runtime-java.overlay.toml |  40 +++
 base/comps/dtc/dtc.comp.toml                  |  11 -
 ...01-disable-mingw-sub-packages.overlay.toml |  15 +
 base/comps/edk2/edk2.comp.toml                |  60 ----
 .../0001-disable-xen-ovmf-build.overlay.toml  |  34 ++
 ...rkaround-remove-virt-firmware.overlay.toml |  34 ++
 base/comps/elfutils/elfutils.comp.toml        |   5 -
 ...-remove-elfutils-default-yama.overlay.toml |   8 +
 base/comps/erlang/erlang.comp.toml            |  37 --
 .../0001-disable-erlang-wx-sub.overlay.toml   |  40 +++
 .../comps/fence-agents/fence-agents.comp.toml |  10 -
 ...01-remove-fence-agents-xenapi.overlay.toml |  14 +
 .../festival-freebsoft-utils.comp.toml        |  11 -
 ...01-drop-buildrequires-sox-sox.overlay.toml |  15 +
 base/comps/firefox/firefox.comp.toml          | 111 ------
 .../0001-disable-build-time-test.overlay.toml |  34 ++
 .../0002-skip-fedora-s-mozilla.overlay.toml   |  61 ++++
 ...pose-release-upstream-release.overlay.toml |  25 ++
 base/comps/freerdp/freerdp.comp.toml          |  31 --
 ...-buildrequires-pkgconfig-opus.overlay.toml |  17 +
 ...p-buildrequires-pkgconfig-fdk.overlay.toml |  18 +
 base/comps/gcab/gcab.comp.toml                |  11 -
 ...01-disable-mingw-sub-packages.overlay.toml |  15 +
 base/comps/gcc/gcc.comp.toml                  |  53 ---
 ...-disable-ada-language-support.overlay.toml |  56 +++
 base/comps/gdb/gdb.comp.toml                  |   6 -
 ...emove-recommends-default-yama.overlay.toml |  10 +
 base/comps/giflib/giflib.comp.toml            |  89 -----
 ...ove-mingw32-giflib-subpackage.overlay.toml |  92 +++++
 base/comps/glycin/glycin.comp.toml            |  12 -
 .../0001-remove-glycin-heif-jxl.overlay.toml  |   9 +
 .../gnome-remote-desktop.comp.toml            | 108 ------
 ...nditional-pkgconfig-ffnvcodec.overlay.toml |  17 +
 .../0002-remove-rdp-only-enable.overlay.toml  |  98 +++++
 .../gnome-session/gnome-session.comp.toml     |  34 --
 ...emove-package-wayland-session.overlay.toml |  32 ++
 .../gstreamer1-plugins-base.comp.toml         |  23 --
 ...move-opus-devel-buildrequires.overlay.toml |  24 ++
 .../gstreamer1-plugins-good.comp.toml         |  23 --
 ...ve-libv4l-devel-buildrequires.overlay.toml |  24 ++
 base/comps/gtk-vnc/gtk-vnc.comp.toml          |  11 -
 ...01-disable-mingw-sub-packages.overlay.toml |  15 +
 base/comps/gtk4/gtk4.comp.toml                |  36 --
 ...-missing-libdrm-buildrequires.overlay.toml |  14 +
 ...002-remove-gstreamer-player-1.overlay.toml |  27 ++
 base/comps/gvfs/gvfs.comp.toml                |  15 -
 ...drequires-pkgconfig-libbluray.overlay.toml |  17 +
 base/comps/hidapi/hidapi.comp.toml            |  77 ----
 ...ove-mingw32-hidapi-subpackage.overlay.toml |  80 +++++
 base/comps/imlib2/imlib2.comp.toml            |  13 -
 ...drop-libheif-build-dependency.overlay.toml |  16 +
 base/comps/imsettings/imsettings.comp.toml    |  10 -
 ...-cinnamon-subpackage-cinnamon.overlay.toml |  14 +
 .../jack-audio-connection-kit.comp.toml       |  16 -
 ...move-opus-devel-buildrequires.overlay.toml |  17 +
 .../java-25-openjdk-portable.comp.toml        |  26 --
 ...d-release-upstream-rpmrelease.overlay.toml |   9 +
 ...-override-buildjdkver-java-25.overlay.toml |   9 +
 ...3-remove-upstream-java-latest.overlay.toml |  18 +
 base/comps/jss/jss.comp.toml                  |  24 --
 ...0001-retarget-java-devel-java.overlay.toml |  28 ++
 base/comps/jxrlib/jxrlib.comp.toml            |  84 -----
 ...ove-mingw32-jxrlib-subpackage.overlay.toml |  87 +++++
 .../kf6-breeze-icons.comp.toml                |  17 -
 ...-disable-fedora-specific-icon.overlay.toml |  21 ++
 .../kf6-kfilemetadata.comp.toml               |   5 -
 ...rop-buildrequires-ffmpeg-free.overlay.toml |   9 +
 .../kf6-kimageformats.comp.toml               |  29 --
 ...drop-libheif-build-dependency.overlay.toml |  22 ++
 ...libavif-buildrequires-libavif.overlay.toml |  11 +
 base/comps/kiwi/kiwi.comp.toml                |   6 -
 ...move-dependency-older-version.overlay.toml |  10 +
 base/comps/libfabric/libfabric.comp.toml      |   5 -
 ...1-remove-infinipath-psm-devel.overlay.toml |   9 +
 base/comps/libgsf/libgsf.comp.toml            |  11 -
 ...01-disable-mingw-sub-packages.overlay.toml |  15 +
 base/comps/libplacebo/libplacebo.comp.toml    |  20 --
 ...p-libdovi-devel-buildrequires.overlay.toml |  22 ++
 .../comps/libquicktime/libquicktime.comp.toml |  12 -
 ...ove-faad2-devel-buildrequires.overlay.toml |  16 +
 base/comps/librsvg2/librsvg2.comp.toml        |   6 -
 ...1-disable-avif-support-remove.overlay.toml |   9 +
 base/comps/libsndfile/libsndfile.comp.toml    |  38 --
 ...move-opus-devel-buildrequires.overlay.toml |  39 ++
 base/comps/libsoup3/libsoup3.comp.toml        |   9 -
 ...01-disable-mingw-sub-packages.overlay.toml |  13 +
 .../comps/libvncserver/libvncserver.comp.toml |  23 --
 ...requires-libavformat-removing.overlay.toml |  26 ++
 base/comps/libyaml/libyaml.comp.toml          |  11 -
 ...01-disable-mingw-sub-packages.overlay.toml |  15 +
 base/comps/libzypp/libzypp.comp.toml          |   5 -
 ...buildrequires-cmake-notcurses.overlay.toml |   9 +
 base/comps/mesa/mesa.comp.toml                |  14 -
 ...move-unavailable-rust-toolset.overlay.toml |  12 +
 .../0002-add-cargo-rpm-macros.overlay.toml    |   9 +
 base/comps/mivisionx/mivisionx.comp.toml      |  11 -
 ...buildrequires-libavcodec-free.overlay.toml |  15 +
 base/comps/nghttp2/nghttp2.comp.toml          |   9 -
 .../0001-disable-mingw-support.overlay.toml   |  13 +
 base/comps/nuspell/nuspell.comp.toml          | 117 ------
 ...ve-mingw32-nuspell-subpackage.overlay.toml | 120 +++++++
 base/comps/openal-soft/openal-soft.comp.toml  |   5 -
 ...requires-pkgconfig-libavcodec.overlay.toml |   8 +
 base/comps/opencv/opencv.comp.toml            |  50 ---
 ...libavif-buildrequires-libavif.overlay.toml |  18 +
 .../0002-remove-cve-2025-53644.overlay.toml   |  20 ++
 ...ve-libv4l-devel-buildrequires.overlay.toml |  18 +
 ...emove-yasm-buildrequires-yasm.overlay.toml |  21 ++
 base/comps/p7zip/p7zip.comp.toml              |  18 -
 ...-release-upstream-baserelease.overlay.toml |   9 +
 ...-force-disable-meson-features.overlay.toml |  39 ++
 .../0003-remove-spa-v4l2-plugin.overlay.toml  |  21 ++
 ...0004-remove-pkgconfig-fdk-aac.overlay.toml |  26 ++
 base/comps/pipewire/pipewire.comp.toml        | 102 ------
 ...ldrequires-kpipewire-removing.overlay.toml |  15 +
 .../plasma-desktop/plasma-desktop.comp.toml   |  11 -
 ...buildrequires-kpipewire-devel.overlay.toml |   9 +
 .../plasma-workspace.comp.toml                |   5 -
 ...ove-buildrequires-maven-local.overlay.toml |  18 +
 .../plexus-velocity/plexus-velocity.comp.toml |  15 -
 ...isable-fedora-specific-charge.overlay.toml |  23 ++
 base/comps/plymouth/plymouth.comp.toml        |  19 -
 ...rop-texlive-kpathsea-requires.overlay.toml |  24 ++
 base/comps/po4a/po4a.comp.toml                |  21 --
 ...-add-release-upstream-release.overlay.toml |  17 +
 ...-disable-gdm-hooks-subpackage.overlay.toml |  13 +
 ...03-disable-webrtc-aec-backend.overlay.toml |  30 ++
 base/comps/pulseaudio/pulseaudio.comp.toml    |  49 ---
 ...mingw32-python3-geographiclib.overlay.toml |  52 +++
 ...eutralize-mingw32-wheel-build.overlay.toml |  38 ++
 .../python-geographiclib.comp.toml            |  84 -----
 ...1-disable-doc-generation-work.overlay.toml |  13 +
 .../python-openstackclient.comp.toml          |   9 -
 ...001-remove-python-xmp-toolkit.overlay.toml |  13 +
 .../python-pikepdf/python-pikepdf.comp.toml   |  11 -
 ...-disable-doc-generation-cliff.overlay.toml |  14 +
 .../python-stestr/python-stestr.comp.toml     |  10 -
 ...eded-features-and-subpackages.overlay.toml | 339 ++++++++++++++++++
 base/comps/qemu/qemu.comp.toml                |  98 -----
 ...-remove-gstreamer-plugins-bad.overlay.toml |  47 +++
 .../qt6-qtmultimedia.comp.toml                |  44 ---
 ...-clear-qt6-qtwebengine-arches.overlay.toml |  19 +
 base/comps/qt6/qt6.comp.toml                  |  16 -
 ...ove-buildrequires-maven-local.overlay.toml |  18 +
 base/comps/resteasy/resteasy.comp.toml        |  15 -
 ...driver-chromium-buildrequires.overlay.toml |  15 +
 ...-disable-system-testing-tests.overlay.toml |   9 +
 .../rubygem-actionpack.comp.toml              |  22 --
 ...p-buildrequires-bindir-ffmpeg.overlay.toml |  27 ++
 ...002-skip-audio-video-analyzer.overlay.toml |   9 +
 .../rubygem-activestorage.comp.toml           |  29 --
 ...driver-chromium-buildrequires.overlay.toml |  18 +
 ...emove-selenium-webdriver-test.overlay.toml |  15 +
 .../rubygem-railties.comp.toml                |  31 --
 ...driver-buildrequires-packaged.overlay.toml |  22 ++
 .../rubygem-selenium-webdriver.comp.toml      |  18 -
 ...0001-remove-package-xen-devel.overlay.toml |  23 ++
 .../rust-vm-memory/rust-vm-memory.comp.toml   |  19 -
 ...0001-disable-test-sub-package.overlay.toml |   9 +
 .../sblim-cmpi-base/sblim-cmpi-base.comp.toml |   5 -
 ...move-opus-devel-buildrequires.overlay.toml |  17 +
 base/comps/spice-gtk/spice-gtk.comp.toml      |  16 -
 ...move-opus-devel-buildrequires.overlay.toml |  17 +
 base/comps/spice/spice.comp.toml              |  15 -
 .../0001-bump-release-0-33.overlay.toml       |  19 +
 ...ove-mingw32-gcc-buildrequires.overlay.toml |  44 +++
 base/comps/syslinux/syslinux.comp.toml        |  56 ---
 ...1-lower-buildrequires-setup-2.overlay.toml |  19 +
 ...emove-xen-devel-buildrequires.overlay.toml |  15 +
 .../0003-disable-udev-rule-sets.overlay.toml  |  10 +
 ...004-set-default-llmnr-support.overlay.toml |   9 +
 ...-remove-build-params-reducing.overlay.toml |  15 +
 base/comps/systemd/systemd.comp.toml          |  53 ---
 ...001-remove-unpackaged-usr-bin.overlay.toml |  14 +
 base/comps/tuna/tuna.comp.toml                |  15 -
 ...drop-libheif-build-dependency.overlay.toml |  50 +++
 base/comps/vips/vips.comp.toml                |  48 ---
 ...libavif-buildrequires-libavif.overlay.toml |   8 +
 ...-remove-gstreamer-plugins-bad.overlay.toml |  15 +
 ...recommends-gstreamer1-plugins.overlay.toml |  18 +
 base/comps/webkitgtk/webkitgtk.comp.toml      |  35 --
 ...uildrequires-neatvnc-removing.overlay.toml |  27 ++
 base/comps/weston/weston.comp.toml            |  23 --
 ...move-opus-devel-buildrequires.overlay.toml |  11 +
 base/comps/wireshark/wireshark.comp.toml      |   9 -
 ...remove-gstreamer1-plugins-bad.overlay.toml |  28 ++
 base/comps/wxGTK/wxGTK.comp.toml              |  26 --
 202 files changed, 3004 insertions(+), 2448 deletions(-)
 create mode 100644 base/comps/GraphicsMagick/overlays/0001-drop-libheif-build-dependency.overlay.toml
 create mode 100644 base/comps/SDL2_image/overlays/0001-remove-libavif-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/SDL3_image/overlays/0001-remove-cmake-libavif-buildrequires.overlay.toml
 create mode 100644 base/comps/anaconda/overlays/0001-drop-requires-flatpak-anaconda.overlay.toml
 create mode 100644 base/comps/anaconda/overlays/0002-guard-gi-require-version.overlay.toml
 create mode 100644 base/comps/coin-or-Cbc/overlays/0001-disable-highs-buildrequires-coin.overlay.toml
 create mode 100644 base/comps/curl/overlays/0001-drop-python3-impacket-buildrequires.overlay.toml
 create mode 100644 base/comps/curl/overlays/0002-annotate-now-empty-if.overlay.toml
 create mode 100644 base/comps/dogtag-pki/overlays/0001-retarget-java-runtime-java.overlay.toml
 create mode 100644 base/comps/dtc/overlays/0001-disable-mingw-sub-packages.overlay.toml
 create mode 100644 base/comps/edk2/overlays/0001-disable-xen-ovmf-build.overlay.toml
 create mode 100644 base/comps/edk2/overlays/0002-workaround-remove-virt-firmware.overlay.toml
 create mode 100644 base/comps/elfutils/overlays/0001-remove-elfutils-default-yama.overlay.toml
 create mode 100644 base/comps/erlang/overlays/0001-disable-erlang-wx-sub.overlay.toml
 create mode 100644 base/comps/fence-agents/overlays/0001-remove-fence-agents-xenapi.overlay.toml
 create mode 100644 base/comps/festival-freebsoft-utils/overlays/0001-drop-buildrequires-sox-sox.overlay.toml
 create mode 100644 base/comps/firefox/overlays/0001-disable-build-time-test.overlay.toml
 create mode 100644 base/comps/firefox/overlays/0002-skip-fedora-s-mozilla.overlay.toml
 create mode 100644 base/comps/firefox/overlays/0003-compose-release-upstream-release.overlay.toml
 create mode 100644 base/comps/freerdp/overlays/0001-drop-buildrequires-pkgconfig-opus.overlay.toml
 create mode 100644 base/comps/freerdp/overlays/0002-drop-buildrequires-pkgconfig-fdk.overlay.toml
 create mode 100644 base/comps/gcab/overlays/0001-disable-mingw-sub-packages.overlay.toml
 create mode 100644 base/comps/gcc/overlays/0001-disable-ada-language-support.overlay.toml
 create mode 100644 base/comps/gdb/overlays/0001-remove-recommends-default-yama.overlay.toml
 create mode 100644 base/comps/giflib/overlays/0001-remove-mingw32-giflib-subpackage.overlay.toml
 create mode 100644 base/comps/glycin/overlays/0001-remove-glycin-heif-jxl.overlay.toml
 create mode 100644 base/comps/gnome-remote-desktop/overlays/0001-drop-unconditional-pkgconfig-ffnvcodec.overlay.toml
 create mode 100644 base/comps/gnome-remote-desktop/overlays/0002-remove-rdp-only-enable.overlay.toml
 create mode 100644 base/comps/gnome-session/overlays/0001-remove-package-wayland-session.overlay.toml
 create mode 100644 base/comps/gstreamer1-plugins-base/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/gstreamer1-plugins-good/overlays/0001-remove-libv4l-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/gtk-vnc/overlays/0001-disable-mingw-sub-packages.overlay.toml
 create mode 100644 base/comps/gtk4/overlays/0001-add-missing-libdrm-buildrequires.overlay.toml
 create mode 100644 base/comps/gtk4/overlays/0002-remove-gstreamer-player-1.overlay.toml
 create mode 100644 base/comps/gvfs/overlays/0001-drop-buildrequires-pkgconfig-libbluray.overlay.toml
 create mode 100644 base/comps/hidapi/overlays/0001-remove-mingw32-hidapi-subpackage.overlay.toml
 create mode 100644 base/comps/imlib2/overlays/0001-drop-libheif-build-dependency.overlay.toml
 create mode 100644 base/comps/imsettings/overlays/0001-drop-cinnamon-subpackage-cinnamon.overlay.toml
 create mode 100644 base/comps/jack-audio-connection-kit/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/java-25-openjdk-portable/overlays/0001-add-release-upstream-rpmrelease.overlay.toml
 create mode 100644 base/comps/java-25-openjdk-portable/overlays/0002-override-buildjdkver-java-25.overlay.toml
 create mode 100644 base/comps/java-25-openjdk-portable/overlays/0003-remove-upstream-java-latest.overlay.toml
 create mode 100644 base/comps/jss/overlays/0001-retarget-java-devel-java.overlay.toml
 create mode 100644 base/comps/jxrlib/overlays/0001-remove-mingw32-jxrlib-subpackage.overlay.toml
 create mode 100644 base/comps/kf6-breeze-icons/overlays/0001-disable-fedora-specific-icon.overlay.toml
 create mode 100644 base/comps/kf6-kfilemetadata/overlays/0001-drop-buildrequires-ffmpeg-free.overlay.toml
 create mode 100644 base/comps/kf6-kimageformats/overlays/0001-drop-libheif-build-dependency.overlay.toml
 create mode 100644 base/comps/kf6-kimageformats/overlays/0002-remove-libavif-buildrequires-libavif.overlay.toml
 create mode 100644 base/comps/kiwi/overlays/0001-remove-dependency-older-version.overlay.toml
 create mode 100644 base/comps/libfabric/overlays/0001-remove-infinipath-psm-devel.overlay.toml
 create mode 100644 base/comps/libgsf/overlays/0001-disable-mingw-sub-packages.overlay.toml
 create mode 100644 base/comps/libplacebo/overlays/0001-drop-libdovi-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/libquicktime/overlays/0001-remove-faad2-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/librsvg2/overlays/0001-disable-avif-support-remove.overlay.toml
 create mode 100644 base/comps/libsndfile/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/libsoup3/overlays/0001-disable-mingw-sub-packages.overlay.toml
 create mode 100644 base/comps/libvncserver/overlays/0001-drop-buildrequires-libavformat-removing.overlay.toml
 create mode 100644 base/comps/libyaml/overlays/0001-disable-mingw-sub-packages.overlay.toml
 create mode 100644 base/comps/libzypp/overlays/0001-drop-buildrequires-cmake-notcurses.overlay.toml
 create mode 100644 base/comps/mesa/overlays/0001-remove-unavailable-rust-toolset.overlay.toml
 create mode 100644 base/comps/mesa/overlays/0002-add-cargo-rpm-macros.overlay.toml
 create mode 100644 base/comps/mivisionx/overlays/0001-drop-buildrequires-libavcodec-free.overlay.toml
 create mode 100644 base/comps/nghttp2/overlays/0001-disable-mingw-support.overlay.toml
 create mode 100644 base/comps/nuspell/overlays/0001-remove-mingw32-nuspell-subpackage.overlay.toml
 create mode 100644 base/comps/openal-soft/overlays/0001-drop-buildrequires-pkgconfig-libavcodec.overlay.toml
 create mode 100644 base/comps/opencv/overlays/0001-remove-libavif-buildrequires-libavif.overlay.toml
 create mode 100644 base/comps/opencv/overlays/0002-remove-cve-2025-53644.overlay.toml
 create mode 100644 base/comps/opencv/overlays/0003-remove-libv4l-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/p7zip/overlays/0001-remove-yasm-buildrequires-yasm.overlay.toml
 create mode 100644 base/comps/pipewire/overlays/0001-add-release-upstream-baserelease.overlay.toml
 create mode 100644 base/comps/pipewire/overlays/0002-force-disable-meson-features.overlay.toml
 create mode 100644 base/comps/pipewire/overlays/0003-remove-spa-v4l2-plugin.overlay.toml
 create mode 100644 base/comps/pipewire/overlays/0004-remove-pkgconfig-fdk-aac.overlay.toml
 create mode 100644 base/comps/plasma-desktop/overlays/0001-drop-buildrequires-kpipewire-removing.overlay.toml
 create mode 100644 base/comps/plasma-workspace/overlays/0001-drop-buildrequires-kpipewire-devel.overlay.toml
 create mode 100644 base/comps/plexus-velocity/overlays/0001-remove-buildrequires-maven-local.overlay.toml
 create mode 100644 base/comps/plymouth/overlays/0001-disable-fedora-specific-charge.overlay.toml
 create mode 100644 base/comps/po4a/overlays/0001-drop-texlive-kpathsea-requires.overlay.toml
 create mode 100644 base/comps/pulseaudio/overlays/0001-add-release-upstream-release.overlay.toml
 create mode 100644 base/comps/pulseaudio/overlays/0002-disable-gdm-hooks-subpackage.overlay.toml
 create mode 100644 base/comps/pulseaudio/overlays/0003-disable-webrtc-aec-backend.overlay.toml
 create mode 100644 base/comps/python-geographiclib/overlays/0001-remove-mingw32-python3-geographiclib.overlay.toml
 create mode 100644 base/comps/python-geographiclib/overlays/0002-neutralize-mingw32-wheel-build.overlay.toml
 create mode 100644 base/comps/python-openstackclient/overlays/0001-disable-doc-generation-work.overlay.toml
 create mode 100644 base/comps/python-pikepdf/overlays/0001-remove-python-xmp-toolkit.overlay.toml
 create mode 100644 base/comps/python-stestr/overlays/0001-disable-doc-generation-cliff.overlay.toml
 create mode 100644 base/comps/qemu/overlays/0001-disable-unneeded-features-and-subpackages.overlay.toml
 create mode 100644 base/comps/qt6-qtmultimedia/overlays/0001-remove-gstreamer-plugins-bad.overlay.toml
 create mode 100644 base/comps/qt6/overlays/0001-clear-qt6-qtwebengine-arches.overlay.toml
 create mode 100644 base/comps/resteasy/overlays/0001-remove-buildrequires-maven-local.overlay.toml
 create mode 100644 base/comps/rubygem-actionpack/overlays/0001-remove-chromedriver-chromium-buildrequires.overlay.toml
 create mode 100644 base/comps/rubygem-actionpack/overlays/0002-disable-system-testing-tests.overlay.toml
 create mode 100644 base/comps/rubygem-activestorage/overlays/0001-drop-buildrequires-bindir-ffmpeg.overlay.toml
 create mode 100644 base/comps/rubygem-activestorage/overlays/0002-skip-audio-video-analyzer.overlay.toml
 create mode 100644 base/comps/rubygem-railties/overlays/0001-remove-chromedriver-chromium-buildrequires.overlay.toml
 create mode 100644 base/comps/rubygem-railties/overlays/0002-remove-selenium-webdriver-test.overlay.toml
 create mode 100644 base/comps/rubygem-selenium-webdriver/overlays/0001-remove-chromedriver-buildrequires-packaged.overlay.toml
 create mode 100644 base/comps/rust-vm-memory/overlays/0001-remove-package-xen-devel.overlay.toml
 create mode 100644 base/comps/sblim-cmpi-base/overlays/0001-disable-test-sub-package.overlay.toml
 create mode 100644 base/comps/spice-gtk/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/spice/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/syslinux/overlays/0001-bump-release-0-33.overlay.toml
 create mode 100644 base/comps/syslinux/overlays/0002-remove-mingw32-gcc-buildrequires.overlay.toml
 create mode 100644 base/comps/systemd/overlays/0001-lower-buildrequires-setup-2.overlay.toml
 create mode 100644 base/comps/systemd/overlays/0002-remove-xen-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/systemd/overlays/0003-disable-udev-rule-sets.overlay.toml
 create mode 100644 base/comps/systemd/overlays/0004-set-default-llmnr-support.overlay.toml
 create mode 100644 base/comps/systemd/overlays/0005-remove-build-params-reducing.overlay.toml
 create mode 100644 base/comps/tuna/overlays/0001-remove-unpackaged-usr-bin.overlay.toml
 create mode 100644 base/comps/vips/overlays/0001-drop-libheif-build-dependency.overlay.toml
 create mode 100644 base/comps/webkitgtk/overlays/0001-remove-libavif-buildrequires-libavif.overlay.toml
 create mode 100644 base/comps/webkitgtk/overlays/0002-remove-gstreamer-plugins-bad.overlay.toml
 create mode 100644 base/comps/webkitgtk/overlays/0003-remove-recommends-gstreamer1-plugins.overlay.toml
 create mode 100644 base/comps/weston/overlays/0001-drop-buildrequires-neatvnc-removing.overlay.toml
 create mode 100644 base/comps/wireshark/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
 create mode 100644 base/comps/wxGTK/overlays/0001-remove-gstreamer1-plugins-bad.overlay.toml

diff --git a/base/comps/GraphicsMagick/GraphicsMagick.comp.toml b/base/comps/GraphicsMagick/GraphicsMagick.comp.toml
index 5f331129625..47998b4e351 100644
--- a/base/comps/GraphicsMagick/GraphicsMagick.comp.toml
+++ b/base/comps/GraphicsMagick/GraphicsMagick.comp.toml
@@ -1,15 +1 @@
 [components.GraphicsMagick]
-
-# Disable HEIF support — libheif is being retired from Azure Linux 4.0.
-# Upstream spec has no explicit `--with-heif`/`--without-heif` flag in
-# `%configure`; the heif coder is auto-detected via pkg-config when
-# libheif-devel is present. Removing the BuildRequires causes configure
-# to skip heif, and no plugin file is produced (the GraphicsMagick %files
-# section globs `%{_libdir}/GraphicsMagick-*/modules-*/coders/`, so a
-# missing heif coder doesn't trigger an "unpackaged file" error).
-
-[[components.GraphicsMagick.overlays]]
-description = "Drop libheif build dependency ahead of libheif removal from Azure Linux 4.0"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "libheif-devel"
diff --git a/base/comps/GraphicsMagick/overlays/0001-drop-libheif-build-dependency.overlay.toml b/base/comps/GraphicsMagick/overlays/0001-drop-libheif-build-dependency.overlay.toml
new file mode 100644
index 00000000000..aae1885890e
--- /dev/null
+++ b/base/comps/GraphicsMagick/overlays/0001-drop-libheif-build-dependency.overlay.toml
@@ -0,0 +1,17 @@
+# Disable HEIF support — libheif is being retired from Azure Linux 4.0.
+# Upstream spec has no explicit `--with-heif`/`--without-heif` flag in
+# `%configure`; the heif coder is auto-detected via pkg-config when
+# libheif-devel is present. Removing the BuildRequires causes configure
+# to skip heif, and no plugin file is produced (the GraphicsMagick %files
+# section globs `%{_libdir}/GraphicsMagick-*/modules-*/coders/`, so a
+# missing heif coder doesn't trigger an "unpackaged file" error).
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop libheif build dependency ahead of libheif removal from Azure Linux 4.0"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "libheif-devel"
diff --git a/base/comps/SDL2_image/SDL2_image.comp.toml b/base/comps/SDL2_image/SDL2_image.comp.toml
index c45a7dcc8b5..d41bed2ea33 100644
--- a/base/comps/SDL2_image/SDL2_image.comp.toml
+++ b/base/comps/SDL2_image/SDL2_image.comp.toml
@@ -4,15 +4,3 @@
 
 [components.SDL2_image]
 
-[[components.SDL2_image.overlays]]
-description = "Remove libavif-devel BuildRequires (libavif not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "libavif-devel"
-
-[[components.SDL2_image.overlays]]
-description = "Disable avif support entirely instead of just disabling shared linking"
-type = "spec-search-replace"
-section = "%build"
-regex = '--disable-avif-shared'
-replacement = '--disable-avif'
diff --git a/base/comps/SDL2_image/overlays/0001-remove-libavif-devel-buildrequires.overlay.toml b/base/comps/SDL2_image/overlays/0001-remove-libavif-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..324d7edf0f6
--- /dev/null
+++ b/base/comps/SDL2_image/overlays/0001-remove-libavif-devel-buildrequires.overlay.toml
@@ -0,0 +1,15 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove libavif-devel BuildRequires (libavif not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "libavif-devel"
+
+[[overlays]]
+description = "Disable avif support entirely instead of just disabling shared linking"
+type = "spec-search-replace"
+section = "%build"
+regex = "--disable-avif-shared"
+replacement = "--disable-avif"
diff --git a/base/comps/SDL3_image/SDL3_image.comp.toml b/base/comps/SDL3_image/SDL3_image.comp.toml
index 78c5e3cda9f..653dd3efc62 100644
--- a/base/comps/SDL3_image/SDL3_image.comp.toml
+++ b/base/comps/SDL3_image/SDL3_image.comp.toml
@@ -11,29 +11,3 @@
 [components.SDL3_image]
 spec = { type = "upstream", upstream-commit = "6b9cdf9cf3e3798c9443bf425017b152d78b9d65" }
 
-[[components.SDL3_image.overlays]]
-description = "Remove cmake(libavif) BuildRequires (libavif not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "cmake(libavif)"
-
-[[components.SDL3_image.overlays]]
-description = "Disable avif support in cmake build flags"
-type = "spec-search-replace"
-section = "%build"
-regex = '-DSDLIMAGE_AVIF=ON'
-replacement = '-DSDLIMAGE_AVIF=OFF'
-
-[[components.SDL3_image.overlays]]
-description = "Disable avif save support in cmake build flags"
-type = "spec-search-replace"
-section = "%build"
-regex = '-DSDLIMAGE_AVIF_SAVE=ON'
-replacement = '-DSDLIMAGE_AVIF_SAVE=OFF'
-
-[[components.SDL3_image.overlays]]
-description = "Disable avif shared linking in cmake build flags"
-type = "spec-search-replace"
-section = "%build"
-regex = '-DSDLIMAGE_AVIF_SHARED=ON'
-replacement = '-DSDLIMAGE_AVIF_SHARED=OFF'
diff --git a/base/comps/SDL3_image/overlays/0001-remove-cmake-libavif-buildrequires.overlay.toml b/base/comps/SDL3_image/overlays/0001-remove-cmake-libavif-buildrequires.overlay.toml
new file mode 100644
index 00000000000..decc004fc1c
--- /dev/null
+++ b/base/comps/SDL3_image/overlays/0001-remove-cmake-libavif-buildrequires.overlay.toml
@@ -0,0 +1,29 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove cmake(libavif) BuildRequires (libavif not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "cmake(libavif)"
+
+[[overlays]]
+description = "Disable avif support in cmake build flags"
+type = "spec-search-replace"
+section = "%build"
+regex = "-DSDLIMAGE_AVIF=ON"
+replacement = "-DSDLIMAGE_AVIF=OFF"
+
+[[overlays]]
+description = "Disable avif save support in cmake build flags"
+type = "spec-search-replace"
+section = "%build"
+regex = "-DSDLIMAGE_AVIF_SAVE=ON"
+replacement = "-DSDLIMAGE_AVIF_SAVE=OFF"
+
+[[overlays]]
+description = "Disable avif shared linking in cmake build flags"
+type = "spec-search-replace"
+section = "%build"
+regex = "-DSDLIMAGE_AVIF_SHARED=ON"
+replacement = "-DSDLIMAGE_AVIF_SHARED=OFF"
diff --git a/base/comps/anaconda/anaconda.comp.toml b/base/comps/anaconda/anaconda.comp.toml
index f68d08f92fe..a29f74b6fa8 100644
--- a/base/comps/anaconda/anaconda.comp.toml
+++ b/base/comps/anaconda/anaconda.comp.toml
@@ -1,26 +1 @@
 [components.anaconda]
-
-# Drop the flatpak Requires from anaconda-core. Anaconda's flatpak
-# source-type lets the installer install OCI/flatpak refs from a
-# CDROM at install time -- a desktop-installer feature that AZL
-# doesn't ship. Removing these Requires unhooks anaconda-core from
-# the flatpak chain so flatpak can be demoted to sdk.
-
-[[components.anaconda.overlays]]
-description = "Drop Requires: flatpak from anaconda-core (flatpak source-type unused on AZL)"
-type = "spec-remove-tag"
-tag = "Requires"
-value = "flatpak"
-package = "core"
-
-[[components.anaconda.overlays]]
-description = "Drop Requires: flatpak-libs from anaconda-core (flatpak source-type unused on AZL)"
-type = "spec-remove-tag"
-tag = "Requires"
-value = "flatpak-libs"
-package = "core"
-
-[[components.anaconda.overlays]]
-description = "Guard gi.require_version('Flatpak') so the module loads even without flatpak-libs typelib"
-type = "patch-add"
-source = "0001-flatpak_manager-guard-gi-import-for-missing-typelib.patch"
diff --git a/base/comps/anaconda/overlays/0001-drop-requires-flatpak-anaconda.overlay.toml b/base/comps/anaconda/overlays/0001-drop-requires-flatpak-anaconda.overlay.toml
new file mode 100644
index 00000000000..11f1094895f
--- /dev/null
+++ b/base/comps/anaconda/overlays/0001-drop-requires-flatpak-anaconda.overlay.toml
@@ -0,0 +1,23 @@
+# Drop the flatpak Requires from anaconda-core. Anaconda's flatpak
+# source-type lets the installer install OCI/flatpak refs from a
+# CDROM at install time -- a desktop-installer feature that AZL
+# doesn't ship. Removing these Requires unhooks anaconda-core from
+# the flatpak chain so flatpak can be demoted to sdk.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop Requires: flatpak from anaconda-core (flatpak source-type unused on AZL)"
+type = "spec-remove-tag"
+tag = "Requires"
+value = "flatpak"
+package = "core"
+
+[[overlays]]
+description = "Drop Requires: flatpak-libs from anaconda-core (flatpak source-type unused on AZL)"
+type = "spec-remove-tag"
+tag = "Requires"
+value = "flatpak-libs"
+package = "core"
diff --git a/base/comps/anaconda/overlays/0002-guard-gi-require-version.overlay.toml b/base/comps/anaconda/overlays/0002-guard-gi-require-version.overlay.toml
new file mode 100644
index 00000000000..c6ef9ed62eb
--- /dev/null
+++ b/base/comps/anaconda/overlays/0002-guard-gi-require-version.overlay.toml
@@ -0,0 +1,8 @@
+[metadata]
+category = "azl-dep-missing-workaround"
+upstreamable = true
+
+[[overlays]]
+description = "Guard gi.require_version('Flatpak') so the module loads even without flatpak-libs typelib"
+type = "patch-add"
+source = "../0001-flatpak_manager-guard-gi-import-for-missing-typelib.patch"
diff --git a/base/comps/coin-or-Cbc/coin-or-Cbc.comp.toml b/base/comps/coin-or-Cbc/coin-or-Cbc.comp.toml
index 8913607c099..b7458b2ad89 100644
--- a/base/comps/coin-or-Cbc/coin-or-Cbc.comp.toml
+++ b/base/comps/coin-or-Cbc/coin-or-Cbc.comp.toml
@@ -1,25 +1 @@
 [components.coin-or-Cbc]
-
-# coin-or-HiGHS is not available in Azure Linux. Disable HiGHS support by
-# removing the HiGHS BuildRequires entry and stripping the configure flags.
-# HiGHS is an optional LP solver backend; Cbc's primary solver (Clp) is unaffected.
-
-[[components.coin-or-Cbc.overlays]]
-description = "Disable HiGHS BuildRequires — coin-or-HiGHS not available in Azure Linux"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(highs)"
-
-[[components.coin-or-Cbc.overlays]]
-description = "Remove HiGHS --with-highs-incdir configure flag"
-type = "spec-search-replace"
-section = "%build"
-regex = '  --with-highs-incdir=%\{_includedir\}/highs \\'
-replacement = "  \\"
-
-[[components.coin-or-Cbc.overlays]]
-description = "Remove HiGHS --with-highs-lib configure flag"
-type = "spec-search-replace"
-section = "%build"
-regex = '  --with-highs-lib=-lhighs \\'
-replacement = "  \\"
diff --git a/base/comps/coin-or-Cbc/overlays/0001-disable-highs-buildrequires-coin.overlay.toml b/base/comps/coin-or-Cbc/overlays/0001-disable-highs-buildrequires-coin.overlay.toml
new file mode 100644
index 00000000000..0a82cbd449b
--- /dev/null
+++ b/base/comps/coin-or-Cbc/overlays/0001-disable-highs-buildrequires-coin.overlay.toml
@@ -0,0 +1,27 @@
+# coin-or-HiGHS is not available in Azure Linux. Disable HiGHS support by
+# removing the HiGHS BuildRequires entry and stripping the configure flags.
+# HiGHS is an optional LP solver backend; Cbc's primary solver (Clp) is unaffected.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable HiGHS BuildRequires — coin-or-HiGHS not available in Azure Linux"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(highs)"
+
+[[overlays]]
+description = "Remove HiGHS --with-highs-incdir configure flag"
+type = "spec-search-replace"
+section = "%build"
+regex = "  --with-highs-incdir=%\\{_includedir\\}/highs \\\\"
+replacement = "  \\"
+
+[[overlays]]
+description = "Remove HiGHS --with-highs-lib configure flag"
+type = "spec-search-replace"
+section = "%build"
+regex = "  --with-highs-lib=-lhighs \\\\"
+replacement = "  \\"
diff --git a/base/comps/curl/curl.comp.toml b/base/comps/curl/curl.comp.toml
index 1bdfeb364d1..8052821ced0 100644
--- a/base/comps/curl/curl.comp.toml
+++ b/base/comps/curl/curl.comp.toml
@@ -1,16 +1,2 @@
 [components.curl]
 
-[[components.curl.overlays]]
-description = "Drop python3-impacket BuildRequires (only used by Fedora-gated upstream test 1451; python-impacket is not packaged for Azure Linux due to RPM-signing issues)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "python3-impacket"
-
-# Update the now-stale comment in the (empty) `%if 0%{?fedora}` block left
-# behind by removing the BuildRequires above, so future readers know the
-# omission is intentional rather than an oversight.
-[[components.curl.overlays]]
-description = "Annotate the now-empty %if 0%{?fedora} block to make the AZL deviation explicit (avoid confusion with the original 'needed for upstream test 1451' comment)"
-type = "spec-search-replace"
-regex = '^# needed for upstream test 1451$'
-replacement = '# python3-impacket BuildRequires intentionally omitted in Azure Linux — see curl.comp.toml overlay (RPM signing blocker; test 1451 is Fedora-gated)'
diff --git a/base/comps/curl/overlays/0001-drop-python3-impacket-buildrequires.overlay.toml b/base/comps/curl/overlays/0001-drop-python3-impacket-buildrequires.overlay.toml
new file mode 100644
index 00000000000..7b807d9cd20
--- /dev/null
+++ b/base/comps/curl/overlays/0001-drop-python3-impacket-buildrequires.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop python3-impacket BuildRequires (only used by Fedora-gated upstream test 1451; python-impacket is not packaged for Azure Linux due to RPM-signing issues)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "python3-impacket"
diff --git a/base/comps/curl/overlays/0002-annotate-now-empty-if.overlay.toml b/base/comps/curl/overlays/0002-annotate-now-empty-if.overlay.toml
new file mode 100644
index 00000000000..b211f753259
--- /dev/null
+++ b/base/comps/curl/overlays/0002-annotate-now-empty-if.overlay.toml
@@ -0,0 +1,13 @@
+# Update the now-stale comment in the (empty) `%if 0%{?fedora}` block left
+# behind by removing the BuildRequires above, so future readers know the
+# omission is intentional rather than an oversight.
+
+[metadata]
+category = "azl-disable-unsupported-tests"
+upstreamable = false
+
+[[overlays]]
+description = "Annotate the now-empty %if 0%{?fedora} block to make the AZL deviation explicit (avoid confusion with the original 'needed for upstream test 1451' comment)"
+type = "spec-search-replace"
+regex = "^# needed for upstream test 1451$"
+replacement = "# python3-impacket BuildRequires intentionally omitted in Azure Linux — see curl.comp.toml overlay (RPM signing blocker; test 1451 is Fedora-gated)"
diff --git a/base/comps/dogtag-pki/dogtag-pki.comp.toml b/base/comps/dogtag-pki/dogtag-pki.comp.toml
index 408c7c226df..5cfa3e638c0 100644
--- a/base/comps/dogtag-pki/dogtag-pki.comp.toml
+++ b/base/comps/dogtag-pki/dogtag-pki.comp.toml
@@ -1,39 +1,3 @@
 [components.dogtag-pki]
 # Release: %{release_number}%{?phase:.}%{?phase}%{?timestamp:.}%{?timestamp}%{?commit_id:.}%{?commit_id}%{?dist}
 release = { calculation = "manual" }
-
-# AZL ships only java-25-openjdk; there is no java-21-openjdk, so the
-# upstream %else branch (taken when %fedora and %rhel are both unset, as
-# in AZL) references unsatisfiable openjdk21 packages. Retarget each
-# %define line individually so we don't accidentally rewrite historical
-# %changelog entries that mention these monikers (spec-search-replace
-# cannot be scoped to the preamble alone).
-[[components.dogtag-pki.overlays]]
-description = "Retarget java_runtime to java-25-openjdk"
-type = "spec-search-replace"
-regex = '^%define java_runtime java-21-openjdk$'
-replacement = "%define java_runtime java-25-openjdk"
-
-[[components.dogtag-pki.overlays]]
-description = "Retarget java_devel to java-25-openjdk-devel"
-type = "spec-search-replace"
-regex = '^%define java_devel java-21-openjdk-devel$'
-replacement = "%define java_devel java-25-openjdk-devel"
-
-[[components.dogtag-pki.overlays]]
-description = "Retarget java_headless to java-25-openjdk-headless"
-type = "spec-search-replace"
-regex = '^%define java_headless java-21-openjdk-headless$'
-replacement = "%define java_headless java-25-openjdk-headless"
-
-[[components.dogtag-pki.overlays]]
-description = "Retarget java_home to jre-25-openjdk"
-type = "spec-search-replace"
-regex = '^%define java_home %\{_jvmdir\}/jre-21-openjdk$'
-replacement = "%define java_home %{_jvmdir}/jre-25-openjdk"
-
-[[components.dogtag-pki.overlays]]
-description = "Retarget maven_local to maven-local-openjdk25"
-type = "spec-search-replace"
-regex = '^%define maven_local maven-local-openjdk21$'
-replacement = "%define maven_local maven-local-openjdk25"
diff --git a/base/comps/dogtag-pki/overlays/0001-retarget-java-runtime-java.overlay.toml b/base/comps/dogtag-pki/overlays/0001-retarget-java-runtime-java.overlay.toml
new file mode 100644
index 00000000000..ab38763ea6a
--- /dev/null
+++ b/base/comps/dogtag-pki/overlays/0001-retarget-java-runtime-java.overlay.toml
@@ -0,0 +1,40 @@
+# AZL ships only java-25-openjdk; there is no java-21-openjdk, so the
+# upstream %else branch (taken when %fedora and %rhel are both unset, as
+# in AZL) references unsatisfiable openjdk21 packages. Retarget each
+# %define line individually so we don't accidentally rewrite historical
+# %changelog entries that mention these monikers (spec-search-replace
+# cannot be scoped to the preamble alone).
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Retarget java_runtime to java-25-openjdk"
+type = "spec-search-replace"
+regex = "^%define java_runtime java-21-openjdk$"
+replacement = "%define java_runtime java-25-openjdk"
+
+[[overlays]]
+description = "Retarget java_devel to java-25-openjdk-devel"
+type = "spec-search-replace"
+regex = "^%define java_devel java-21-openjdk-devel$"
+replacement = "%define java_devel java-25-openjdk-devel"
+
+[[overlays]]
+description = "Retarget java_headless to java-25-openjdk-headless"
+type = "spec-search-replace"
+regex = "^%define java_headless java-21-openjdk-headless$"
+replacement = "%define java_headless java-25-openjdk-headless"
+
+[[overlays]]
+description = "Retarget java_home to jre-25-openjdk"
+type = "spec-search-replace"
+regex = "^%define java_home %\\{_jvmdir\\}/jre-21-openjdk$"
+replacement = "%define java_home %{_jvmdir}/jre-25-openjdk"
+
+[[overlays]]
+description = "Retarget maven_local to maven-local-openjdk25"
+type = "spec-search-replace"
+regex = "^%define maven_local maven-local-openjdk21$"
+replacement = "%define maven_local maven-local-openjdk25"
diff --git a/base/comps/dtc/dtc.comp.toml b/base/comps/dtc/dtc.comp.toml
index 97bdbc6664e..450055dfe7c 100644
--- a/base/comps/dtc/dtc.comp.toml
+++ b/base/comps/dtc/dtc.comp.toml
@@ -1,12 +1 @@
 [components.dtc]
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# The upstream spec hard-codes `%global with_mingw 1` whenever %fedora is
-# defined (true in our build environment) rather than gating on a %bcond, so
-# the standard `build.without = ["mingw"]` mechanism has no effect. Force it
-# off via spec overlay.
-[[components.dtc.overlays]]
-description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
-type = "spec-search-replace"
-regex = '%global with_mingw 1'
-replacement = '%global with_mingw 0'
diff --git a/base/comps/dtc/overlays/0001-disable-mingw-sub-packages.overlay.toml b/base/comps/dtc/overlays/0001-disable-mingw-sub-packages.overlay.toml
new file mode 100644
index 00000000000..9ea750a6735
--- /dev/null
+++ b/base/comps/dtc/overlays/0001-disable-mingw-sub-packages.overlay.toml
@@ -0,0 +1,15 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# The upstream spec hard-codes `%global with_mingw 1` whenever %fedora is
+# defined (true in our build environment) rather than gating on a %bcond, so
+# the standard `build.without = ["mingw"]` mechanism has no effect. Force it
+# off via spec overlay.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
+type = "spec-search-replace"
+regex = "%global with_mingw 1"
+replacement = "%global with_mingw 0"
diff --git a/base/comps/edk2/edk2.comp.toml b/base/comps/edk2/edk2.comp.toml
index 96fcd3408c2..e8669b1f7b5 100644
--- a/base/comps/edk2/edk2.comp.toml
+++ b/base/comps/edk2/edk2.comp.toml
@@ -1,61 +1 @@
 [components.edk2]
-
-# Disable the Xen OVMF build variant — not applicable to Azure Linux (Hyper-V/KVM).
-
-# 1. Rename the build config section so edk2-build.py skips the Xen build.
-#    The script iterates sections starting with "build." prefix.
-[[components.edk2.overlays]]
-description = "Disable Xen OVMF build - rename config section so edk2-build.py skips it"
-type = "file-search-replace"
-file = "edk2-build.fedora"
-regex = '\[build\.ovmf\.xen\]'
-replacement = '[disabled.ovmf.xen]'
-
-# 2. Remove the ovmf-xen subpackage entirely.
-[[components.edk2.overlays]]
-description = "Remove %package ovmf-xen"
-type = "spec-remove-section"
-section = "%package"
-package = "ovmf-xen"
-
-[[components.edk2.overlays]]
-description = "Remove %description ovmf-xen"
-type = "spec-remove-section"
-section = "%description"
-package = "ovmf-xen"
-
-[[components.edk2.overlays]]
-description = "Remove %files ovmf-xen"
-type = "spec-remove-section"
-section = "%files"
-package = "ovmf-xen"
-
-# WORKAROUND: Disable IGVM/confidential VM build support until virt-firmware-rs
-# is imported into AZL4. The upstream edk2 spec uses igvm-wrap (from
-# virt-firmware-rs) to generate OVMF.igvm for SEV-SNP confidential VMs.
-# Remove these overlays once virt-firmware-rs is available.
-
-# 3. Remove BuildRequires for virt-firmware-rs (not yet available in AZL4).
-[[components.edk2.overlays]]
-description = "WORKAROUND: Remove virt-firmware-rs BuildRequires — not yet in AZL4. Provides igvm-wrap for IGVM/confidential VM support. Remove overlay when virt-firmware-rs is imported."
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "virt-firmware-rs >= 25.8"
-
-# 4. Disable the igvm-wrap invocation in %build by prefixing with ':'
-#    (POSIX null command). The ':' absorbs the multi-line continuation args.
-[[components.edk2.overlays]]
-description = "WORKAROUND: Disable igvm-wrap invocation — virt-firmware-rs not available."
-type = "spec-search-replace"
-section = "%build"
-regex = 'igvm-wrap --input'
-replacement = ': igvm-wrap --input'
-
-# 5. Remove OVMF.igvm from %files ovmf (not built without igvm-wrap).
-[[components.edk2.overlays]]
-description = "WORKAROUND: Remove OVMF.igvm from files list — not built without virt-firmware-rs."
-type = "spec-search-replace"
-section = "%files"
-package = "ovmf"
-regex = '%\{_datadir\}/%\{name\}/ovmf/OVMF\.igvm'
-replacement = '# %{_datadir}/%{name}/ovmf/OVMF.igvm — disabled, no virt-firmware-rs'
diff --git a/base/comps/edk2/overlays/0001-disable-xen-ovmf-build.overlay.toml b/base/comps/edk2/overlays/0001-disable-xen-ovmf-build.overlay.toml
new file mode 100644
index 00000000000..2fe5b01a0c5
--- /dev/null
+++ b/base/comps/edk2/overlays/0001-disable-xen-ovmf-build.overlay.toml
@@ -0,0 +1,34 @@
+# Disable the Xen OVMF build variant — not applicable to Azure Linux (Hyper-V/KVM).
+
+# 1. Rename the build config section so edk2-build.py skips the Xen build.
+#    The script iterates sections starting with "build." prefix.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable Xen OVMF build - rename config section so edk2-build.py skips it"
+type = "file-search-replace"
+file = "edk2-build.fedora"
+regex = "\\[build\\.ovmf\\.xen\\]"
+replacement = "[disabled.ovmf.xen]"
+
+# 2. Remove the ovmf-xen subpackage entirely.
+[[overlays]]
+description = "Remove %package ovmf-xen"
+type = "spec-remove-section"
+section = "%package"
+package = "ovmf-xen"
+
+[[overlays]]
+description = "Remove %description ovmf-xen"
+type = "spec-remove-section"
+section = "%description"
+package = "ovmf-xen"
+
+[[overlays]]
+description = "Remove %files ovmf-xen"
+type = "spec-remove-section"
+section = "%files"
+package = "ovmf-xen"
diff --git a/base/comps/edk2/overlays/0002-workaround-remove-virt-firmware.overlay.toml b/base/comps/edk2/overlays/0002-workaround-remove-virt-firmware.overlay.toml
new file mode 100644
index 00000000000..19a5e4a9d5a
--- /dev/null
+++ b/base/comps/edk2/overlays/0002-workaround-remove-virt-firmware.overlay.toml
@@ -0,0 +1,34 @@
+# WORKAROUND: Disable IGVM/confidential VM build support until virt-firmware-rs
+# is imported into AZL4. The upstream edk2 spec uses igvm-wrap (from
+# virt-firmware-rs) to generate OVMF.igvm for SEV-SNP confidential VMs.
+# Remove these overlays once virt-firmware-rs is available.
+
+# 3. Remove BuildRequires for virt-firmware-rs (not yet available in AZL4).
+
+[metadata]
+category = "azl-dep-missing-workaround"
+upstreamable = false
+
+[[overlays]]
+description = "WORKAROUND: Remove virt-firmware-rs BuildRequires — not yet in AZL4. Provides igvm-wrap for IGVM/confidential VM support. Remove overlay when virt-firmware-rs is imported."
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "virt-firmware-rs >= 25.8"
+
+# 4. Disable the igvm-wrap invocation in %build by prefixing with ':'
+#    (POSIX null command). The ':' absorbs the multi-line continuation args.
+[[overlays]]
+description = "WORKAROUND: Disable igvm-wrap invocation — virt-firmware-rs not available."
+type = "spec-search-replace"
+section = "%build"
+regex = "igvm-wrap --input"
+replacement = ": igvm-wrap --input"
+
+# 5. Remove OVMF.igvm from %files ovmf (not built without igvm-wrap).
+[[overlays]]
+description = "WORKAROUND: Remove OVMF.igvm from files list — not built without virt-firmware-rs."
+type = "spec-search-replace"
+section = "%files"
+package = "ovmf"
+regex = "%\\{_datadir\\}/%\\{name\\}/ovmf/OVMF\\.igvm"
+replacement = "# %{_datadir}/%{name}/ovmf/OVMF.igvm — disabled, no virt-firmware-rs"
diff --git a/base/comps/elfutils/elfutils.comp.toml b/base/comps/elfutils/elfutils.comp.toml
index a2768899e61..82edd5af917 100644
--- a/base/comps/elfutils/elfutils.comp.toml
+++ b/base/comps/elfutils/elfutils.comp.toml
@@ -2,8 +2,3 @@
 # Release: %{baserelease}%{?dist}
 release = { calculation = "manual" }
 
-[[components.elfutils.overlays]]
-description = "Remove elfutils-default-yama-scope package"
-type = "spec-search-replace"
-regex = "%global provide_yama_scope\\s+1"
-replacement = "%global provide_yama_scope 0"
diff --git a/base/comps/elfutils/overlays/0001-remove-elfutils-default-yama.overlay.toml b/base/comps/elfutils/overlays/0001-remove-elfutils-default-yama.overlay.toml
new file mode 100644
index 00000000000..90688ccd4e8
--- /dev/null
+++ b/base/comps/elfutils/overlays/0001-remove-elfutils-default-yama.overlay.toml
@@ -0,0 +1,8 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove elfutils-default-yama-scope package"
+type = "spec-search-replace"
+regex = "%global provide_yama_scope\\s+1"
+replacement = "%global provide_yama_scope 0"
diff --git a/base/comps/erlang/erlang.comp.toml b/base/comps/erlang/erlang.comp.toml
index aec3e176662..04f6263dc66 100644
--- a/base/comps/erlang/erlang.comp.toml
+++ b/base/comps/erlang/erlang.comp.toml
@@ -4,40 +4,3 @@
 
 [components.erlang.build]
 without = ["doc"]
-
-# Disable the erlang-wx sub-package (Erlang's wxWidgets bindings). AZL is a
-# headless cloud distro and does not ship wxGTK; building erlang-wx would
-# pull in a desktop GUI stack at build time and would force every other
-# erlang sub-package whose %if %{__with_wxwidgets} block adds a
-# `Requires: erlang-wx` (erlang-meta, -debugger, -dialyzer, -et, -observer,
-# -reltool, -src) to drag the wx subpackage into the runtime closure.
-#
-# The upstream spec already supports this configuration via the
-# `%global __with_wxwidgets` toggle: when set to 0, every wx-conditional
-# `%package wx` definition, every `Requires: %{name}-wx` line, and the
-# wxGTK BuildRequires are skipped wholesale. Flipping the global is by
-# far the most surgical fix.
-[[components.erlang.overlays]]
-description = "Disable erlang-wx sub-package (wxGTK GUI bindings) — AZL is a headless cloud distro"
-type = "spec-search-replace"
-regex = '^%global __with_wxwidgets 1$'
-replacement = '%global __with_wxwidgets 0'
-
-# The erlang-src %package preamble lives inside `%if %{__with_sources}` and
-# carries unconditional `Requires: %{name}-<sub>` lines for every other
-# sub-package — including all of the wxwidgets-gated ones (common_test,
-# debugger, dialyzer, et, megaco, observer, reltool, wx). Because these
-# Requires are NOT wrapped in `%if %{__with_wxwidgets}`, flipping the
-# toggle alone leaves erlang-src demanding sub-packages that are no longer
-# built. Strip every such line so the rebuilt erlang-src RPM does not pull
-# in now-nonexistent sub-packages. Scope the regex to `%package src` so it
-# only targets these unconditional Requires; equivalent lines elsewhere in
-# the spec are already inside `%if %{__with_wxwidgets}` blocks and are
-# dead code under the toggle, so they stay untouched.
-[[components.erlang.overlays]]
-description = "Drop unconditional Requires for wxwidgets-gated sub-packages from erlang-src (paired with __with_wxwidgets=0 above)"
-type = "spec-search-replace"
-section = "%package"
-package = "src"
-regex = '^Requires: %\{name\}-(common_test|debugger|dialyzer|et|megaco|observer|reltool|wx)%\{\?_isa\} = %\{version\}-%\{release\}$'
-replacement = ''
diff --git a/base/comps/erlang/overlays/0001-disable-erlang-wx-sub.overlay.toml b/base/comps/erlang/overlays/0001-disable-erlang-wx-sub.overlay.toml
new file mode 100644
index 00000000000..e7caa201af7
--- /dev/null
+++ b/base/comps/erlang/overlays/0001-disable-erlang-wx-sub.overlay.toml
@@ -0,0 +1,40 @@
+# Disable the erlang-wx sub-package (Erlang's wxWidgets bindings). AZL is a
+# headless cloud distro and does not ship wxGTK; building erlang-wx would
+# pull in a desktop GUI stack at build time and would force every other
+# erlang sub-package whose %if %{__with_wxwidgets} block adds a
+# `Requires: erlang-wx` (erlang-meta, -debugger, -dialyzer, -et, -observer,
+# -reltool, -src) to drag the wx subpackage into the runtime closure.
+#
+# The upstream spec already supports this configuration via the
+# `%global __with_wxwidgets` toggle: when set to 0, every wx-conditional
+# `%package wx` definition, every `Requires: %{name}-wx` line, and the
+# wxGTK BuildRequires are skipped wholesale. Flipping the global is by
+# far the most surgical fix.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Disable erlang-wx sub-package (wxGTK GUI bindings) — AZL is a headless cloud distro"
+type = "spec-search-replace"
+regex = "^%global __with_wxwidgets 1$"
+replacement = "%global __with_wxwidgets 0"
+
+# The erlang-src %package preamble lives inside `%if %{__with_sources}` and
+# carries unconditional `Requires: %{name}-<sub>` lines for every other
+# sub-package — including all of the wxwidgets-gated ones (common_test,
+# debugger, dialyzer, et, megaco, observer, reltool, wx). Because these
+# Requires are NOT wrapped in `%if %{__with_wxwidgets}`, flipping the
+# toggle alone leaves erlang-src demanding sub-packages that are no longer
+# built. Strip every such line so the rebuilt erlang-src RPM does not pull
+# in now-nonexistent sub-packages. Scope the regex to `%package src` so it
+# only targets these unconditional Requires; equivalent lines elsewhere in
+# the spec are already inside `%if %{__with_wxwidgets}` blocks and are
+# dead code under the toggle, so they stay untouched.
+[[overlays]]
+description = "Drop unconditional Requires for wxwidgets-gated sub-packages from erlang-src (paired with __with_wxwidgets=0 above)"
+type = "spec-search-replace"
+section = "%package"
+package = "src"
+regex = "^Requires: %\\{name\\}-(common_test|debugger|dialyzer|et|megaco|observer|reltool|wx)%\\{\\?_isa\\} = %\\{version\\}-%\\{release\\}$"
+replacement = ""
diff --git a/base/comps/fence-agents/fence-agents.comp.toml b/base/comps/fence-agents/fence-agents.comp.toml
index ee48b8b6213..6b36f9e6f27 100644
--- a/base/comps/fence-agents/fence-agents.comp.toml
+++ b/base/comps/fence-agents/fence-agents.comp.toml
@@ -1,13 +1,3 @@
 [components.fence-agents]
 # Release: 1%{?alphatag:.%{alphatag}}%{?dist}
 release = { calculation = "manual" }
-
-# Remove fence-agents-xenapi from the fence-agents-all metapackage.
-# Xen is not applicable to Azure Linux's Hyper-V/KVM environment.
-# Clearing the package name leaves " \\" — a blank continuation that adds
-# only harmless whitespace to the Requires list.
-[[components.fence-agents.overlays]]
-description = "Remove fence-agents-xenapi from fence-agents-all Requires - Xen not needed for Azure Linux"
-type = "spec-search-replace"
-regex = 'fence-agents-xenapi'
-replacement = ''
diff --git a/base/comps/fence-agents/overlays/0001-remove-fence-agents-xenapi.overlay.toml b/base/comps/fence-agents/overlays/0001-remove-fence-agents-xenapi.overlay.toml
new file mode 100644
index 00000000000..cf6a4eb9904
--- /dev/null
+++ b/base/comps/fence-agents/overlays/0001-remove-fence-agents-xenapi.overlay.toml
@@ -0,0 +1,14 @@
+# Remove fence-agents-xenapi from the fence-agents-all metapackage.
+# Xen is not applicable to Azure Linux's Hyper-V/KVM environment.
+# Clearing the package name leaves " \\" — a blank continuation that adds
+# only harmless whitespace to the Requires list.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove fence-agents-xenapi from fence-agents-all Requires - Xen not needed for Azure Linux"
+type = "spec-search-replace"
+regex = "fence-agents-xenapi"
+replacement = ""
diff --git a/base/comps/festival-freebsoft-utils/festival-freebsoft-utils.comp.toml b/base/comps/festival-freebsoft-utils/festival-freebsoft-utils.comp.toml
index 16fae3530ba..55ae37abf33 100644
--- a/base/comps/festival-freebsoft-utils/festival-freebsoft-utils.comp.toml
+++ b/base/comps/festival-freebsoft-utils/festival-freebsoft-utils.comp.toml
@@ -5,14 +5,3 @@
 # works.
 [components.festival-freebsoft-utils]
 
-[[components.festival-freebsoft-utils.overlays]]
-description = "Drop BuildRequires: sox — sox is not shipped in AZL"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "sox"
-
-[[components.festival-freebsoft-utils.overlays]]
-description = "Drop Recommends: sox — sox is not shipped in AZL"
-type = "spec-remove-tag"
-tag = "Recommends"
-value = "sox"
diff --git a/base/comps/festival-freebsoft-utils/overlays/0001-drop-buildrequires-sox-sox.overlay.toml b/base/comps/festival-freebsoft-utils/overlays/0001-drop-buildrequires-sox-sox.overlay.toml
new file mode 100644
index 00000000000..5d071a0bdcc
--- /dev/null
+++ b/base/comps/festival-freebsoft-utils/overlays/0001-drop-buildrequires-sox-sox.overlay.toml
@@ -0,0 +1,15 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop BuildRequires: sox — sox is not shipped in AZL"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "sox"
+
+[[overlays]]
+description = "Drop Recommends: sox — sox is not shipped in AZL"
+type = "spec-remove-tag"
+tag = "Recommends"
+value = "sox"
diff --git a/base/comps/firefox/firefox.comp.toml b/base/comps/firefox/firefox.comp.toml
index 007f649083d..15b6a8ed19b 100644
--- a/base/comps/firefox/firefox.comp.toml
+++ b/base/comps/firefox/firefox.comp.toml
@@ -26,116 +26,6 @@ release = { calculation = "manual" }
 #   5. 'fix(firefox): drop fdk-aac-free-devel and Fedora fdk-aac patch'
 azl_release = "5"
 
-# Firefox 148.0's mfbt/tests/TestIntegerRange.cpp uses uint8_t/uint16_t/uint32_t/uint64_t
-# without #include <cstdint>. GCC 15 (used in Azure Linux bootstrap) enforces stricter
-# C++ standards compliance and no longer leaks these types through transitive includes,
-# causing a compilation failure. The test binaries (controlled by build_tests) are not
-# shipped in the RPM and are only used when run_firefox_tests is enabled (which it is not).
-# Disabling them avoids the broken test compilation without affecting the final package.
-#
-# Upstream spec: https://src.fedoraproject.org/rpms/firefox/blob/f43/f/firefox.spec
-# Koji build failure: task 907428 (aarch64), task 898577 (x86_64)
-# TODO: Remove when upstream Firefox fixes GCC 15 compatibility (missing <cstdint> include).
-[[components.firefox.overlays]]
-description = "Disable build-time test compilation to avoid GCC 15 missing <cstdint> error in TestIntegerRange.cpp"
-type = "spec-search-replace"
-regex = '%global build_tests       1'
-replacement = '%global build_tests       0'
-
-# Firefox 148.0's bundled breakpad crash reporter has a GCC 15 compatibility issue:
-# minidump_descriptor.h references a field 'address_within_principal_mapping_' that
-# does not exist in the class. This fails on x86_64 where the crash reporter is enabled
-# (enable_mozilla_crashreporter = 1). Disabling it aligns with the aarch64/ppc64le
-# configuration and removes the non-essential crash reporter from the build.
-#
-# Upstream spec: https://src.fedoraproject.org/rpms/firefox/blob/f43/f/firefox.spec
-# TODO: Remove when upstream Firefox updates bundled breakpad for GCC 15 compatibility.
-[[components.firefox.overlays]]
-description = "Disable crash reporter to avoid GCC 15 breakpad compilation error in minidump_descriptor.h"
-type = "spec-search-replace"
-regex = '%global enable_mozilla_crashreporter 1'
-replacement = '%global enable_mozilla_crashreporter 0'
-
-# AZL does not ship fdk-aac-free. Four coordinated overlays are
-# required: simply dropping the BR causes ./mach configure to hard-fail.
-#
-# Mechanism: the Fedora firefox-mozconfig (Source10) ships
-# `ac_add_options --with-system-fdk-aac` unconditionally, and Fedora's
-# mozilla-1667096.patch (Patch401) wires that into
-# `pkg_check_modules('MOZ_FDK_AAC', 'fdk-aac', when='--with-system-fdk-aac')`
-# in toolkit/moz.configure. Mozilla's pkg_check_modules defaults to
-# `allow_missing=False`, so configure exits 1 if fdk-aac.pc is not in
-# the buildroot — which it won't be once fdk-aac-free is dropped.
-#
-# Patch401 is fdk-aac-only — it touches exactly 4 files
-# (toolkit/moz.configure to add the `--with-system-fdk-aac` option +
-# pkg_check_modules; ffvpx moz.build / codec_list.c / libfdk-aacdec.c
-# to wire `ff_libfdk_aac_decoder` into the ffvpx codec table). Nothing
-# else depends on it.
-#
-# We therefore (a) skip the `%patch -P401` invocation in %prep, which
-# removes the `--with-system-fdk-aac` configure option entirely AND
-# removes the `ff_libfdk_aac_decoder` entry from ffvpx's codec table
-# (otherwise the link of libmozavcodec.so fails with `undefined
-# reference to ff_libfdk_aac_decoder` because the wrapper .c file isn't
-# compiled); (b) drop the `Patch401:` source declaration so the
-# now-unused mozilla-1667096.patch is also pruned from the rendered
-# SRPM by azldev's render filter; (c) drop the now-stale
-# `ac_add_options --with-system-fdk-aac` line from firefox-mozconfig
-# (Source10), because once Patch401 is gone that option is
-# unrecognized by ./mach configure and aborts the build; and (d) drop
-# the now-unnecessary fdk-aac-free-devel BR.
-#
-# Update regexes on Fedora rebase if upstream renames Patch401 or
-# reflows firefox-mozconfig; do NOT remove the overlays.
-
-[[components.firefox.overlays]]
-description = "Skip Fedora's mozilla-1667096.patch (Patch401) in %prep. The patch is fdk-aac-only and (i) adds the `--with-system-fdk-aac` configure option and (ii) registers `ff_libfdk_aac_decoder` in ffvpx's codec_list.c. Without the wrapper .c file (libfdk-aacdec.c, also added by the patch) compiled in, that codec-table entry produces `undefined reference to ff_libfdk_aac_decoder` when linking libmozavcodec.so."
-type = "spec-search-replace"
-section = "%prep"
-regex = '^%patch -P401 -p1 -b \.1667096$'
-replacement = '# AZL: mozilla-1667096.patch (Patch401) skipped — adds fdk-aac support; see firefox.comp.toml'
-
-[[components.firefox.overlays]]
-description = "Drop the Patch401 source declaration for the now-unused mozilla-1667096.patch. azldev's render filter prunes patch files not referenced in the rendered spec, so removing the declaration also retires the ~21KB .patch file from the SRPM."
-type = "spec-remove-tag"
-tag = "Patch401"
-value = "mozilla-1667096.patch"
-
-[[components.firefox.overlays]]
-description = "Drop the `ac_add_options --with-system-fdk-aac` line from firefox-mozconfig (Source10). Once Patch401 is skipped, toolkit/moz.configure no longer declares `--with-system-fdk-aac`, so leaving the mozconfig line in (or flipping it to `--without-`) aborts ./mach configure with 'unknown option'."
-type = "file-search-replace"
-file = "firefox-mozconfig"
-regex = 'ac_add_options --with-system-fdk-aac'
-replacement = ''
-
-[[components.firefox.overlays]]
-description = "Drop BuildRequires: fdk-aac-free-devel (no longer needed once the mozconfig override above disables MOZ_FDK_AAC; fdk-aac-free is being removed from AZL anyway)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "fdk-aac-free-devel"
-
-# Compose AZL release counter with upstream's Release integer. Uses RPM's
-# `%[ ... ]` expression syntax so the final Release tag stays a single
-# integer (Fedora-style). The literal "1" in the replacement MIRRORS the
-# upstream Release integer at the pinned f43 commit — when bumping the
-# `upstream-commit` pin, re-render and update this literal if upstream
-# bumped its own Release (e.g. to "2"). The regex is anchored to the full
-# upstream line, so if upstream changes the Release format (e.g. drops
-# `%{?pre_tag}` or bumps the leading integer), `azldev comp render` will
-# report `STATUS=error` for this component and leave the rendered spec
-# unchanged — caught at PR time by the `Check Rendered Specs` CI job.
-#
-# AZL-only rebuild (no upstream pin change): bump `azl_release` only.
-# Upstream pin bump: update upstream-commit, re-render, update the
-# literal here to match the new upstream Release integer, and reset
-# `azl_release = "1"`.
-[[components.firefox.overlays]]
-description = "Compose azl_release with upstream Release integer so AZL-only bumps are tracked independently of upstream Fedora's Release counter"
-type = "spec-search-replace"
-regex = '^Release:\s+1%\{\?pre_tag\}%\{\?dist\}$'
-replacement = 'Release: %[1 + %{azl_release}]%{?pre_tag}%{?dist}'
-
 # The upstream Mozilla source tarball ships content flagged by the AZL RPM
 # signing pipeline as obfuscated / malware-like (e.g. an obfuscated Windows
 # binary used only by media-sniffer unit tests, crashtest HTML that trips
@@ -160,7 +50,6 @@ replacement = 'Release: %[1 + %{azl_release}]%{?pre_tag}%{?dist}'
 # `sources` lookaside manifest so the build does not also try to fetch the
 # unmodified upstream tarball alongside our repacked one. This is handled
 # by `replace-upstream = true` on the source-files entry below.
-
 [[components.firefox.source-files]]
 filename = "firefox-148.0.source.tar.xz"
 hash = "c9c9f29fbd8f889bf3cf3d88776e1a62da7b2a65d386538d2bd048dd70caaaf8324adb5303a5fa9aa73c2cf6eb9f89cb4b34f9e67c4208d88636dd5376af90a9"
diff --git a/base/comps/firefox/overlays/0001-disable-build-time-test.overlay.toml b/base/comps/firefox/overlays/0001-disable-build-time-test.overlay.toml
new file mode 100644
index 00000000000..baefaf16692
--- /dev/null
+++ b/base/comps/firefox/overlays/0001-disable-build-time-test.overlay.toml
@@ -0,0 +1,34 @@
+# Firefox 148.0's mfbt/tests/TestIntegerRange.cpp uses uint8_t/uint16_t/uint32_t/uint64_t
+# without #include <cstdint>. GCC 15 (used in Azure Linux bootstrap) enforces stricter
+# C++ standards compliance and no longer leaks these types through transitive includes,
+# causing a compilation failure. The test binaries (controlled by build_tests) are not
+# shipped in the RPM and are only used when run_firefox_tests is enabled (which it is not).
+# Disabling them avoids the broken test compilation without affecting the final package.
+#
+# Upstream spec: https://src.fedoraproject.org/rpms/firefox/blob/f43/f/firefox.spec
+# Koji build failure: task 907428 (aarch64), task 898577 (x86_64)
+# TODO: Remove when upstream Firefox fixes GCC 15 compatibility (missing <cstdint> include).
+
+[metadata]
+category = "azl-compatibility"
+upstreamable = true
+
+[[overlays]]
+description = "Disable build-time test compilation to avoid GCC 15 missing <cstdint> error in TestIntegerRange.cpp"
+type = "spec-search-replace"
+regex = "%global build_tests       1"
+replacement = "%global build_tests       0"
+
+# Firefox 148.0's bundled breakpad crash reporter has a GCC 15 compatibility issue:
+# minidump_descriptor.h references a field 'address_within_principal_mapping_' that
+# does not exist in the class. This fails on x86_64 where the crash reporter is enabled
+# (enable_mozilla_crashreporter = 1). Disabling it aligns with the aarch64/ppc64le
+# configuration and removes the non-essential crash reporter from the build.
+#
+# Upstream spec: https://src.fedoraproject.org/rpms/firefox/blob/f43/f/firefox.spec
+# TODO: Remove when upstream Firefox updates bundled breakpad for GCC 15 compatibility.
+[[overlays]]
+description = "Disable crash reporter to avoid GCC 15 breakpad compilation error in minidump_descriptor.h"
+type = "spec-search-replace"
+regex = "%global enable_mozilla_crashreporter 1"
+replacement = "%global enable_mozilla_crashreporter 0"
diff --git a/base/comps/firefox/overlays/0002-skip-fedora-s-mozilla.overlay.toml b/base/comps/firefox/overlays/0002-skip-fedora-s-mozilla.overlay.toml
new file mode 100644
index 00000000000..70dbcea0aa5
--- /dev/null
+++ b/base/comps/firefox/overlays/0002-skip-fedora-s-mozilla.overlay.toml
@@ -0,0 +1,61 @@
+# AZL does not ship fdk-aac-free. Four coordinated overlays are
+# required: simply dropping the BR causes ./mach configure to hard-fail.
+#
+# Mechanism: the Fedora firefox-mozconfig (Source10) ships
+# `ac_add_options --with-system-fdk-aac` unconditionally, and Fedora's
+# mozilla-1667096.patch (Patch401) wires that into
+# `pkg_check_modules('MOZ_FDK_AAC', 'fdk-aac', when='--with-system-fdk-aac')`
+# in toolkit/moz.configure. Mozilla's pkg_check_modules defaults to
+# `allow_missing=False`, so configure exits 1 if fdk-aac.pc is not in
+# the buildroot — which it won't be once fdk-aac-free is dropped.
+#
+# Patch401 is fdk-aac-only — it touches exactly 4 files
+# (toolkit/moz.configure to add the `--with-system-fdk-aac` option +
+# pkg_check_modules; ffvpx moz.build / codec_list.c / libfdk-aacdec.c
+# to wire `ff_libfdk_aac_decoder` into the ffvpx codec table). Nothing
+# else depends on it.
+#
+# We therefore (a) skip the `%patch -P401` invocation in %prep, which
+# removes the `--with-system-fdk-aac` configure option entirely AND
+# removes the `ff_libfdk_aac_decoder` entry from ffvpx's codec table
+# (otherwise the link of libmozavcodec.so fails with `undefined
+# reference to ff_libfdk_aac_decoder` because the wrapper .c file isn't
+# compiled); (b) drop the `Patch401:` source declaration so the
+# now-unused mozilla-1667096.patch is also pruned from the rendered
+# SRPM by azldev's render filter; (c) drop the now-stale
+# `ac_add_options --with-system-fdk-aac` line from firefox-mozconfig
+# (Source10), because once Patch401 is gone that option is
+# unrecognized by ./mach configure and aborts the build; and (d) drop
+# the now-unnecessary fdk-aac-free-devel BR.
+#
+# Update regexes on Fedora rebase if upstream renames Patch401 or
+# reflows firefox-mozconfig; do NOT remove the overlays.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Skip Fedora's mozilla-1667096.patch (Patch401) in %prep. The patch is fdk-aac-only and (i) adds the `--with-system-fdk-aac` configure option and (ii) registers `ff_libfdk_aac_decoder` in ffvpx's codec_list.c. Without the wrapper .c file (libfdk-aacdec.c, also added by the patch) compiled in, that codec-table entry produces `undefined reference to ff_libfdk_aac_decoder` when linking libmozavcodec.so."
+type = "spec-search-replace"
+section = "%prep"
+regex = "^%patch -P401 -p1 -b \\.1667096$"
+replacement = "# AZL: mozilla-1667096.patch (Patch401) skipped — adds fdk-aac support; see firefox.comp.toml"
+
+[[overlays]]
+description = "Drop the Patch401 source declaration for the now-unused mozilla-1667096.patch. azldev's render filter prunes patch files not referenced in the rendered spec, so removing the declaration also retires the ~21KB .patch file from the SRPM."
+type = "spec-remove-tag"
+tag = "Patch401"
+value = "mozilla-1667096.patch"
+
+[[overlays]]
+description = "Drop the `ac_add_options --with-system-fdk-aac` line from firefox-mozconfig (Source10). Once Patch401 is skipped, toolkit/moz.configure no longer declares `--with-system-fdk-aac`, so leaving the mozconfig line in (or flipping it to `--without-`) aborts ./mach configure with 'unknown option'."
+type = "file-search-replace"
+file = "firefox-mozconfig"
+regex = "ac_add_options --with-system-fdk-aac"
+replacement = ""
+
+[[overlays]]
+description = "Drop BuildRequires: fdk-aac-free-devel (no longer needed once the mozconfig override above disables MOZ_FDK_AAC; fdk-aac-free is being removed from AZL anyway)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "fdk-aac-free-devel"
diff --git a/base/comps/firefox/overlays/0003-compose-release-upstream-release.overlay.toml b/base/comps/firefox/overlays/0003-compose-release-upstream-release.overlay.toml
new file mode 100644
index 00000000000..950a4fc7bdf
--- /dev/null
+++ b/base/comps/firefox/overlays/0003-compose-release-upstream-release.overlay.toml
@@ -0,0 +1,25 @@
+# Compose AZL release counter with upstream's Release integer. Uses RPM's
+# `%[ ... ]` expression syntax so the final Release tag stays a single
+# integer (Fedora-style). The literal "1" in the replacement MIRRORS the
+# upstream Release integer at the pinned f43 commit — when bumping the
+# `upstream-commit` pin, re-render and update this literal if upstream
+# bumped its own Release (e.g. to "2"). The regex is anchored to the full
+# upstream line, so if upstream changes the Release format (e.g. drops
+# `%{?pre_tag}` or bumps the leading integer), `azldev comp render` will
+# report `STATUS=error` for this component and leave the rendered spec
+# unchanged — caught at PR time by the `Check Rendered Specs` CI job.
+#
+# AZL-only rebuild (no upstream pin change): bump `azl_release` only.
+# Upstream pin bump: update upstream-commit, re-render, update the
+# literal here to match the new upstream Release integer, and reset
+# `azl_release = "1"`.
+
+[metadata]
+category = "azl-release-management"
+upstreamable = false
+
+[[overlays]]
+description = "Compose azl_release with upstream Release integer so AZL-only bumps are tracked independently of upstream Fedora's Release counter"
+type = "spec-search-replace"
+regex = "^Release:\\s+1%\\{\\?pre_tag\\}%\\{\\?dist\\}$"
+replacement = "Release: %[1 + %{azl_release}]%{?pre_tag}%{?dist}"
diff --git a/base/comps/freerdp/freerdp.comp.toml b/base/comps/freerdp/freerdp.comp.toml
index 1e928e4a3c4..009ff565999 100644
--- a/base/comps/freerdp/freerdp.comp.toml
+++ b/base/comps/freerdp/freerdp.comp.toml
@@ -1,32 +1 @@
 [components.freerdp]
-
-# AZL does not ship opus — disable opus audio support in FreeRDP.
-
-[[components.freerdp.overlays]]
-description = "Drop BuildRequires: pkgconfig(opus) (opus not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(opus)"
-
-[[components.freerdp.overlays]]
-description = "Disable opus audio codec in FreeRDP (-DWITH_OPUS=OFF)"
-type = "spec-search-replace"
-section = "%build"
-regex = '-DWITH_OPUS=ON \\'
-replacement = '-DWITH_OPUS=OFF \'
-
-# AZL does not ship fdk-aac-free — disable AAC audio support in FreeRDP.
-# Update regex on Fedora rebase; do NOT remove the overlays.
-
-[[components.freerdp.overlays]]
-description = "Drop BuildRequires: pkgconfig(fdk-aac) (fdk-aac-free not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(fdk-aac)"
-
-[[components.freerdp.overlays]]
-description = "Disable AAC audio codec in FreeRDP (-DWITH_FDK_AAC=OFF)"
-type = "spec-search-replace"
-section = "%build"
-regex = '-DWITH_FDK_AAC=ON \\'
-replacement = '-DWITH_FDK_AAC=OFF \'
diff --git a/base/comps/freerdp/overlays/0001-drop-buildrequires-pkgconfig-opus.overlay.toml b/base/comps/freerdp/overlays/0001-drop-buildrequires-pkgconfig-opus.overlay.toml
new file mode 100644
index 00000000000..2560836b473
--- /dev/null
+++ b/base/comps/freerdp/overlays/0001-drop-buildrequires-pkgconfig-opus.overlay.toml
@@ -0,0 +1,17 @@
+# AZL does not ship opus — disable opus audio support in FreeRDP.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Drop BuildRequires: pkgconfig(opus) (opus not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(opus)"
+
+[[overlays]]
+description = "Disable opus audio codec in FreeRDP (-DWITH_OPUS=OFF)"
+type = "spec-search-replace"
+section = "%build"
+regex = "-DWITH_OPUS=ON \\\\"
+replacement = "-DWITH_OPUS=OFF \\"
diff --git a/base/comps/freerdp/overlays/0002-drop-buildrequires-pkgconfig-fdk.overlay.toml b/base/comps/freerdp/overlays/0002-drop-buildrequires-pkgconfig-fdk.overlay.toml
new file mode 100644
index 00000000000..971b7ecd709
--- /dev/null
+++ b/base/comps/freerdp/overlays/0002-drop-buildrequires-pkgconfig-fdk.overlay.toml
@@ -0,0 +1,18 @@
+# AZL does not ship fdk-aac-free — disable AAC audio support in FreeRDP.
+# Update regex on Fedora rebase; do NOT remove the overlays.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Drop BuildRequires: pkgconfig(fdk-aac) (fdk-aac-free not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(fdk-aac)"
+
+[[overlays]]
+description = "Disable AAC audio codec in FreeRDP (-DWITH_FDK_AAC=OFF)"
+type = "spec-search-replace"
+section = "%build"
+regex = "-DWITH_FDK_AAC=ON \\\\"
+replacement = "-DWITH_FDK_AAC=OFF \\"
diff --git a/base/comps/gcab/gcab.comp.toml b/base/comps/gcab/gcab.comp.toml
index eff0cd6c0a8..e945f73f842 100644
--- a/base/comps/gcab/gcab.comp.toml
+++ b/base/comps/gcab/gcab.comp.toml
@@ -1,12 +1 @@
 [components.gcab]
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# The upstream spec hard-codes `%global with_mingw 1` whenever %fedora is
-# defined (true in our build environment) rather than gating on a %bcond, so
-# the standard `build.without = ["mingw"]` mechanism has no effect. Force it
-# off via spec overlay.
-[[components.gcab.overlays]]
-description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
-type = "spec-search-replace"
-regex = '%global with_mingw 1'
-replacement = '%global with_mingw 0'
diff --git a/base/comps/gcab/overlays/0001-disable-mingw-sub-packages.overlay.toml b/base/comps/gcab/overlays/0001-disable-mingw-sub-packages.overlay.toml
new file mode 100644
index 00000000000..9ea750a6735
--- /dev/null
+++ b/base/comps/gcab/overlays/0001-disable-mingw-sub-packages.overlay.toml
@@ -0,0 +1,15 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# The upstream spec hard-codes `%global with_mingw 1` whenever %fedora is
+# defined (true in our build environment) rather than gating on a %bcond, so
+# the standard `build.without = ["mingw"]` mechanism has no effect. Force it
+# off via spec overlay.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
+type = "spec-search-replace"
+regex = "%global with_mingw 1"
+replacement = "%global with_mingw 0"
diff --git a/base/comps/gcc/gcc.comp.toml b/base/comps/gcc/gcc.comp.toml
index 83d29e48843..32b7050f6fb 100644
--- a/base/comps/gcc/gcc.comp.toml
+++ b/base/comps/gcc/gcc.comp.toml
@@ -1,56 +1,3 @@
 [components.gcc]
 # Release: %{gcc_release}%{?dist}
 release = { calculation = "manual" }
-
-# Our build of GCC does not support many of the language frontends Fedora
-# supports. We also do not want GPU offload to be done by GCC. It is better done
-# via libraries like CUDA. Dropping support for these features make the build
-# faster. The overlays below implement those choices.
-
-[[components.gcc.overlays]]
-description = "Disable Ada language support"
-type = "spec-search-replace"
-regex = '%global build_ada 1'
-replacement = '%global build_ada 0'
-
-[[components.gcc.overlays]]
-description = "Disable Objective-C language support"
-type = "spec-search-replace"
-regex = '%global build_objc 1'
-replacement = '%global build_objc 0'
-
-[[components.gcc.overlays]]
-description = "Disable Go language support"
-type = "spec-search-replace"
-regex = '%global build_go 1'
-replacement = '%global build_go 0'
-
-[[components.gcc.overlays]]
-description = "Disable D language support"
-type = "spec-search-replace"
-regex = '%global build_d 1'
-replacement = '%global build_d 0'
-
-[[components.gcc.overlays]]
-description = "Disable Modula-2 language support"
-type = "spec-search-replace"
-regex = '%global build_m2 1'
-replacement = '%global build_m2 0'
-
-[[components.gcc.overlays]]
-description = "Disable Cobol language support"
-type = "spec-search-replace"
-regex = '%global build_cobol 1'
-replacement = '%global build_cobol 0'
-
-[[components.gcc.overlays]]
-description = "Disable NVPTX offload support"
-type = "spec-search-replace"
-regex = '%global build_offload_nvptx 1'
-replacement = '%global build_offload_nvptx 0'
-
-[[components.gcc.overlays]]
-description = "Disable AMDGCN offload support"
-type = "spec-search-replace"
-regex = '%global build_offload_amdgcn 1'
-replacement = '%global build_offload_amdgcn 0'
diff --git a/base/comps/gcc/overlays/0001-disable-ada-language-support.overlay.toml b/base/comps/gcc/overlays/0001-disable-ada-language-support.overlay.toml
new file mode 100644
index 00000000000..53214994774
--- /dev/null
+++ b/base/comps/gcc/overlays/0001-disable-ada-language-support.overlay.toml
@@ -0,0 +1,56 @@
+# Our build of GCC does not support many of the language frontends Fedora
+# supports. We also do not want GPU offload to be done by GCC. It is better done
+# via libraries like CUDA. Dropping support for these features make the build
+# faster. The overlays below implement those choices.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable Ada language support"
+type = "spec-search-replace"
+regex = "%global build_ada 1"
+replacement = "%global build_ada 0"
+
+[[overlays]]
+description = "Disable Objective-C language support"
+type = "spec-search-replace"
+regex = "%global build_objc 1"
+replacement = "%global build_objc 0"
+
+[[overlays]]
+description = "Disable Go language support"
+type = "spec-search-replace"
+regex = "%global build_go 1"
+replacement = "%global build_go 0"
+
+[[overlays]]
+description = "Disable D language support"
+type = "spec-search-replace"
+regex = "%global build_d 1"
+replacement = "%global build_d 0"
+
+[[overlays]]
+description = "Disable Modula-2 language support"
+type = "spec-search-replace"
+regex = "%global build_m2 1"
+replacement = "%global build_m2 0"
+
+[[overlays]]
+description = "Disable Cobol language support"
+type = "spec-search-replace"
+regex = "%global build_cobol 1"
+replacement = "%global build_cobol 0"
+
+[[overlays]]
+description = "Disable NVPTX offload support"
+type = "spec-search-replace"
+regex = "%global build_offload_nvptx 1"
+replacement = "%global build_offload_nvptx 0"
+
+[[overlays]]
+description = "Disable AMDGCN offload support"
+type = "spec-search-replace"
+regex = "%global build_offload_amdgcn 1"
+replacement = "%global build_offload_amdgcn 0"
diff --git a/base/comps/gdb/gdb.comp.toml b/base/comps/gdb/gdb.comp.toml
index 2ae0f0377ac..9bf7b5c66bb 100644
--- a/base/comps/gdb/gdb.comp.toml
+++ b/base/comps/gdb/gdb.comp.toml
@@ -1,8 +1,2 @@
 [components.gdb]
 
-[[components.gdb.overlays]]
-description = "Remove recommends: default-yama-scope"
-type = "spec-remove-tag"
-package = "headless"
-tag = "Recommends"
-value = "default-yama-scope"
diff --git a/base/comps/gdb/overlays/0001-remove-recommends-default-yama.overlay.toml b/base/comps/gdb/overlays/0001-remove-recommends-default-yama.overlay.toml
new file mode 100644
index 00000000000..b292f7c20bb
--- /dev/null
+++ b/base/comps/gdb/overlays/0001-remove-recommends-default-yama.overlay.toml
@@ -0,0 +1,10 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove recommends: default-yama-scope"
+type = "spec-remove-tag"
+package = "headless"
+tag = "Recommends"
+value = "default-yama-scope"
diff --git a/base/comps/giflib/giflib.comp.toml b/base/comps/giflib/giflib.comp.toml
index c3a5ac2aec1..e7df5f63571 100644
--- a/base/comps/giflib/giflib.comp.toml
+++ b/base/comps/giflib/giflib.comp.toml
@@ -1,90 +1 @@
 [components.giflib]
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# Remove all mingw subpackages and their build dependencies.
-
-[[components.giflib.overlays]]
-description = "Remove mingw32-giflib subpackage — Azure Linux does not ship mingw toolchains"
-type = "spec-remove-subpackage"
-package = "mingw32-%{name}"
-
-[[components.giflib.overlays]]
-description = "Remove mingw32-giflib-tools subpackage"
-type = "spec-remove-subpackage"
-package = "mingw32-%{name}-tools"
-
-[[components.giflib.overlays]]
-description = "Remove mingw64-giflib subpackage"
-type = "spec-remove-subpackage"
-package = "mingw64-%{name}"
-
-[[components.giflib.overlays]]
-description = "Remove mingw64-giflib-tools subpackage"
-type = "spec-remove-subpackage"
-package = "mingw64-%{name}-tools"
-
-[[components.giflib.overlays]]
-description = "Remove mingw32-filesystem BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-filesystem"
-
-[[components.giflib.overlays]]
-description = "Remove mingw32-gcc BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-gcc"
-
-[[components.giflib.overlays]]
-description = "Remove mingw64-filesystem BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-filesystem"
-
-[[components.giflib.overlays]]
-description = "Remove mingw64-gcc BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-gcc"
-
-[[components.giflib.overlays]]
-description = "Remove mingw cmake build step"
-type = "spec-search-replace"
-section = "%build"
-regex = '^\%mingw_cmake$'
-replacement = ''
-
-[[components.giflib.overlays]]
-description = "Remove mingw make build step"
-type = "spec-search-replace"
-section = "%build"
-regex = '^\%mingw_make_build$'
-replacement = ''
-
-[[components.giflib.overlays]]
-description = "Remove mingw install steps"
-type = "spec-search-replace"
-section = "%install"
-regex = '^\%mingw_make_install$'
-replacement = ''
-
-[[components.giflib.overlays]]
-description = "Remove mingw mandir cleanup (mingw32)"
-type = "spec-search-replace"
-section = "%install"
-regex = '^rm -rf %\{buildroot\}%\{mingw32_mandir\}$'
-replacement = ''
-
-[[components.giflib.overlays]]
-description = "Remove mingw mandir cleanup (mingw64)"
-type = "spec-search-replace"
-section = "%install"
-regex = '^rm -rf %\{buildroot\}%\{mingw64_mandir\}$'
-replacement = ''
-
-[[components.giflib.overlays]]
-description = "Remove mingw debug install post step"
-type = "spec-search-replace"
-section = "%install"
-regex = '^\%mingw_debug_install_post$'
-replacement = ''
diff --git a/base/comps/giflib/overlays/0001-remove-mingw32-giflib-subpackage.overlay.toml b/base/comps/giflib/overlays/0001-remove-mingw32-giflib-subpackage.overlay.toml
new file mode 100644
index 00000000000..e7f72d51add
--- /dev/null
+++ b/base/comps/giflib/overlays/0001-remove-mingw32-giflib-subpackage.overlay.toml
@@ -0,0 +1,92 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# Remove all mingw subpackages and their build dependencies.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove mingw32-giflib subpackage — Azure Linux does not ship mingw toolchains"
+type = "spec-remove-subpackage"
+package = "mingw32-%{name}"
+
+[[overlays]]
+description = "Remove mingw32-giflib-tools subpackage"
+type = "spec-remove-subpackage"
+package = "mingw32-%{name}-tools"
+
+[[overlays]]
+description = "Remove mingw64-giflib subpackage"
+type = "spec-remove-subpackage"
+package = "mingw64-%{name}"
+
+[[overlays]]
+description = "Remove mingw64-giflib-tools subpackage"
+type = "spec-remove-subpackage"
+package = "mingw64-%{name}-tools"
+
+[[overlays]]
+description = "Remove mingw32-filesystem BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-filesystem"
+
+[[overlays]]
+description = "Remove mingw32-gcc BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-gcc"
+
+[[overlays]]
+description = "Remove mingw64-filesystem BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-filesystem"
+
+[[overlays]]
+description = "Remove mingw64-gcc BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-gcc"
+
+[[overlays]]
+description = "Remove mingw cmake build step"
+type = "spec-search-replace"
+section = "%build"
+regex = "^\\%mingw_cmake$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw make build step"
+type = "spec-search-replace"
+section = "%build"
+regex = "^\\%mingw_make_build$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw install steps"
+type = "spec-search-replace"
+section = "%install"
+regex = "^\\%mingw_make_install$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw mandir cleanup (mingw32)"
+type = "spec-search-replace"
+section = "%install"
+regex = "^rm -rf %\\{buildroot\\}%\\{mingw32_mandir\\}$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw mandir cleanup (mingw64)"
+type = "spec-search-replace"
+section = "%install"
+regex = "^rm -rf %\\{buildroot\\}%\\{mingw64_mandir\\}$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw debug install post step"
+type = "spec-search-replace"
+section = "%install"
+regex = "^\\%mingw_debug_install_post$"
+replacement = ""
diff --git a/base/comps/glycin/glycin.comp.toml b/base/comps/glycin/glycin.comp.toml
index e90ff6005fc..5d6a38e0840 100644
--- a/base/comps/glycin/glycin.comp.toml
+++ b/base/comps/glycin/glycin.comp.toml
@@ -4,15 +4,3 @@
 [components.glycin.build]
 without = ["heif", "jpegxl"]
 
-[[components.glycin.overlays]]
-description = "Remove glycin-heif/jxl loader sources to prevent cargo from generating unresolvable crate BRs"
-type = "spec-search-replace"
-section = "%prep"
-regex = 'rm -r glycin-loaders/glycin-jpeg2000'
-replacement = """rm -r glycin-loaders/glycin-jpeg2000
-%if %{without heif}
-rm -rf glycin-loaders/glycin-heif
-%endif
-%if %{without jpegxl}
-rm -rf glycin-loaders/glycin-jxl
-%endif"""
diff --git a/base/comps/glycin/overlays/0001-remove-glycin-heif-jxl.overlay.toml b/base/comps/glycin/overlays/0001-remove-glycin-heif-jxl.overlay.toml
new file mode 100644
index 00000000000..6c876cb9f40
--- /dev/null
+++ b/base/comps/glycin/overlays/0001-remove-glycin-heif-jxl.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove glycin-heif/jxl loader sources to prevent cargo from generating unresolvable crate BRs"
+type = "spec-search-replace"
+section = "%prep"
+regex = "rm -r glycin-loaders/glycin-jpeg2000"
+replacement = "rm -r glycin-loaders/glycin-jpeg2000\n%if %{without heif}\nrm -rf glycin-loaders/glycin-heif\n%endif\n%if %{without jpegxl}\nrm -rf glycin-loaders/glycin-jxl\n%endif"
diff --git a/base/comps/gnome-remote-desktop/gnome-remote-desktop.comp.toml b/base/comps/gnome-remote-desktop/gnome-remote-desktop.comp.toml
index 8a2d1617338..38f11f05085 100644
--- a/base/comps/gnome-remote-desktop/gnome-remote-desktop.comp.toml
+++ b/base/comps/gnome-remote-desktop/gnome-remote-desktop.comp.toml
@@ -1,110 +1,2 @@
 [components.gnome-remote-desktop]
 build.without = ["rdp"]
-
-# AZL does not ship opus. Opus is a hard meson dependency when RDP is
-# enabled, so disable the RDP backend via build.without and remove
-# RDP-only file entries so %files doesn't list missing files.
-
-# Drop pkgconfig(ffnvcodec) BuildRequires — nv-codec-headers is not
-# shipped in AZL and is only needed for the (disabled) RDP backend's
-# NVENC hardware-encode path.
-[[components.gnome-remote-desktop.overlays]]
-description = "Drop unconditional pkgconfig(ffnvcodec) BR; nv-codec-headers is not in AZL and is only used by the disabled RDP backend"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(ffnvcodec)"
-
-# Remove RDP-only libexec entries from %files
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only enable-service from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_libexecdir\}/gnome-remote-desktop-enable-service'
-replacement = ''
-
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only configuration-daemon from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_libexecdir\}/gnome-remote-desktop-configuration-daemon'
-replacement = ''
-
-# Remove RDP-only systemd units from %files
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only handover unit from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_userunitdir\}/%\{systemd_unit_handover\}'
-replacement = ''
-
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only system unit from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_unitdir\}/%\{systemd_unit_system\}'
-replacement = ''
-
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only configuration service unit from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_unitdir\}/gnome-remote-desktop-configuration\.service'
-replacement = ''
-
-# Remove RDP-only desktop/dbus entries from %files
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only handover desktop file from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_datadir\}/applications/org\.gnome\.RemoteDesktop\.Handover\.desktop'
-replacement = ''
-
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only dbus system service from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_datadir\}/dbus-1/system-services/org\.gnome\.RemoteDesktop\.Configuration\.service'
-replacement = ''
-
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only dbus system.d conf from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_datadir\}/dbus-1/system\.d/org\.gnome\.RemoteDesktop\.conf'
-replacement = ''
-
-# Remove RDP-only polkit/sysusers/tmpfiles from %files
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only polkit configure-system-daemon policy from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_datadir\}/polkit-1/actions/org\.gnome\.remotedesktop\.configure-system-daemon\.policy'
-replacement = ''
-
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only polkit enable-system-daemon policy from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_datadir\}/polkit-1/actions/org\.gnome\.remotedesktop\.enable-system-daemon\.policy'
-replacement = ''
-
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only polkit rules from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_datadir\}/polkit-1/rules\.d/20-gnome-remote-desktop\.rules'
-replacement = ''
-
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only sysusers conf from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_sysusersdir\}/gnome-remote-desktop-sysusers\.conf'
-replacement = ''
-
-[[components.gnome-remote-desktop.overlays]]
-description = "Remove RDP-only tmpfiles conf from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_tmpfilesdir\}/gnome-remote-desktop-tmpfiles\.conf'
-replacement = ''
diff --git a/base/comps/gnome-remote-desktop/overlays/0001-drop-unconditional-pkgconfig-ffnvcodec.overlay.toml b/base/comps/gnome-remote-desktop/overlays/0001-drop-unconditional-pkgconfig-ffnvcodec.overlay.toml
new file mode 100644
index 00000000000..63ae73bb69c
--- /dev/null
+++ b/base/comps/gnome-remote-desktop/overlays/0001-drop-unconditional-pkgconfig-ffnvcodec.overlay.toml
@@ -0,0 +1,17 @@
+# AZL does not ship opus. Opus is a hard meson dependency when RDP is
+# enabled, so disable the RDP backend via build.without and remove
+# RDP-only file entries so %files doesn't list missing files.
+
+# Drop pkgconfig(ffnvcodec) BuildRequires — nv-codec-headers is not
+# shipped in AZL and is only needed for the (disabled) RDP backend's
+# NVENC hardware-encode path.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop unconditional pkgconfig(ffnvcodec) BR; nv-codec-headers is not in AZL and is only used by the disabled RDP backend"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(ffnvcodec)"
diff --git a/base/comps/gnome-remote-desktop/overlays/0002-remove-rdp-only-enable.overlay.toml b/base/comps/gnome-remote-desktop/overlays/0002-remove-rdp-only-enable.overlay.toml
new file mode 100644
index 00000000000..35bd8f2e8b2
--- /dev/null
+++ b/base/comps/gnome-remote-desktop/overlays/0002-remove-rdp-only-enable.overlay.toml
@@ -0,0 +1,98 @@
+# Remove RDP-only libexec entries from %files
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove RDP-only enable-service from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_libexecdir\\}/gnome-remote-desktop-enable-service"
+replacement = ""
+
+[[overlays]]
+description = "Remove RDP-only configuration-daemon from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_libexecdir\\}/gnome-remote-desktop-configuration-daemon"
+replacement = ""
+
+# Remove RDP-only systemd units from %files
+[[overlays]]
+description = "Remove RDP-only handover unit from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_userunitdir\\}/%\\{systemd_unit_handover\\}"
+replacement = ""
+
+[[overlays]]
+description = "Remove RDP-only system unit from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_unitdir\\}/%\\{systemd_unit_system\\}"
+replacement = ""
+
+[[overlays]]
+description = "Remove RDP-only configuration service unit from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_unitdir\\}/gnome-remote-desktop-configuration\\.service"
+replacement = ""
+
+# Remove RDP-only desktop/dbus entries from %files
+[[overlays]]
+description = "Remove RDP-only handover desktop file from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_datadir\\}/applications/org\\.gnome\\.RemoteDesktop\\.Handover\\.desktop"
+replacement = ""
+
+[[overlays]]
+description = "Remove RDP-only dbus system service from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_datadir\\}/dbus-1/system-services/org\\.gnome\\.RemoteDesktop\\.Configuration\\.service"
+replacement = ""
+
+[[overlays]]
+description = "Remove RDP-only dbus system.d conf from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_datadir\\}/dbus-1/system\\.d/org\\.gnome\\.RemoteDesktop\\.conf"
+replacement = ""
+
+# Remove RDP-only polkit/sysusers/tmpfiles from %files
+[[overlays]]
+description = "Remove RDP-only polkit configure-system-daemon policy from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_datadir\\}/polkit-1/actions/org\\.gnome\\.remotedesktop\\.configure-system-daemon\\.policy"
+replacement = ""
+
+[[overlays]]
+description = "Remove RDP-only polkit enable-system-daemon policy from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_datadir\\}/polkit-1/actions/org\\.gnome\\.remotedesktop\\.enable-system-daemon\\.policy"
+replacement = ""
+
+[[overlays]]
+description = "Remove RDP-only polkit rules from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_datadir\\}/polkit-1/rules\\.d/20-gnome-remote-desktop\\.rules"
+replacement = ""
+
+[[overlays]]
+description = "Remove RDP-only sysusers conf from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_sysusersdir\\}/gnome-remote-desktop-sysusers\\.conf"
+replacement = ""
+
+[[overlays]]
+description = "Remove RDP-only tmpfiles conf from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_tmpfilesdir\\}/gnome-remote-desktop-tmpfiles\\.conf"
+replacement = ""
diff --git a/base/comps/gnome-session/gnome-session.comp.toml b/base/comps/gnome-session/gnome-session.comp.toml
index a729d3faa0c..bf414ca5e5e 100644
--- a/base/comps/gnome-session/gnome-session.comp.toml
+++ b/base/comps/gnome-session/gnome-session.comp.toml
@@ -1,35 +1 @@
 [components.gnome-session]
-
-# Remove the wayland-session subpackage — it provides a .desktop file for
-# display managers to offer "GNOME on Wayland" as a session choice. Only gdm
-# depends on it (and gdm is being removed). Removing it also drops the
-# transitive Requires on gnome-shell.
-
-[[components.gnome-session.overlays]]
-description = "Remove %package wayland-session"
-type = "spec-remove-section"
-section = "%package"
-package = "wayland-session"
-
-[[components.gnome-session.overlays]]
-description = "Remove %description wayland-session"
-type = "spec-remove-section"
-section = "%description"
-package = "wayland-session"
-
-[[components.gnome-session.overlays]]
-description = "Remove %files wayland-session"
-type = "spec-remove-section"
-section = "%files"
-package = "wayland-session"
-
-# Delete installed wayland-session files to avoid unpackaged file errors
-[[components.gnome-session.overlays]]
-description = "Delete wayland-session files from buildroot"
-type = "spec-append-lines"
-section = "%install"
-lines = [
-    "",
-    "# Remove wayland-session files (subpackage removed for Azure Linux)",
-    "rm -rf %{buildroot}%{_datadir}/wayland-sessions",
-]
diff --git a/base/comps/gnome-session/overlays/0001-remove-package-wayland-session.overlay.toml b/base/comps/gnome-session/overlays/0001-remove-package-wayland-session.overlay.toml
new file mode 100644
index 00000000000..6cf8009c7be
--- /dev/null
+++ b/base/comps/gnome-session/overlays/0001-remove-package-wayland-session.overlay.toml
@@ -0,0 +1,32 @@
+# Remove the wayland-session subpackage — it provides a .desktop file for
+# display managers to offer "GNOME on Wayland" as a session choice. Only gdm
+# depends on it (and gdm is being removed). Removing it also drops the
+# transitive Requires on gnome-shell.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove %package wayland-session"
+type = "spec-remove-section"
+section = "%package"
+package = "wayland-session"
+
+[[overlays]]
+description = "Remove %description wayland-session"
+type = "spec-remove-section"
+section = "%description"
+package = "wayland-session"
+
+[[overlays]]
+description = "Remove %files wayland-session"
+type = "spec-remove-section"
+section = "%files"
+package = "wayland-session"
+
+# Delete installed wayland-session files to avoid unpackaged file errors
+[[overlays]]
+description = "Delete wayland-session files from buildroot"
+type = "spec-append-lines"
+section = "%install"
+lines = ["", "# Remove wayland-session files (subpackage removed for Azure Linux)", "rm -rf %{buildroot}%{_datadir}/wayland-sessions"]
diff --git a/base/comps/gstreamer1-plugins-base/gstreamer1-plugins-base.comp.toml b/base/comps/gstreamer1-plugins-base/gstreamer1-plugins-base.comp.toml
index 15967329dfa..53e656fffe9 100644
--- a/base/comps/gstreamer1-plugins-base/gstreamer1-plugins-base.comp.toml
+++ b/base/comps/gstreamer1-plugins-base/gstreamer1-plugins-base.comp.toml
@@ -1,24 +1 @@
 [components.gstreamer1-plugins-base]
-
-# AZL does not ship opus — disable the opus plugin and remove its BR.
-
-[[components.gstreamer1-plugins-base.overlays]]
-description = "Remove opus-devel BuildRequires (opus not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "opus-devel"
-
-[[components.gstreamer1-plugins-base.overlays]]
-description = "Disable the opus meson option"
-type = "spec-search-replace"
-section = "%build"
-regex = '%meson \\'
-replacement = """%meson \\
-  -D opus=disabled \\"""
-
-[[components.gstreamer1-plugins-base.overlays]]
-description = "Remove libgstopus.so from %files"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_libdir\}/gstreamer-%\{majorminor\}/libgstopus\.so'
-replacement = ''
diff --git a/base/comps/gstreamer1-plugins-base/overlays/0001-remove-opus-devel-buildrequires.overlay.toml b/base/comps/gstreamer1-plugins-base/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..15b7f354ff5
--- /dev/null
+++ b/base/comps/gstreamer1-plugins-base/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
@@ -0,0 +1,24 @@
+# AZL does not ship opus — disable the opus plugin and remove its BR.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove opus-devel BuildRequires (opus not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "opus-devel"
+
+[[overlays]]
+description = "Disable the opus meson option"
+type = "spec-search-replace"
+section = "%build"
+regex = "%meson \\\\"
+replacement = "%meson \\\n  -D opus=disabled \\"
+
+[[overlays]]
+description = "Remove libgstopus.so from %files"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_libdir\\}/gstreamer-%\\{majorminor\\}/libgstopus\\.so"
+replacement = ""
diff --git a/base/comps/gstreamer1-plugins-good/gstreamer1-plugins-good.comp.toml b/base/comps/gstreamer1-plugins-good/gstreamer1-plugins-good.comp.toml
index 1ef0a38c6cb..ecf8017da49 100644
--- a/base/comps/gstreamer1-plugins-good/gstreamer1-plugins-good.comp.toml
+++ b/base/comps/gstreamer1-plugins-good/gstreamer1-plugins-good.comp.toml
@@ -1,24 +1 @@
 [components.gstreamer1-plugins-good]
-
-# v4l-utils/libv4l not shipped in AZL — disable the v4l2 GStreamer plugin.
-
-[[components.gstreamer1-plugins-good.overlays]]
-description = "Remove libv4l-devel BuildRequires — libv4l not shipped in AZL"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "libv4l-devel"
-
-[[components.gstreamer1-plugins-good.overlays]]
-description = "Disable v4l2 meson option — libv4l not shipped in AZL"
-type = "spec-search-replace"
-section = "%build"
-regex = '%meson \\'
-replacement = '''%meson \
-  -D v4l2=disabled \'''
-
-[[components.gstreamer1-plugins-good.overlays]]
-description = "Remove libgstvideo4linux2.so from %files — v4l2 plugin disabled"
-type = "spec-search-replace"
-section = "%files"
-regex = '.*libgstvideo4linux2.*'
-replacement = ""
diff --git a/base/comps/gstreamer1-plugins-good/overlays/0001-remove-libv4l-devel-buildrequires.overlay.toml b/base/comps/gstreamer1-plugins-good/overlays/0001-remove-libv4l-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..1556a2b97db
--- /dev/null
+++ b/base/comps/gstreamer1-plugins-good/overlays/0001-remove-libv4l-devel-buildrequires.overlay.toml
@@ -0,0 +1,24 @@
+# v4l-utils/libv4l not shipped in AZL — disable the v4l2 GStreamer plugin.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove libv4l-devel BuildRequires — libv4l not shipped in AZL"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "libv4l-devel"
+
+[[overlays]]
+description = "Disable v4l2 meson option — libv4l not shipped in AZL"
+type = "spec-search-replace"
+section = "%build"
+regex = "%meson \\\\"
+replacement = "%meson \\\n  -D v4l2=disabled \\"
+
+[[overlays]]
+description = "Remove libgstvideo4linux2.so from %files — v4l2 plugin disabled"
+type = "spec-search-replace"
+section = "%files"
+regex = ".*libgstvideo4linux2.*"
+replacement = ""
diff --git a/base/comps/gtk-vnc/gtk-vnc.comp.toml b/base/comps/gtk-vnc/gtk-vnc.comp.toml
index 090953679ef..537342499f3 100644
--- a/base/comps/gtk-vnc/gtk-vnc.comp.toml
+++ b/base/comps/gtk-vnc/gtk-vnc.comp.toml
@@ -1,12 +1 @@
 [components.gtk-vnc]
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# The upstream spec hard-codes `%global with_mingw 1` whenever %fedora is
-# defined (true in our build environment) rather than gating on a %bcond, so
-# the standard `build.without = ["mingw"]` mechanism has no effect. Force it
-# off via spec overlay.
-[[components.gtk-vnc.overlays]]
-description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
-type = "spec-search-replace"
-regex = '%global with_mingw 1'
-replacement = '%global with_mingw 0'
diff --git a/base/comps/gtk-vnc/overlays/0001-disable-mingw-sub-packages.overlay.toml b/base/comps/gtk-vnc/overlays/0001-disable-mingw-sub-packages.overlay.toml
new file mode 100644
index 00000000000..9ea750a6735
--- /dev/null
+++ b/base/comps/gtk-vnc/overlays/0001-disable-mingw-sub-packages.overlay.toml
@@ -0,0 +1,15 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# The upstream spec hard-codes `%global with_mingw 1` whenever %fedora is
+# defined (true in our build environment) rather than gating on a %bcond, so
+# the standard `build.without = ["mingw"]` mechanism has no effect. Force it
+# off via spec overlay.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
+type = "spec-search-replace"
+regex = "%global with_mingw 1"
+replacement = "%global with_mingw 0"
diff --git a/base/comps/gtk4/gtk4.comp.toml b/base/comps/gtk4/gtk4.comp.toml
index 0053ab33aab..03c8e60b4c0 100644
--- a/base/comps/gtk4/gtk4.comp.toml
+++ b/base/comps/gtk4/gtk4.comp.toml
@@ -1,37 +1 @@
 [components.gtk4]
-
-# gtk4 4.20.3's meson hard-requires libdrm but the upstream Fedora
-# spec does not declare a BuildRequires on libdrm-devel. Without
-# this BR the build fails at meson.build:731. This is a latent
-# upstream gap; keep the BR even though gtk4 itself now lives in sdk.
-
-[[components.gtk4.overlays]]
-description = "Add missing libdrm BuildRequires (gtk4 4.20+ meson requirement)"
-type = "spec-add-tag"
-tag = "BuildRequires"
-value = "pkgconfig(libdrm)"
-
-# gstreamer1-plugins-bad-free is not shipped in AZL.  Disable GTK4's
-# GStreamer media backend so the build and runtime do not depend on it.
-# GstPlayer (gstreamer-player-1.0) lives in gstreamer1-plugins-bad-free-libs,
-# which is the source of both the BuildRequires and the runtime Requires below.
-
-[[components.gtk4.overlays]]
-description = "Remove gstreamer-player-1.0 BuildRequires — gstreamer1-plugins-bad-free not shipped in AZL"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(gstreamer-player-1.0) >= %{gstreamer_version}"
-
-[[components.gtk4.overlays]]
-description = "Disable gstreamer media backend at meson configure time"
-type = "spec-search-replace"
-section = "%build"
-regex = '%meson \\'
-replacement = '''%meson \
-        -Dmedia-gstreamer=disabled \'''
-
-[[components.gtk4.overlays]]
-description = "Remove runtime Requires on gstreamer1-plugins-bad-free-libs (gstreamer media backend disabled)"
-type = "spec-remove-tag"
-tag = "Requires"
-value = "gstreamer1-plugins-bad-free-libs%{?_isa} >= %{gstreamer_version}"
diff --git a/base/comps/gtk4/overlays/0001-add-missing-libdrm-buildrequires.overlay.toml b/base/comps/gtk4/overlays/0001-add-missing-libdrm-buildrequires.overlay.toml
new file mode 100644
index 00000000000..68ce7ad52b1
--- /dev/null
+++ b/base/comps/gtk4/overlays/0001-add-missing-libdrm-buildrequires.overlay.toml
@@ -0,0 +1,14 @@
+# gtk4 4.20.3's meson hard-requires libdrm but the upstream Fedora
+# spec does not declare a BuildRequires on libdrm-devel. Without
+# this BR the build fails at meson.build:731. This is a latent
+# upstream gap; keep the BR even though gtk4 itself now lives in sdk.
+
+[metadata]
+category = "azl-compatibility"
+upstreamable = true
+
+[[overlays]]
+description = "Add missing libdrm BuildRequires (gtk4 4.20+ meson requirement)"
+type = "spec-add-tag"
+tag = "BuildRequires"
+value = "pkgconfig(libdrm)"
diff --git a/base/comps/gtk4/overlays/0002-remove-gstreamer-player-1.overlay.toml b/base/comps/gtk4/overlays/0002-remove-gstreamer-player-1.overlay.toml
new file mode 100644
index 00000000000..4e6ce24db67
--- /dev/null
+++ b/base/comps/gtk4/overlays/0002-remove-gstreamer-player-1.overlay.toml
@@ -0,0 +1,27 @@
+# gstreamer1-plugins-bad-free is not shipped in AZL.  Disable GTK4's
+# GStreamer media backend so the build and runtime do not depend on it.
+# GstPlayer (gstreamer-player-1.0) lives in gstreamer1-plugins-bad-free-libs,
+# which is the source of both the BuildRequires and the runtime Requires below.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove gstreamer-player-1.0 BuildRequires — gstreamer1-plugins-bad-free not shipped in AZL"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(gstreamer-player-1.0) >= %{gstreamer_version}"
+
+[[overlays]]
+description = "Disable gstreamer media backend at meson configure time"
+type = "spec-search-replace"
+section = "%build"
+regex = "%meson \\\\"
+replacement = "%meson \\\n        -Dmedia-gstreamer=disabled \\"
+
+[[overlays]]
+description = "Remove runtime Requires on gstreamer1-plugins-bad-free-libs (gstreamer media backend disabled)"
+type = "spec-remove-tag"
+tag = "Requires"
+value = "gstreamer1-plugins-bad-free-libs%{?_isa} >= %{gstreamer_version}"
diff --git a/base/comps/gvfs/gvfs.comp.toml b/base/comps/gvfs/gvfs.comp.toml
index 482b64f9107..65588228751 100644
--- a/base/comps/gvfs/gvfs.comp.toml
+++ b/base/comps/gvfs/gvfs.comp.toml
@@ -1,16 +1 @@
 [components.gvfs]
-
-# AZL does not ship libbluray — Blu-Ray playback support is dropped from gvfs.
-
-[[components.gvfs.overlays]]
-description = "Drop BuildRequires: pkgconfig(libbluray) (libbluray not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(libbluray)"
-
-[[components.gvfs.overlays]]
-description = "Pass -Dbluray=false to meson unconditionally (libbluray not available in AZL)"
-type = "spec-search-replace"
-section = "%build"
-regex = '-Dman=true \\'
-replacement = "-Dman=true \\\n       -Dbluray=false \\"
diff --git a/base/comps/gvfs/overlays/0001-drop-buildrequires-pkgconfig-libbluray.overlay.toml b/base/comps/gvfs/overlays/0001-drop-buildrequires-pkgconfig-libbluray.overlay.toml
new file mode 100644
index 00000000000..baf8639ce58
--- /dev/null
+++ b/base/comps/gvfs/overlays/0001-drop-buildrequires-pkgconfig-libbluray.overlay.toml
@@ -0,0 +1,17 @@
+# AZL does not ship libbluray — Blu-Ray playback support is dropped from gvfs.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Drop BuildRequires: pkgconfig(libbluray) (libbluray not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(libbluray)"
+
+[[overlays]]
+description = "Pass -Dbluray=false to meson unconditionally (libbluray not available in AZL)"
+type = "spec-search-replace"
+section = "%build"
+regex = "-Dman=true \\\\"
+replacement = "-Dman=true \\\n       -Dbluray=false \\"
diff --git a/base/comps/hidapi/hidapi.comp.toml b/base/comps/hidapi/hidapi.comp.toml
index 922ff8311e4..c58039b1e39 100644
--- a/base/comps/hidapi/hidapi.comp.toml
+++ b/base/comps/hidapi/hidapi.comp.toml
@@ -1,78 +1 @@
 [components.hidapi]
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# Remove all mingw subpackages and their build dependencies.
-
-[[components.hidapi.overlays]]
-description = "Remove mingw32-hidapi subpackage — Azure Linux does not ship mingw toolchains"
-type = "spec-remove-subpackage"
-package = "mingw32-hidapi"
-
-[[components.hidapi.overlays]]
-description = "Remove mingw64-hidapi subpackage"
-type = "spec-remove-subpackage"
-package = "mingw64-hidapi"
-
-[[components.hidapi.overlays]]
-description = "Remove mingw32-filesystem BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-filesystem >= 95"
-
-[[components.hidapi.overlays]]
-description = "Remove mingw32-gcc BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-gcc"
-
-[[components.hidapi.overlays]]
-description = "Remove mingw32-binutils BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-binutils"
-
-[[components.hidapi.overlays]]
-description = "Remove mingw64-filesystem BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-filesystem >= 95"
-
-[[components.hidapi.overlays]]
-description = "Remove mingw64-gcc BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-gcc"
-
-[[components.hidapi.overlays]]
-description = "Remove mingw64-binutils BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-binutils"
-
-[[components.hidapi.overlays]]
-description = "Remove mingw cmake build step"
-type = "spec-search-replace"
-section = "%build"
-regex = '^\%mingw_cmake$'
-replacement = ''
-
-[[components.hidapi.overlays]]
-description = "Remove mingw make build step"
-type = "spec-search-replace"
-section = "%build"
-regex = '^\%mingw_make_build$'
-replacement = ''
-
-[[components.hidapi.overlays]]
-description = "Remove mingw install step"
-type = "spec-search-replace"
-section = "%install"
-regex = '^\%mingw_make_install$'
-replacement = ''
-
-[[components.hidapi.overlays]]
-description = "Remove mingw debug install post step"
-type = "spec-search-replace"
-section = "%install"
-regex = '^\%mingw_debug_install_post$'
-replacement = ''
diff --git a/base/comps/hidapi/overlays/0001-remove-mingw32-hidapi-subpackage.overlay.toml b/base/comps/hidapi/overlays/0001-remove-mingw32-hidapi-subpackage.overlay.toml
new file mode 100644
index 00000000000..0afdf10d96a
--- /dev/null
+++ b/base/comps/hidapi/overlays/0001-remove-mingw32-hidapi-subpackage.overlay.toml
@@ -0,0 +1,80 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# Remove all mingw subpackages and their build dependencies.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove mingw32-hidapi subpackage — Azure Linux does not ship mingw toolchains"
+type = "spec-remove-subpackage"
+package = "mingw32-hidapi"
+
+[[overlays]]
+description = "Remove mingw64-hidapi subpackage"
+type = "spec-remove-subpackage"
+package = "mingw64-hidapi"
+
+[[overlays]]
+description = "Remove mingw32-filesystem BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-filesystem >= 95"
+
+[[overlays]]
+description = "Remove mingw32-gcc BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-gcc"
+
+[[overlays]]
+description = "Remove mingw32-binutils BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-binutils"
+
+[[overlays]]
+description = "Remove mingw64-filesystem BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-filesystem >= 95"
+
+[[overlays]]
+description = "Remove mingw64-gcc BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-gcc"
+
+[[overlays]]
+description = "Remove mingw64-binutils BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-binutils"
+
+[[overlays]]
+description = "Remove mingw cmake build step"
+type = "spec-search-replace"
+section = "%build"
+regex = "^\\%mingw_cmake$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw make build step"
+type = "spec-search-replace"
+section = "%build"
+regex = "^\\%mingw_make_build$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw install step"
+type = "spec-search-replace"
+section = "%install"
+regex = "^\\%mingw_make_install$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw debug install post step"
+type = "spec-search-replace"
+section = "%install"
+regex = "^\\%mingw_debug_install_post$"
+replacement = ""
diff --git a/base/comps/imlib2/imlib2.comp.toml b/base/comps/imlib2/imlib2.comp.toml
index 22c14f1a5a4..d9d4437bd2b 100644
--- a/base/comps/imlib2/imlib2.comp.toml
+++ b/base/comps/imlib2/imlib2.comp.toml
@@ -1,14 +1 @@
 [components.imlib2]
-
-# Disable HEIF support — libheif is being retired from Azure Linux 4.0.
-# Upstream spec has no explicit configure flag for heif; the heif loader
-# is auto-detected via pkg-config when libheif-devel is present. Removing
-# the BuildRequires causes configure to skip the loader, and the
-# %{_libdir}/imlib2/ directory glob in %files absorbs the missing plugin
-# without an "unpackaged file" error.
-
-[[components.imlib2.overlays]]
-description = "Drop libheif build dependency ahead of libheif removal from Azure Linux 4.0"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "libheif-devel"
diff --git a/base/comps/imlib2/overlays/0001-drop-libheif-build-dependency.overlay.toml b/base/comps/imlib2/overlays/0001-drop-libheif-build-dependency.overlay.toml
new file mode 100644
index 00000000000..b1e3563665a
--- /dev/null
+++ b/base/comps/imlib2/overlays/0001-drop-libheif-build-dependency.overlay.toml
@@ -0,0 +1,16 @@
+# Disable HEIF support — libheif is being retired from Azure Linux 4.0.
+# Upstream spec has no explicit configure flag for heif; the heif loader
+# is auto-detected via pkg-config when libheif-devel is present. Removing
+# the BuildRequires causes configure to skip the loader, and the
+# %{_libdir}/imlib2/ directory glob in %files absorbs the missing plugin
+# without an "unpackaged file" error.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop libheif build dependency ahead of libheif removal from Azure Linux 4.0"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "libheif-devel"
diff --git a/base/comps/imsettings/imsettings.comp.toml b/base/comps/imsettings/imsettings.comp.toml
index c157932cefa..5183490bbbe 100644
--- a/base/comps/imsettings/imsettings.comp.toml
+++ b/base/comps/imsettings/imsettings.comp.toml
@@ -1,12 +1,2 @@
 [components.imsettings]
 
-[[components.imsettings.overlays]]
-description = "Drop -cinnamon subpackage; Cinnamon DE not shipped on Azure Linux 4.0."
-type = "spec-remove-subpackage"
-package = "cinnamon"
-
-[[components.imsettings.overlays]]
-description = "Delete orphaned libimsettings-cinnamon-gsettings.so from buildroot."
-type = "spec-append-lines"
-section = "%install"
-lines = ["rm -f %{buildroot}%{_libdir}/imsettings/libimsettings-cinnamon-gsettings.so"]
diff --git a/base/comps/imsettings/overlays/0001-drop-cinnamon-subpackage-cinnamon.overlay.toml b/base/comps/imsettings/overlays/0001-drop-cinnamon-subpackage-cinnamon.overlay.toml
new file mode 100644
index 00000000000..072d81be606
--- /dev/null
+++ b/base/comps/imsettings/overlays/0001-drop-cinnamon-subpackage-cinnamon.overlay.toml
@@ -0,0 +1,14 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop -cinnamon subpackage; Cinnamon DE not shipped on Azure Linux 4.0."
+type = "spec-remove-subpackage"
+package = "cinnamon"
+
+[[overlays]]
+description = "Delete orphaned libimsettings-cinnamon-gsettings.so from buildroot."
+type = "spec-append-lines"
+section = "%install"
+lines = ["rm -f %{buildroot}%{_libdir}/imsettings/libimsettings-cinnamon-gsettings.so"]
diff --git a/base/comps/jack-audio-connection-kit/jack-audio-connection-kit.comp.toml b/base/comps/jack-audio-connection-kit/jack-audio-connection-kit.comp.toml
index 88aea877d5d..0e39f788e69 100644
--- a/base/comps/jack-audio-connection-kit/jack-audio-connection-kit.comp.toml
+++ b/base/comps/jack-audio-connection-kit/jack-audio-connection-kit.comp.toml
@@ -1,17 +1 @@
 [components.jack-audio-connection-kit]
-
-# AZL is removing opus — remove the BR and explicitly disable opus.
-
-[[components.jack-audio-connection-kit.overlays]]
-description = "Remove opus-devel BuildRequires (opus being removed from AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "opus-devel"
-
-[[components.jack-audio-connection-kit.overlays]]
-description = "Disable opus support in waf configure"
-type = "spec-search-replace"
-section = "%build"
-regex = 'python3 \./waf configure \\'
-replacement = """python3 ./waf configure \\
-   --no-opus \\"""
diff --git a/base/comps/jack-audio-connection-kit/overlays/0001-remove-opus-devel-buildrequires.overlay.toml b/base/comps/jack-audio-connection-kit/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..4a79db6bd7d
--- /dev/null
+++ b/base/comps/jack-audio-connection-kit/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
@@ -0,0 +1,17 @@
+# AZL is removing opus — remove the BR and explicitly disable opus.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove opus-devel BuildRequires (opus being removed from AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "opus-devel"
+
+[[overlays]]
+description = "Disable opus support in waf configure"
+type = "spec-search-replace"
+section = "%build"
+regex = "python3 \\./waf configure \\\\"
+replacement = "python3 ./waf configure \\\n   --no-opus \\"
diff --git a/base/comps/java-25-openjdk-portable/java-25-openjdk-portable.comp.toml b/base/comps/java-25-openjdk-portable/java-25-openjdk-portable.comp.toml
index 79932c23de5..63e7682ca29 100644
--- a/base/comps/java-25-openjdk-portable/java-25-openjdk-portable.comp.toml
+++ b/base/comps/java-25-openjdk-portable/java-25-openjdk-portable.comp.toml
@@ -20,29 +20,3 @@ build.without = ["slowdebug"]
 # new AZL-only changes on top of the pinned upstream commit.
 azl_release = "2"
 
-[[components.java-25-openjdk-portable.overlays]]
-description = "Add azl_release to upstream %{rpmrelease} so we can bump release independently of upstream while keeping a single-number Fedora-style Release schema"
-type = "spec-search-replace"
-regex = '^Release:\s+%\{\?eaprefix\}%\{rpmrelease\}%\{\?extraver\}%\{\?dist\}$'
-replacement = 'Release: %{?eaprefix}%[%{rpmrelease} + %{azl_release}]%{?extraver}%{?dist}'
-
-[[components.java-25-openjdk-portable.overlays]]
-description = "Override buildjdkver to use Java 25 instead of 24 for bootstrap"
-type = "spec-search-replace"
-regex = '^%global buildjdkver 24$'
-replacement = '%global buildjdkver 25'
-
-# We are working off an older version of the -portable spec which hardcoded BuildRequires
-# to java-latest*. The buildjdkver change above will not remove that dependency. We have
-# to explicitly replace the -latest dependency with -25.
-[[components.java-25-openjdk-portable.overlays]]
-description = "Remove upstream java-latest BuildRequires to avoid pulling java-latest-openjdk-devel"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "java-latest-openjdk-devel"
-
-[[components.java-25-openjdk-portable.overlays]]
-description = "Add BuildRequires on java-25-openjdk-devel instead of java-latest-openjdk-devel"
-type = "spec-add-tag"
-tag = "BuildRequires"
-value = "java-25-openjdk-devel"
diff --git a/base/comps/java-25-openjdk-portable/overlays/0001-add-release-upstream-rpmrelease.overlay.toml b/base/comps/java-25-openjdk-portable/overlays/0001-add-release-upstream-rpmrelease.overlay.toml
new file mode 100644
index 00000000000..fede583b86c
--- /dev/null
+++ b/base/comps/java-25-openjdk-portable/overlays/0001-add-release-upstream-rpmrelease.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-release-management"
+upstreamable = false
+
+[[overlays]]
+description = "Add azl_release to upstream %{rpmrelease} so we can bump release independently of upstream while keeping a single-number Fedora-style Release schema"
+type = "spec-search-replace"
+regex = "^Release:\\s+%\\{\\?eaprefix\\}%\\{rpmrelease\\}%\\{\\?extraver\\}%\\{\\?dist\\}$"
+replacement = "Release: %{?eaprefix}%[%{rpmrelease} + %{azl_release}]%{?extraver}%{?dist}"
diff --git a/base/comps/java-25-openjdk-portable/overlays/0002-override-buildjdkver-java-25.overlay.toml b/base/comps/java-25-openjdk-portable/overlays/0002-override-buildjdkver-java-25.overlay.toml
new file mode 100644
index 00000000000..2de610d8e23
--- /dev/null
+++ b/base/comps/java-25-openjdk-portable/overlays/0002-override-buildjdkver-java-25.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-compatibility"
+upstreamable = false
+
+[[overlays]]
+description = "Override buildjdkver to use Java 25 instead of 24 for bootstrap"
+type = "spec-search-replace"
+regex = "^%global buildjdkver 24$"
+replacement = "%global buildjdkver 25"
diff --git a/base/comps/java-25-openjdk-portable/overlays/0003-remove-upstream-java-latest.overlay.toml b/base/comps/java-25-openjdk-portable/overlays/0003-remove-upstream-java-latest.overlay.toml
new file mode 100644
index 00000000000..294dfc61eed
--- /dev/null
+++ b/base/comps/java-25-openjdk-portable/overlays/0003-remove-upstream-java-latest.overlay.toml
@@ -0,0 +1,18 @@
+# We are working off an older version of the -portable spec which hardcoded BuildRequires
+# to java-latest*. The buildjdkver change above will not remove that dependency. We have
+# to explicitly replace the -latest dependency with -25.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove upstream java-latest BuildRequires to avoid pulling java-latest-openjdk-devel"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "java-latest-openjdk-devel"
+
+[[overlays]]
+description = "Add BuildRequires on java-25-openjdk-devel instead of java-latest-openjdk-devel"
+type = "spec-add-tag"
+tag = "BuildRequires"
+value = "java-25-openjdk-devel"
diff --git a/base/comps/jss/jss.comp.toml b/base/comps/jss/jss.comp.toml
index 407f72cdcc2..9e5ad9ba1cf 100644
--- a/base/comps/jss/jss.comp.toml
+++ b/base/comps/jss/jss.comp.toml
@@ -11,27 +11,3 @@ release = { calculation = "manual" }
 # See: https://src.fedoraproject.org/rpms/jss/blob/rawhide/f/jss.spec (line ~28)
 [components.jss.build]
 defines = { enable_nss_version_pqc_def_flag = "-DENABLE_NSS_VERSION_PQC_DEF=ON" }
-
-# AZL ships only java-25-openjdk; there is no java-21-openjdk, so the
-# upstream %else branch (taken when %fedora is unset, as in AZL)
-# references unsatisfiable openjdk21 packages. Retarget each %define
-# line individually so we don't accidentally rewrite historical
-# %changelog entries (spec-search-replace cannot be scoped to the
-# preamble alone).
-[[components.jss.overlays]]
-description = "Retarget java_devel to java-25-openjdk-devel"
-type = "spec-search-replace"
-regex = '^%define java_devel java-21-openjdk-devel$'
-replacement = "%define java_devel java-25-openjdk-devel"
-
-[[components.jss.overlays]]
-description = "Retarget java_headless to java-25-openjdk-headless"
-type = "spec-search-replace"
-regex = '^%define java_headless java-21-openjdk-headless$'
-replacement = "%define java_headless java-25-openjdk-headless"
-
-[[components.jss.overlays]]
-description = "Retarget java_home to jre-25-openjdk"
-type = "spec-search-replace"
-regex = '^%define java_home %\{_jvmdir\}/jre-21-openjdk$'
-replacement = "%define java_home %{_jvmdir}/jre-25-openjdk"
diff --git a/base/comps/jss/overlays/0001-retarget-java-devel-java.overlay.toml b/base/comps/jss/overlays/0001-retarget-java-devel-java.overlay.toml
new file mode 100644
index 00000000000..c085104c507
--- /dev/null
+++ b/base/comps/jss/overlays/0001-retarget-java-devel-java.overlay.toml
@@ -0,0 +1,28 @@
+# AZL ships only java-25-openjdk; there is no java-21-openjdk, so the
+# upstream %else branch (taken when %fedora is unset, as in AZL)
+# references unsatisfiable openjdk21 packages. Retarget each %define
+# line individually so we don't accidentally rewrite historical
+# %changelog entries (spec-search-replace cannot be scoped to the
+# preamble alone).
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Retarget java_devel to java-25-openjdk-devel"
+type = "spec-search-replace"
+regex = "^%define java_devel java-21-openjdk-devel$"
+replacement = "%define java_devel java-25-openjdk-devel"
+
+[[overlays]]
+description = "Retarget java_headless to java-25-openjdk-headless"
+type = "spec-search-replace"
+regex = "^%define java_headless java-21-openjdk-headless$"
+replacement = "%define java_headless java-25-openjdk-headless"
+
+[[overlays]]
+description = "Retarget java_home to jre-25-openjdk"
+type = "spec-search-replace"
+regex = "^%define java_home %\\{_jvmdir\\}/jre-21-openjdk$"
+replacement = "%define java_home %{_jvmdir}/jre-25-openjdk"
diff --git a/base/comps/jxrlib/jxrlib.comp.toml b/base/comps/jxrlib/jxrlib.comp.toml
index 9d1d190b5bb..1f4b2191613 100644
--- a/base/comps/jxrlib/jxrlib.comp.toml
+++ b/base/comps/jxrlib/jxrlib.comp.toml
@@ -1,85 +1 @@
 [components.jxrlib]
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# Remove all mingw subpackages and their build dependencies.
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw32-jxrlib subpackage — Azure Linux does not ship mingw toolchains"
-type = "spec-remove-subpackage"
-package = "mingw32-%{name}"
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw64-jxrlib subpackage"
-type = "spec-remove-subpackage"
-package = "mingw64-%{name}"
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw32-filesystem BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-filesystem >= 95"
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw32-gcc BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-gcc"
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw64-filesystem BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-filesystem >= 95"
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw64-gcc BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-gcc"
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw patch (only needed for mingw cross-compilation)"
-type = "patch-remove"
-file = "jxrlib_mingw.patch"
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw cmake build step"
-type = "spec-search-replace"
-section = "%build"
-regex = '^\%mingw_cmake$'
-replacement = ''
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw make build step"
-type = "spec-search-replace"
-section = "%build"
-regex = '^\%mingw_make_build$'
-replacement = ''
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw install step"
-type = "spec-search-replace"
-section = "%install"
-regex = '^\%mingw_make_install$'
-replacement = ''
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw guiddef.h cleanup (mingw32)"
-type = "spec-search-replace"
-section = "%install"
-regex = '^rm -f %\{buildroot\}%\{mingw32_includedir\}/jxrlib/guiddef\.h$'
-replacement = ''
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw guiddef.h cleanup (mingw64)"
-type = "spec-search-replace"
-section = "%install"
-regex = '^rm -f %\{buildroot\}%\{mingw64_includedir\}/jxrlib/guiddef\.h$'
-replacement = ''
-
-[[components.jxrlib.overlays]]
-description = "Remove mingw debug install post step"
-type = "spec-search-replace"
-section = "%install"
-regex = '^\%mingw_debug_install_post$'
-replacement = ''
diff --git a/base/comps/jxrlib/overlays/0001-remove-mingw32-jxrlib-subpackage.overlay.toml b/base/comps/jxrlib/overlays/0001-remove-mingw32-jxrlib-subpackage.overlay.toml
new file mode 100644
index 00000000000..1a1939bdb11
--- /dev/null
+++ b/base/comps/jxrlib/overlays/0001-remove-mingw32-jxrlib-subpackage.overlay.toml
@@ -0,0 +1,87 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# Remove all mingw subpackages and their build dependencies.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove mingw32-jxrlib subpackage — Azure Linux does not ship mingw toolchains"
+type = "spec-remove-subpackage"
+package = "mingw32-%{name}"
+
+[[overlays]]
+description = "Remove mingw64-jxrlib subpackage"
+type = "spec-remove-subpackage"
+package = "mingw64-%{name}"
+
+[[overlays]]
+description = "Remove mingw32-filesystem BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-filesystem >= 95"
+
+[[overlays]]
+description = "Remove mingw32-gcc BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-gcc"
+
+[[overlays]]
+description = "Remove mingw64-filesystem BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-filesystem >= 95"
+
+[[overlays]]
+description = "Remove mingw64-gcc BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-gcc"
+
+[[overlays]]
+description = "Remove mingw patch (only needed for mingw cross-compilation)"
+type = "patch-remove"
+file = "jxrlib_mingw.patch"
+
+[[overlays]]
+description = "Remove mingw cmake build step"
+type = "spec-search-replace"
+section = "%build"
+regex = "^\\%mingw_cmake$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw make build step"
+type = "spec-search-replace"
+section = "%build"
+regex = "^\\%mingw_make_build$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw install step"
+type = "spec-search-replace"
+section = "%install"
+regex = "^\\%mingw_make_install$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw guiddef.h cleanup (mingw32)"
+type = "spec-search-replace"
+section = "%install"
+regex = "^rm -f %\\{buildroot\\}%\\{mingw32_includedir\\}/jxrlib/guiddef\\.h$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw guiddef.h cleanup (mingw64)"
+type = "spec-search-replace"
+section = "%install"
+regex = "^rm -f %\\{buildroot\\}%\\{mingw64_includedir\\}/jxrlib/guiddef\\.h$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw debug install post step"
+type = "spec-search-replace"
+section = "%install"
+regex = "^\\%mingw_debug_install_post$"
+replacement = ""
diff --git a/base/comps/kf6-breeze-icons/kf6-breeze-icons.comp.toml b/base/comps/kf6-breeze-icons/kf6-breeze-icons.comp.toml
index c8102ec5491..b152ea062db 100644
--- a/base/comps/kf6-breeze-icons/kf6-breeze-icons.comp.toml
+++ b/base/comps/kf6-breeze-icons/kf6-breeze-icons.comp.toml
@@ -1,18 +1 @@
 [components.kf6-breeze-icons]
-
-# Drop the breeze-icon-theme-fedora subpackage — it requires fedora-release-common,
-# which does not exist in Azure Linux. The upstream spec gates this subpackage behind
-# %if 0%{?fedora}, but %fedora is set on our builders, so we must force the guard off.
-# The base breeze-icon-theme package is unaffected.
-# Upstream package context: https://src.fedoraproject.org/rpms/kf6-breeze-icons
-# Ref: microsoft/azurelinux#18865
-#
-# spec-remove-section cannot be used here because each fedora-specific block is
-# wrapped in %if 0%{?fedora} / %endif — removing the section eats the %endif,
-# leaving an unclosed %if. Intentionally unscoped — the same guard appears in 4
-# locations (%package, %install, %files x2) and all must be disabled.
-[[components.kf6-breeze-icons.overlays]]
-description = "Disable Fedora-specific icon subpackage (breeze-icon-theme-fedora) — requires fedora-release-common which AZL does not ship"
-type = "spec-search-replace"
-regex = '^%if\s+0%\{\?fedora\}\s*$'
-replacement = '%if 0'
diff --git a/base/comps/kf6-breeze-icons/overlays/0001-disable-fedora-specific-icon.overlay.toml b/base/comps/kf6-breeze-icons/overlays/0001-disable-fedora-specific-icon.overlay.toml
new file mode 100644
index 00000000000..9e7a3bcb516
--- /dev/null
+++ b/base/comps/kf6-breeze-icons/overlays/0001-disable-fedora-specific-icon.overlay.toml
@@ -0,0 +1,21 @@
+# Drop the breeze-icon-theme-fedora subpackage — it requires fedora-release-common,
+# which does not exist in Azure Linux. The upstream spec gates this subpackage behind
+# %if 0%{?fedora}, but %fedora is set on our builders, so we must force the guard off.
+# The base breeze-icon-theme package is unaffected.
+# Upstream package context: https://src.fedoraproject.org/rpms/kf6-breeze-icons
+# Ref: microsoft/azurelinux#18865
+#
+# spec-remove-section cannot be used here because each fedora-specific block is
+# wrapped in %if 0%{?fedora} / %endif — removing the section eats the %endif,
+# leaving an unclosed %if. Intentionally unscoped — the same guard appears in 4
+# locations (%package, %install, %files x2) and all must be disabled.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable Fedora-specific icon subpackage (breeze-icon-theme-fedora) — requires fedora-release-common which AZL does not ship"
+type = "spec-search-replace"
+regex = "^%if\\s+0%\\{\\?fedora\\}\\s*$"
+replacement = "%if 0"
diff --git a/base/comps/kf6-kfilemetadata/kf6-kfilemetadata.comp.toml b/base/comps/kf6-kfilemetadata/kf6-kfilemetadata.comp.toml
index aa2232e91a9..4786041c2c4 100644
--- a/base/comps/kf6-kfilemetadata/kf6-kfilemetadata.comp.toml
+++ b/base/comps/kf6-kfilemetadata/kf6-kfilemetadata.comp.toml
@@ -6,8 +6,3 @@
 # extractors) is unaffected.
 [components.kf6-kfilemetadata]
 
-[[components.kf6-kfilemetadata.overlays]]
-description = "Drop BuildRequires on ffmpeg-free-devel — removing ffmpeg from the distro"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "ffmpeg-free-devel"
diff --git a/base/comps/kf6-kfilemetadata/overlays/0001-drop-buildrequires-ffmpeg-free.overlay.toml b/base/comps/kf6-kfilemetadata/overlays/0001-drop-buildrequires-ffmpeg-free.overlay.toml
new file mode 100644
index 00000000000..e09b33f86db
--- /dev/null
+++ b/base/comps/kf6-kfilemetadata/overlays/0001-drop-buildrequires-ffmpeg-free.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop BuildRequires on ffmpeg-free-devel — removing ffmpeg from the distro"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "ffmpeg-free-devel"
diff --git a/base/comps/kf6-kimageformats/kf6-kimageformats.comp.toml b/base/comps/kf6-kimageformats/kf6-kimageformats.comp.toml
index cd29a005b78..e2ddda4a5bf 100644
--- a/base/comps/kf6-kimageformats/kf6-kimageformats.comp.toml
+++ b/base/comps/kf6-kimageformats/kf6-kimageformats.comp.toml
@@ -1,30 +1 @@
 [components.kf6-kimageformats]
-
-# Disable HEIF support — libheif is being retired from Azure Linux 4.0.
-# Upstream spec passes `-DKIMAGEFORMATS_HEIF:BOOL=ON` and BuildRequires
-# `pkgconfig(libheif)`. Drop the BR and flip the cmake flag to OFF so the
-# kimg_heif.so plugin is not built; the %files glob over the imageformats
-# plugin directory absorbs the absent plugin without an "unpackaged file"
-# error.
-
-[[components.kf6-kimageformats.overlays]]
-description = "Drop libheif build dependency ahead of libheif removal from Azure Linux 4.0"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(libheif) >= 1.10.0"
-
-[[components.kf6-kimageformats.overlays]]
-description = "Disable libheif-backed cmake option (KIMAGEFORMATS_HEIF) so kimg_heif.so is not built"
-type = "spec-search-replace"
-section = "%build"
-regex = '-DKIMAGEFORMATS_HEIF:BOOL=ON'
-replacement = '-DKIMAGEFORMATS_HEIF:BOOL=OFF'
-
-# AZL does not ship libavif — remove the cmake(libavif) BR so the avif
-# plugin is not discovered or built.
-
-[[components.kf6-kimageformats.overlays]]
-description = "Remove libavif BuildRequires (libavif not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "cmake(libavif)"
diff --git a/base/comps/kf6-kimageformats/overlays/0001-drop-libheif-build-dependency.overlay.toml b/base/comps/kf6-kimageformats/overlays/0001-drop-libheif-build-dependency.overlay.toml
new file mode 100644
index 00000000000..fc93d86932d
--- /dev/null
+++ b/base/comps/kf6-kimageformats/overlays/0001-drop-libheif-build-dependency.overlay.toml
@@ -0,0 +1,22 @@
+# Disable HEIF support — libheif is being retired from Azure Linux 4.0.
+# Upstream spec passes `-DKIMAGEFORMATS_HEIF:BOOL=ON` and BuildRequires
+# `pkgconfig(libheif)`. Drop the BR and flip the cmake flag to OFF so the
+# kimg_heif.so plugin is not built; the %files glob over the imageformats
+# plugin directory absorbs the absent plugin without an "unpackaged file"
+# error.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Drop libheif build dependency ahead of libheif removal from Azure Linux 4.0"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(libheif) >= 1.10.0"
+
+[[overlays]]
+description = "Disable libheif-backed cmake option (KIMAGEFORMATS_HEIF) so kimg_heif.so is not built"
+type = "spec-search-replace"
+section = "%build"
+regex = "-DKIMAGEFORMATS_HEIF:BOOL=ON"
+replacement = "-DKIMAGEFORMATS_HEIF:BOOL=OFF"
diff --git a/base/comps/kf6-kimageformats/overlays/0002-remove-libavif-buildrequires-libavif.overlay.toml b/base/comps/kf6-kimageformats/overlays/0002-remove-libavif-buildrequires-libavif.overlay.toml
new file mode 100644
index 00000000000..a97853495b0
--- /dev/null
+++ b/base/comps/kf6-kimageformats/overlays/0002-remove-libavif-buildrequires-libavif.overlay.toml
@@ -0,0 +1,11 @@
+# AZL does not ship libavif — remove the cmake(libavif) BR so the avif
+# plugin is not discovered or built.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove libavif BuildRequires (libavif not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "cmake(libavif)"
diff --git a/base/comps/kiwi/kiwi.comp.toml b/base/comps/kiwi/kiwi.comp.toml
index 5b5b73cf0f2..78509843d24 100644
--- a/base/comps/kiwi/kiwi.comp.toml
+++ b/base/comps/kiwi/kiwi.comp.toml
@@ -1,8 +1,2 @@
 [components.kiwi]
 
-[[components.kiwi.overlays]]
-description = "Remove dependency on older version of dnf not carried in Azure Linux"
-type = "spec-remove-tag"
-tag = "Requires"
-value = "dnf4"
-package = "systemdeps-core"
diff --git a/base/comps/kiwi/overlays/0001-remove-dependency-older-version.overlay.toml b/base/comps/kiwi/overlays/0001-remove-dependency-older-version.overlay.toml
new file mode 100644
index 00000000000..8452043fe7b
--- /dev/null
+++ b/base/comps/kiwi/overlays/0001-remove-dependency-older-version.overlay.toml
@@ -0,0 +1,10 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove dependency on older version of dnf not carried in Azure Linux"
+type = "spec-remove-tag"
+tag = "Requires"
+value = "dnf4"
+package = "systemdeps-core"
diff --git a/base/comps/libfabric/libfabric.comp.toml b/base/comps/libfabric/libfabric.comp.toml
index 761884d7db7..431c6b2b49c 100644
--- a/base/comps/libfabric/libfabric.comp.toml
+++ b/base/comps/libfabric/libfabric.comp.toml
@@ -4,8 +4,3 @@
 # infinipath-psm since it's for obsolete hardware. Remove the BuildRequires.
 [components.libfabric]
 
-[[components.libfabric.overlays]]
-description = "Remove infinipath-psm-devel BuildRequires — legacy hardware, not packaged in Azure Linux"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "infinipath-psm-devel"
diff --git a/base/comps/libfabric/overlays/0001-remove-infinipath-psm-devel.overlay.toml b/base/comps/libfabric/overlays/0001-remove-infinipath-psm-devel.overlay.toml
new file mode 100644
index 00000000000..2e6b4ee255d
--- /dev/null
+++ b/base/comps/libfabric/overlays/0001-remove-infinipath-psm-devel.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove infinipath-psm-devel BuildRequires — legacy hardware, not packaged in Azure Linux"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "infinipath-psm-devel"
diff --git a/base/comps/libgsf/libgsf.comp.toml b/base/comps/libgsf/libgsf.comp.toml
index b1df5902483..42bfcb44575 100644
--- a/base/comps/libgsf/libgsf.comp.toml
+++ b/base/comps/libgsf/libgsf.comp.toml
@@ -1,12 +1 @@
 [components.libgsf]
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# The upstream spec hard-codes `%global with_mingw 1` whenever %fedora is
-# defined (true in our build environment) rather than gating on a %bcond, so
-# the standard `build.without = ["mingw"]` mechanism has no effect. Force it
-# off via spec overlay.
-[[components.libgsf.overlays]]
-description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
-type = "spec-search-replace"
-regex = '%global with_mingw 1'
-replacement = '%global with_mingw 0'
diff --git a/base/comps/libgsf/overlays/0001-disable-mingw-sub-packages.overlay.toml b/base/comps/libgsf/overlays/0001-disable-mingw-sub-packages.overlay.toml
new file mode 100644
index 00000000000..9ea750a6735
--- /dev/null
+++ b/base/comps/libgsf/overlays/0001-disable-mingw-sub-packages.overlay.toml
@@ -0,0 +1,15 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# The upstream spec hard-codes `%global with_mingw 1` whenever %fedora is
+# defined (true in our build environment) rather than gating on a %bcond, so
+# the standard `build.without = ["mingw"]` mechanism has no effect. Force it
+# off via spec overlay.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
+type = "spec-search-replace"
+regex = "%global with_mingw 1"
+replacement = "%global with_mingw 0"
diff --git a/base/comps/libplacebo/libplacebo.comp.toml b/base/comps/libplacebo/libplacebo.comp.toml
index d361bc6bfc8..dccf4b47f04 100644
--- a/base/comps/libplacebo/libplacebo.comp.toml
+++ b/base/comps/libplacebo/libplacebo.comp.toml
@@ -1,21 +1 @@
 [components.libplacebo]
-
-# Disable Dolby Vision support so libplacebo no longer pulls in libdovi
-# (from the rust-dolby_vision SRPM, which has been removed from Azure
-# Linux 4.0). The `-Dlibdovi=disabled` Meson option is upstream-supported
-# and only affects parsing of Dolby Vision RPU metadata at runtime —
-# standard HDR10 / HDR10+ paths are unaffected.
-
-[[components.libplacebo.overlays]]
-description = "Drop libdovi-devel BuildRequires; rust-dolby_vision (which provides libdovi) is being removed from Azure Linux 4.0"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "libdovi-devel"
-
-[[components.libplacebo.overlays]]
-description = "Force -Dlibdovi=disabled in the Meson invocation so libplacebo builds without Dolby Vision support after libdovi is dropped. Anchor on %meson itself (rather than a sibling -Doption) so the overlay survives upstream churn in the option list."
-type = "spec-search-replace"
-section = "%build"
-regex = '^%meson \\$'
-replacement = '''%meson \
- -Dlibdovi=disabled \'''
diff --git a/base/comps/libplacebo/overlays/0001-drop-libdovi-devel-buildrequires.overlay.toml b/base/comps/libplacebo/overlays/0001-drop-libdovi-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..a441a962761
--- /dev/null
+++ b/base/comps/libplacebo/overlays/0001-drop-libdovi-devel-buildrequires.overlay.toml
@@ -0,0 +1,22 @@
+# Disable Dolby Vision support so libplacebo no longer pulls in libdovi
+# (from the rust-dolby_vision SRPM, which has been removed from Azure
+# Linux 4.0). The `-Dlibdovi=disabled` Meson option is upstream-supported
+# and only affects parsing of Dolby Vision RPU metadata at runtime —
+# standard HDR10 / HDR10+ paths are unaffected.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop libdovi-devel BuildRequires; rust-dolby_vision (which provides libdovi) is being removed from Azure Linux 4.0"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "libdovi-devel"
+
+[[overlays]]
+description = "Force -Dlibdovi=disabled in the Meson invocation so libplacebo builds without Dolby Vision support after libdovi is dropped. Anchor on %meson itself (rather than a sibling -Doption) so the overlay survives upstream churn in the option list."
+type = "spec-search-replace"
+section = "%build"
+regex = "^%meson \\\\$"
+replacement = "%meson \\\n -Dlibdovi=disabled \\"
diff --git a/base/comps/libquicktime/libquicktime.comp.toml b/base/comps/libquicktime/libquicktime.comp.toml
index ac1040d7f86..70662745ed7 100644
--- a/base/comps/libquicktime/libquicktime.comp.toml
+++ b/base/comps/libquicktime/libquicktime.comp.toml
@@ -3,15 +3,3 @@
 # build system auto-detects that faad2 is absent and skips the AAC plugin.
 [components.libquicktime]
 
-[[components.libquicktime.overlays]]
-description = "Remove faad2-devel BuildRequires (AAC requires CELA review)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "faad2-devel"
-
-[[components.libquicktime.overlays]]
-description = "Remove lqt_faad2.so from %files (no longer built without faad2)"
-type = "spec-search-replace"
-section = "%files"
-regex = '%\{_libdir\}/%\{name\}/lqt_faad2\.so'
-replacement = ''
diff --git a/base/comps/libquicktime/overlays/0001-remove-faad2-devel-buildrequires.overlay.toml b/base/comps/libquicktime/overlays/0001-remove-faad2-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..19055ad56d1
--- /dev/null
+++ b/base/comps/libquicktime/overlays/0001-remove-faad2-devel-buildrequires.overlay.toml
@@ -0,0 +1,16 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove faad2-devel BuildRequires (AAC requires CELA review)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "faad2-devel"
+
+[[overlays]]
+description = "Remove lqt_faad2.so from %files (no longer built without faad2)"
+type = "spec-search-replace"
+section = "%files"
+regex = "%\\{_libdir\\}/%\\{name\\}/lqt_faad2\\.so"
+replacement = ""
diff --git a/base/comps/librsvg2/librsvg2.comp.toml b/base/comps/librsvg2/librsvg2.comp.toml
index b393367f34a..449dcb3d38a 100644
--- a/base/comps/librsvg2/librsvg2.comp.toml
+++ b/base/comps/librsvg2/librsvg2.comp.toml
@@ -1,8 +1,2 @@
 [components.librsvg2]
 
-[[components.librsvg2.overlays]]
-description = "Disable AVIF support to remove dav1d dependency"
-type = "spec-search-replace"
-section = "%build"
-regex = '%meson %\{\?rhel:-Davif=disabled\} -Dpixbuf-loader=disabled'
-replacement = '%meson -Davif=disabled -Dpixbuf-loader=disabled'
diff --git a/base/comps/librsvg2/overlays/0001-disable-avif-support-remove.overlay.toml b/base/comps/librsvg2/overlays/0001-disable-avif-support-remove.overlay.toml
new file mode 100644
index 00000000000..b3ecab8517f
--- /dev/null
+++ b/base/comps/librsvg2/overlays/0001-disable-avif-support-remove.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Disable AVIF support to remove dav1d dependency"
+type = "spec-search-replace"
+section = "%build"
+regex = "%meson %\\{\\?rhel:-Davif=disabled\\} -Dpixbuf-loader=disabled"
+replacement = "%meson -Davif=disabled -Dpixbuf-loader=disabled"
diff --git a/base/comps/libsndfile/libsndfile.comp.toml b/base/comps/libsndfile/libsndfile.comp.toml
index 9a6de91f299..dd4ee1ae65f 100644
--- a/base/comps/libsndfile/libsndfile.comp.toml
+++ b/base/comps/libsndfile/libsndfile.comp.toml
@@ -1,39 +1 @@
 [components.libsndfile]
-
-# AZL does not ship opus — remove the BR and explicitly disable external Xiph
-# libs (FLAC, Ogg, Vorbis, Opus).  Upstream configure.ac requires ALL four Xiph
-# codecs present or none; removing opus-devel alone would silently disable the
-# other three as well.  We make this explicit with --disable-external-libs and
-# drop the now-dead flac/ogg/vorbis BRs to keep the dep graph honest.
-
-[[components.libsndfile.overlays]]
-description = "Remove opus-devel BuildRequires (opus not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "opus-devel"
-
-[[components.libsndfile.overlays]]
-description = "Drop dead flac-devel BR (libsndfile builds without external Xiph)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "flac-devel"
-
-[[components.libsndfile.overlays]]
-description = "Drop dead libogg-devel BR"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "libogg-devel"
-
-[[components.libsndfile.overlays]]
-description = "Drop dead libvorbis-devel BR"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "libvorbis-devel"
-
-[[components.libsndfile.overlays]]
-description = "Explicitly disable external Xiph libs rather than relying on missing BRs"
-type = "spec-search-replace"
-section = "%build"
-regex = '--enable-mpeg \\'
-replacement = """--enable-mpeg \\
-\t--disable-external-libs \\"""
diff --git a/base/comps/libsndfile/overlays/0001-remove-opus-devel-buildrequires.overlay.toml b/base/comps/libsndfile/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..02960e261fe
--- /dev/null
+++ b/base/comps/libsndfile/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
@@ -0,0 +1,39 @@
+# AZL does not ship opus — remove the BR and explicitly disable external Xiph
+# libs (FLAC, Ogg, Vorbis, Opus).  Upstream configure.ac requires ALL four Xiph
+# codecs present or none; removing opus-devel alone would silently disable the
+# other three as well.  We make this explicit with --disable-external-libs and
+# drop the now-dead flac/ogg/vorbis BRs to keep the dep graph honest.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove opus-devel BuildRequires (opus not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "opus-devel"
+
+[[overlays]]
+description = "Drop dead flac-devel BR (libsndfile builds without external Xiph)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "flac-devel"
+
+[[overlays]]
+description = "Drop dead libogg-devel BR"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "libogg-devel"
+
+[[overlays]]
+description = "Drop dead libvorbis-devel BR"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "libvorbis-devel"
+
+[[overlays]]
+description = "Explicitly disable external Xiph libs rather than relying on missing BRs"
+type = "spec-search-replace"
+section = "%build"
+regex = "--enable-mpeg \\\\"
+replacement = "--enable-mpeg \\\n\t--disable-external-libs \\"
diff --git a/base/comps/libsoup3/libsoup3.comp.toml b/base/comps/libsoup3/libsoup3.comp.toml
index 5930a6cf569..ac340519b1b 100644
--- a/base/comps/libsoup3/libsoup3.comp.toml
+++ b/base/comps/libsoup3/libsoup3.comp.toml
@@ -1,10 +1 @@
 [components.libsoup3]
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# The upstream spec conditionally enables mingw when %fedora is defined,
-# which is true in our build environment. Force it off.
-[[components.libsoup3.overlays]]
-description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
-type = "spec-search-replace"
-regex = '%global with_mingw 1'
-replacement = '%global with_mingw 0'
diff --git a/base/comps/libsoup3/overlays/0001-disable-mingw-sub-packages.overlay.toml b/base/comps/libsoup3/overlays/0001-disable-mingw-sub-packages.overlay.toml
new file mode 100644
index 00000000000..4b048ffb27e
--- /dev/null
+++ b/base/comps/libsoup3/overlays/0001-disable-mingw-sub-packages.overlay.toml
@@ -0,0 +1,13 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# The upstream spec conditionally enables mingw when %fedora is defined,
+# which is true in our build environment. Force it off.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
+type = "spec-search-replace"
+regex = "%global with_mingw 1"
+replacement = "%global with_mingw 0"
diff --git a/base/comps/libvncserver/libvncserver.comp.toml b/base/comps/libvncserver/libvncserver.comp.toml
index 878609477f0..1a13ce73c3e 100644
--- a/base/comps/libvncserver/libvncserver.comp.toml
+++ b/base/comps/libvncserver/libvncserver.comp.toml
@@ -7,26 +7,3 @@
 # Part of the distro-wide effort to remove ffmpeg/libav*.
 [components.libvncserver]
 
-[[components.libvncserver.overlays]]
-description = "Drop BuildRequires on libavformat — removing ffmpeg/libav* (used only by uninstalled example binaries)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(libavformat)"
-
-[[components.libvncserver.overlays]]
-description = "Drop BuildRequires on libavcodec — removing ffmpeg/libav* (used only by uninstalled example binaries)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(libavcodec)"
-
-[[components.libvncserver.overlays]]
-description = "Drop BuildRequires on libavutil — removing ffmpeg/libav* (used only by uninstalled example binaries)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(libavutil)"
-
-[[components.libvncserver.overlays]]
-description = "Drop BuildRequires on libswscale — removing ffmpeg/libav* (used only by uninstalled example binaries)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(libswscale)"
diff --git a/base/comps/libvncserver/overlays/0001-drop-buildrequires-libavformat-removing.overlay.toml b/base/comps/libvncserver/overlays/0001-drop-buildrequires-libavformat-removing.overlay.toml
new file mode 100644
index 00000000000..ae69d23acdb
--- /dev/null
+++ b/base/comps/libvncserver/overlays/0001-drop-buildrequires-libavformat-removing.overlay.toml
@@ -0,0 +1,26 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Drop BuildRequires on libavformat — removing ffmpeg/libav* (used only by uninstalled example binaries)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(libavformat)"
+
+[[overlays]]
+description = "Drop BuildRequires on libavcodec — removing ffmpeg/libav* (used only by uninstalled example binaries)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(libavcodec)"
+
+[[overlays]]
+description = "Drop BuildRequires on libavutil — removing ffmpeg/libav* (used only by uninstalled example binaries)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(libavutil)"
+
+[[overlays]]
+description = "Drop BuildRequires on libswscale — removing ffmpeg/libav* (used only by uninstalled example binaries)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(libswscale)"
diff --git a/base/comps/libyaml/libyaml.comp.toml b/base/comps/libyaml/libyaml.comp.toml
index d25b9cbb04d..6ad10c454cb 100644
--- a/base/comps/libyaml/libyaml.comp.toml
+++ b/base/comps/libyaml/libyaml.comp.toml
@@ -1,12 +1 @@
 [components.libyaml]
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# The upstream spec hard-codes `%global with_mingw 1` whenever %fedora is
-# defined (true in our build environment) rather than gating on a %bcond, so
-# the standard `build.without = ["mingw"]` mechanism has no effect. Force it
-# off via spec overlay.
-[[components.libyaml.overlays]]
-description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
-type = "spec-search-replace"
-regex = '%global with_mingw 1'
-replacement = '%global with_mingw 0'
diff --git a/base/comps/libyaml/overlays/0001-disable-mingw-sub-packages.overlay.toml b/base/comps/libyaml/overlays/0001-disable-mingw-sub-packages.overlay.toml
new file mode 100644
index 00000000000..9ea750a6735
--- /dev/null
+++ b/base/comps/libyaml/overlays/0001-disable-mingw-sub-packages.overlay.toml
@@ -0,0 +1,15 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# The upstream spec hard-codes `%global with_mingw 1` whenever %fedora is
+# defined (true in our build environment) rather than gating on a %bcond, so
+# the standard `build.without = ["mingw"]` mechanism has no effect. Force it
+# off via spec overlay.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable mingw sub-packages — Azure Linux does not ship mingw toolchains"
+type = "spec-search-replace"
+regex = "%global with_mingw 1"
+replacement = "%global with_mingw 0"
diff --git a/base/comps/libzypp/libzypp.comp.toml b/base/comps/libzypp/libzypp.comp.toml
index c4655eba3d3..51e55f0a1e9 100644
--- a/base/comps/libzypp/libzypp.comp.toml
+++ b/base/comps/libzypp/libzypp.comp.toml
@@ -4,8 +4,3 @@
 # removing ffmpeg/libav* (and notcurses itself) from the distro.
 [components.libzypp]
 
-[[components.libzypp.overlays]]
-description = "Drop BuildRequires on cmake(Notcurses++) — only used by default-OFF DEVTOOL_REPOMIRROR; notcurses being removed"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "cmake(Notcurses++)"
diff --git a/base/comps/libzypp/overlays/0001-drop-buildrequires-cmake-notcurses.overlay.toml b/base/comps/libzypp/overlays/0001-drop-buildrequires-cmake-notcurses.overlay.toml
new file mode 100644
index 00000000000..f70bcdf145b
--- /dev/null
+++ b/base/comps/libzypp/overlays/0001-drop-buildrequires-cmake-notcurses.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop BuildRequires on cmake(Notcurses++) — only used by default-OFF DEVTOOL_REPOMIRROR; notcurses being removed"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "cmake(Notcurses++)"
diff --git a/base/comps/mesa/mesa.comp.toml b/base/comps/mesa/mesa.comp.toml
index 141b7a4e16f..5d0ef011ff4 100644
--- a/base/comps/mesa/mesa.comp.toml
+++ b/base/comps/mesa/mesa.comp.toml
@@ -7,17 +7,3 @@
 # Re-enable with_va (disabled by RHEL profile) for rocdecode/rocjpeg.
 [components.mesa.build]
 defines = { rhel = "10", with_va = "1" }
-
-# RHEL uses rust-toolset (a meta-package) instead of cargo-rpm-macros for Rust
-# builds. AZL doesn't have rust-toolset — use cargo-rpm-macros like Fedora.
-[[components.mesa.overlays]]
-description = "Remove unavailable rust-toolset build dependency"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "rust-toolset"
-
-[[components.mesa.overlays]]
-description = "Add cargo-rpm-macros — Fedora-style Rust build macros used by Azure Linux"
-type = "spec-add-tag"
-tag = "BuildRequires"
-value = "cargo-rpm-macros"
diff --git a/base/comps/mesa/overlays/0001-remove-unavailable-rust-toolset.overlay.toml b/base/comps/mesa/overlays/0001-remove-unavailable-rust-toolset.overlay.toml
new file mode 100644
index 00000000000..ab0589ab1e4
--- /dev/null
+++ b/base/comps/mesa/overlays/0001-remove-unavailable-rust-toolset.overlay.toml
@@ -0,0 +1,12 @@
+# RHEL uses rust-toolset (a meta-package) instead of cargo-rpm-macros for Rust
+# builds. AZL doesn't have rust-toolset — use cargo-rpm-macros like Fedora.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove unavailable rust-toolset build dependency"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "rust-toolset"
diff --git a/base/comps/mesa/overlays/0002-add-cargo-rpm-macros.overlay.toml b/base/comps/mesa/overlays/0002-add-cargo-rpm-macros.overlay.toml
new file mode 100644
index 00000000000..0be42f28ee2
--- /dev/null
+++ b/base/comps/mesa/overlays/0002-add-cargo-rpm-macros.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-compatibility"
+upstreamable = false
+
+[[overlays]]
+description = "Add cargo-rpm-macros — Fedora-style Rust build macros used by Azure Linux"
+type = "spec-add-tag"
+tag = "BuildRequires"
+value = "cargo-rpm-macros"
diff --git a/base/comps/mivisionx/mivisionx.comp.toml b/base/comps/mivisionx/mivisionx.comp.toml
index f50bffa3ca5..5d9285236b9 100644
--- a/base/comps/mivisionx/mivisionx.comp.toml
+++ b/base/comps/mivisionx/mivisionx.comp.toml
@@ -9,14 +9,3 @@
 # Part of the distro-wide effort to remove ffmpeg/libav*.
 [components.mivisionx]
 
-[[components.mivisionx.overlays]]
-description = "Drop BuildRequires on libavcodec-free-devel — removing ffmpeg/libav* (amd_media extension auto-disables)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "libavcodec-free-devel"
-
-[[components.mivisionx.overlays]]
-description = "Drop BuildRequires on libavformat-free-devel — removing ffmpeg/libav* (amd_media extension auto-disables)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "libavformat-free-devel"
diff --git a/base/comps/mivisionx/overlays/0001-drop-buildrequires-libavcodec-free.overlay.toml b/base/comps/mivisionx/overlays/0001-drop-buildrequires-libavcodec-free.overlay.toml
new file mode 100644
index 00000000000..d6b1924d8ab
--- /dev/null
+++ b/base/comps/mivisionx/overlays/0001-drop-buildrequires-libavcodec-free.overlay.toml
@@ -0,0 +1,15 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop BuildRequires on libavcodec-free-devel — removing ffmpeg/libav* (amd_media extension auto-disables)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "libavcodec-free-devel"
+
+[[overlays]]
+description = "Drop BuildRequires on libavformat-free-devel — removing ffmpeg/libav* (amd_media extension auto-disables)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "libavformat-free-devel"
diff --git a/base/comps/nghttp2/nghttp2.comp.toml b/base/comps/nghttp2/nghttp2.comp.toml
index 8af3508e5bd..15d5725289b 100644
--- a/base/comps/nghttp2/nghttp2.comp.toml
+++ b/base/comps/nghttp2/nghttp2.comp.toml
@@ -1,10 +1 @@
 [components.nghttp2]
-
-# nghttp2's mingw support is enabled in Fedora-derived builds of the upstream spec.
-# mingw support is out of scope for Azure Linux, and enabling it presently brings in
-# dependencies on Python 3.11, which we do not support.
-[[components.nghttp2.overlays]]
-description = "Disable mingw support"
-type = "spec-search-replace"
-regex = '^%global with_mingw 1$'
-replacement = '%global with_mingw 0'
diff --git a/base/comps/nghttp2/overlays/0001-disable-mingw-support.overlay.toml b/base/comps/nghttp2/overlays/0001-disable-mingw-support.overlay.toml
new file mode 100644
index 00000000000..481902080af
--- /dev/null
+++ b/base/comps/nghttp2/overlays/0001-disable-mingw-support.overlay.toml
@@ -0,0 +1,13 @@
+# nghttp2's mingw support is enabled in Fedora-derived builds of the upstream spec.
+# mingw support is out of scope for Azure Linux, and enabling it presently brings in
+# dependencies on Python 3.11, which we do not support.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable mingw support"
+type = "spec-search-replace"
+regex = "^%global with_mingw 1$"
+replacement = "%global with_mingw 0"
diff --git a/base/comps/nuspell/nuspell.comp.toml b/base/comps/nuspell/nuspell.comp.toml
index 522f722c367..f99d8fb59f4 100644
--- a/base/comps/nuspell/nuspell.comp.toml
+++ b/base/comps/nuspell/nuspell.comp.toml
@@ -1,118 +1 @@
 [components.nuspell]
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# Remove all mingw subpackages and their build dependencies.
-
-[[components.nuspell.overlays]]
-description = "Remove mingw32-nuspell subpackage — Azure Linux does not ship mingw toolchains"
-type = "spec-remove-subpackage"
-package = "mingw32-%{name}"
-
-[[components.nuspell.overlays]]
-description = "Remove mingw64-nuspell subpackage"
-type = "spec-remove-subpackage"
-package = "mingw64-%{name}"
-
-[[components.nuspell.overlays]]
-description = "Remove mingw32-filesystem BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-filesystem"
-
-[[components.nuspell.overlays]]
-description = "Remove mingw32-dlfcn BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-dlfcn"
-
-[[components.nuspell.overlays]]
-description = "Remove mingw32-gcc-c++ BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-gcc-c++"
-
-[[components.nuspell.overlays]]
-description = "Remove mingw32-icu BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-icu"
-
-[[components.nuspell.overlays]]
-description = "Remove mingw64-filesystem BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-filesystem"
-
-[[components.nuspell.overlays]]
-description = "Remove mingw64-dlfcn BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-dlfcn"
-
-[[components.nuspell.overlays]]
-description = "Remove mingw64-gcc-c++ BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-gcc-c++"
-
-[[components.nuspell.overlays]]
-description = "Remove mingw64-icu BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-icu"
-
-[[components.nuspell.overlays]]
-description = "Remove mingw cmake build step"
-type = "spec-search-replace"
-section = "%build"
-regex = '^\%mingw_cmake -DBUILD_TESTING=OFF$'
-replacement = ''
-
-[[components.nuspell.overlays]]
-description = "Remove mingw make build step"
-type = "spec-search-replace"
-section = "%build"
-regex = '^\%mingw_make_build$'
-replacement = ''
-
-[[components.nuspell.overlays]]
-description = "Remove mingw install step"
-type = "spec-search-replace"
-section = "%install"
-regex = '^\%mingw_make_install$'
-replacement = ''
-
-[[components.nuspell.overlays]]
-description = "Remove mingw docdir cleanup (mingw32)"
-type = "spec-search-replace"
-section = "%install"
-regex = '^rm -rf %\{buildroot\}%\{mingw32_docdir\}/%\{name\}$'
-replacement = ''
-
-[[components.nuspell.overlays]]
-description = "Remove mingw docdir cleanup (mingw64)"
-type = "spec-search-replace"
-section = "%install"
-regex = '^rm -rf %\{buildroot\}%\{mingw64_docdir\}/%\{name\}$'
-replacement = ''
-
-[[components.nuspell.overlays]]
-description = "Remove mingw mandir cleanup (mingw32)"
-type = "spec-search-replace"
-section = "%install"
-regex = '^rm -rf %\{buildroot\}%\{mingw32_mandir\}$'
-replacement = ''
-
-[[components.nuspell.overlays]]
-description = "Remove mingw mandir cleanup (mingw64)"
-type = "spec-search-replace"
-section = "%install"
-regex = '^rm -rf %\{buildroot\}%\{mingw64_mandir\}$'
-replacement = ''
-
-[[components.nuspell.overlays]]
-description = "Remove mingw debug install post step"
-type = "spec-search-replace"
-section = "%install"
-regex = '^\%mingw_debug_install_post$'
-replacement = ''
diff --git a/base/comps/nuspell/overlays/0001-remove-mingw32-nuspell-subpackage.overlay.toml b/base/comps/nuspell/overlays/0001-remove-mingw32-nuspell-subpackage.overlay.toml
new file mode 100644
index 00000000000..ff44a038aa8
--- /dev/null
+++ b/base/comps/nuspell/overlays/0001-remove-mingw32-nuspell-subpackage.overlay.toml
@@ -0,0 +1,120 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# Remove all mingw subpackages and their build dependencies.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove mingw32-nuspell subpackage — Azure Linux does not ship mingw toolchains"
+type = "spec-remove-subpackage"
+package = "mingw32-%{name}"
+
+[[overlays]]
+description = "Remove mingw64-nuspell subpackage"
+type = "spec-remove-subpackage"
+package = "mingw64-%{name}"
+
+[[overlays]]
+description = "Remove mingw32-filesystem BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-filesystem"
+
+[[overlays]]
+description = "Remove mingw32-dlfcn BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-dlfcn"
+
+[[overlays]]
+description = "Remove mingw32-gcc-c++ BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-gcc-c++"
+
+[[overlays]]
+description = "Remove mingw32-icu BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-icu"
+
+[[overlays]]
+description = "Remove mingw64-filesystem BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-filesystem"
+
+[[overlays]]
+description = "Remove mingw64-dlfcn BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-dlfcn"
+
+[[overlays]]
+description = "Remove mingw64-gcc-c++ BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-gcc-c++"
+
+[[overlays]]
+description = "Remove mingw64-icu BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-icu"
+
+[[overlays]]
+description = "Remove mingw cmake build step"
+type = "spec-search-replace"
+section = "%build"
+regex = "^\\%mingw_cmake -DBUILD_TESTING=OFF$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw make build step"
+type = "spec-search-replace"
+section = "%build"
+regex = "^\\%mingw_make_build$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw install step"
+type = "spec-search-replace"
+section = "%install"
+regex = "^\\%mingw_make_install$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw docdir cleanup (mingw32)"
+type = "spec-search-replace"
+section = "%install"
+regex = "^rm -rf %\\{buildroot\\}%\\{mingw32_docdir\\}/%\\{name\\}$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw docdir cleanup (mingw64)"
+type = "spec-search-replace"
+section = "%install"
+regex = "^rm -rf %\\{buildroot\\}%\\{mingw64_docdir\\}/%\\{name\\}$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw mandir cleanup (mingw32)"
+type = "spec-search-replace"
+section = "%install"
+regex = "^rm -rf %\\{buildroot\\}%\\{mingw32_mandir\\}$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw mandir cleanup (mingw64)"
+type = "spec-search-replace"
+section = "%install"
+regex = "^rm -rf %\\{buildroot\\}%\\{mingw64_mandir\\}$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw debug install post step"
+type = "spec-search-replace"
+section = "%install"
+regex = "^\\%mingw_debug_install_post$"
+replacement = ""
diff --git a/base/comps/openal-soft/openal-soft.comp.toml b/base/comps/openal-soft/openal-soft.comp.toml
index 1b6ab1d29eb..f178f5edd0d 100644
--- a/base/comps/openal-soft/openal-soft.comp.toml
+++ b/base/comps/openal-soft/openal-soft.comp.toml
@@ -7,8 +7,3 @@
 # Part of the distro-wide effort to remove ffmpeg/libav*.
 [components.openal-soft]
 
-[[components.openal-soft.overlays]]
-description = "Drop BuildRequires on pkgconfig(libavcodec) — only used by uninstalled alffplay example"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(libavcodec)"
diff --git a/base/comps/openal-soft/overlays/0001-drop-buildrequires-pkgconfig-libavcodec.overlay.toml b/base/comps/openal-soft/overlays/0001-drop-buildrequires-pkgconfig-libavcodec.overlay.toml
new file mode 100644
index 00000000000..c8988f301e5
--- /dev/null
+++ b/base/comps/openal-soft/overlays/0001-drop-buildrequires-pkgconfig-libavcodec.overlay.toml
@@ -0,0 +1,8 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Drop BuildRequires on pkgconfig(libavcodec) — only used by uninstalled alffplay example"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(libavcodec)"
diff --git a/base/comps/opencv/opencv.comp.toml b/base/comps/opencv/opencv.comp.toml
index 5e88de05fa4..869d2e76313 100644
--- a/base/comps/opencv/opencv.comp.toml
+++ b/base/comps/opencv/opencv.comp.toml
@@ -8,53 +8,3 @@
 # backends; gstreamer and v4l2 backends remain available.
 [components.opencv.build]
 without = ["openni", "ffmpeg", "xine"]
-
-# AZL does not ship libavif — disable avif support in imgcodecs.
-# No bcond exists; need to remove the BR and pass -DWITH_AVIF=OFF.
-
-[[components.opencv.overlays]]
-description = "Remove libavif BuildRequires (libavif not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(libavif)"
-
-[[components.opencv.overlays]]
-description = "Disable avif support in opencv imgcodecs"
-type = "spec-search-replace"
-section = "%build"
-regex = '%cmake \\'
-replacement = '''%cmake \
- -DWITH_AVIF=OFF \'''
-
-# CVE-2025-53644 patch targets bundled 3rdparty/openjpeg, which Fedora's spec
-# deletes during %prep (it uses system openjpeg2-devel instead). The patch
-# can't find the file and fails. Remove both the patch declaration and its
-# application. The CVE fix belongs in the system openjpeg package, not here.
-# Upstream Fedora offending commit: https://src.fedoraproject.org/rpms/opencv/c/f7431cf
-
-[[components.opencv.overlays]]
-description = "Remove CVE-2025-53644 patch — targets bundled openjpeg that is deleted in %prep; fix belongs in system openjpeg package"
-type = "patch-remove"
-file = "**/a39db41390de546d18962ee1278bd6dbb715f466.patch"
-
-[[components.opencv.overlays]]
-description = "Remove application of CVE-2025-53644 patch (see above)"
-type = "spec-search-replace"
-regex = '%patch.*cve2025-53644'
-replacement = ""
-
-# v4l-utils/libv4l not shipped in AZL. Disable the libv4l userspace wrapper
-# while keeping the kernel V4L2 API available (WITH_V4L defaults to ON).
-
-[[components.opencv.overlays]]
-description = "Remove libv4l-devel BuildRequires — libv4l not shipped in AZL"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "libv4l-devel"
-
-[[components.opencv.overlays]]
-description = "Disable libv4l userspace wrapper — kernel V4L2 API still available via WITH_V4L (default ON)"
-type = "spec-search-replace"
-section = "%build"
-regex = '-DWITH_LIBV4L=ON'
-replacement = '-DWITH_LIBV4L=OFF'
diff --git a/base/comps/opencv/overlays/0001-remove-libavif-buildrequires-libavif.overlay.toml b/base/comps/opencv/overlays/0001-remove-libavif-buildrequires-libavif.overlay.toml
new file mode 100644
index 00000000000..dae29d83dc8
--- /dev/null
+++ b/base/comps/opencv/overlays/0001-remove-libavif-buildrequires-libavif.overlay.toml
@@ -0,0 +1,18 @@
+# AZL does not ship libavif — disable avif support in imgcodecs.
+# No bcond exists; need to remove the BR and pass -DWITH_AVIF=OFF.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove libavif BuildRequires (libavif not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(libavif)"
+
+[[overlays]]
+description = "Disable avif support in opencv imgcodecs"
+type = "spec-search-replace"
+section = "%build"
+regex = "%cmake \\\\"
+replacement = "%cmake \\\n -DWITH_AVIF=OFF \\"
diff --git a/base/comps/opencv/overlays/0002-remove-cve-2025-53644.overlay.toml b/base/comps/opencv/overlays/0002-remove-cve-2025-53644.overlay.toml
new file mode 100644
index 00000000000..34265ee27e2
--- /dev/null
+++ b/base/comps/opencv/overlays/0002-remove-cve-2025-53644.overlay.toml
@@ -0,0 +1,20 @@
+# CVE-2025-53644 patch targets bundled 3rdparty/openjpeg, which Fedora's spec
+# deletes during %prep (it uses system openjpeg2-devel instead). The patch
+# can't find the file and fails. Remove both the patch declaration and its
+# application. The CVE fix belongs in the system openjpeg package, not here.
+# Upstream Fedora offending commit: https://src.fedoraproject.org/rpms/opencv/c/f7431cf
+
+[metadata]
+category = "azl-pruning"
+upstreamable = true
+
+[[overlays]]
+description = "Remove CVE-2025-53644 patch — targets bundled openjpeg that is deleted in %prep; fix belongs in system openjpeg package"
+type = "patch-remove"
+file = "**/a39db41390de546d18962ee1278bd6dbb715f466.patch"
+
+[[overlays]]
+description = "Remove application of CVE-2025-53644 patch (see above)"
+type = "spec-search-replace"
+regex = "%patch.*cve2025-53644"
+replacement = ""
diff --git a/base/comps/opencv/overlays/0003-remove-libv4l-devel-buildrequires.overlay.toml b/base/comps/opencv/overlays/0003-remove-libv4l-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..f35165cffdd
--- /dev/null
+++ b/base/comps/opencv/overlays/0003-remove-libv4l-devel-buildrequires.overlay.toml
@@ -0,0 +1,18 @@
+# v4l-utils/libv4l not shipped in AZL. Disable the libv4l userspace wrapper
+# while keeping the kernel V4L2 API available (WITH_V4L defaults to ON).
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove libv4l-devel BuildRequires — libv4l not shipped in AZL"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "libv4l-devel"
+
+[[overlays]]
+description = "Disable libv4l userspace wrapper — kernel V4L2 API still available via WITH_V4L (default ON)"
+type = "spec-search-replace"
+section = "%build"
+regex = "-DWITH_LIBV4L=ON"
+replacement = "-DWITH_LIBV4L=OFF"
diff --git a/base/comps/p7zip/overlays/0001-remove-yasm-buildrequires-yasm.overlay.toml b/base/comps/p7zip/overlays/0001-remove-yasm-buildrequires-yasm.overlay.toml
new file mode 100644
index 00000000000..0a69fdb2cf8
--- /dev/null
+++ b/base/comps/p7zip/overlays/0001-remove-yasm-buildrequires-yasm.overlay.toml
@@ -0,0 +1,21 @@
+# yasm is deprecated in Fedora 43 (https://fedoraproject.org/wiki/Changes/DeprecateYASM)
+# and not available in Azure Linux. Remove the yasm BuildRequires and switch to
+# the non-asm makefile on x86_64. This loses asm-optimized CRC32/AES but is
+# functionally identical.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove yasm BuildRequires — yasm is not available in Azure Linux"
+type = "spec-search-replace"
+regex = "BuildRequires: yasm"
+replacement = "# BuildRequires: yasm — removed, not available in Azure Linux"
+
+[[overlays]]
+description = "Use non-asm makefile on x86_64 to avoid yasm dependency"
+type = "spec-search-replace"
+section = "%build"
+regex = "makefile.linux_amd64_asm"
+replacement = "makefile.linux_amd64"
diff --git a/base/comps/p7zip/p7zip.comp.toml b/base/comps/p7zip/p7zip.comp.toml
index a89134bbe56..27c6538fb80 100644
--- a/base/comps/p7zip/p7zip.comp.toml
+++ b/base/comps/p7zip/p7zip.comp.toml
@@ -1,19 +1 @@
 [components.p7zip]
-
-# yasm is deprecated in Fedora 43 (https://fedoraproject.org/wiki/Changes/DeprecateYASM)
-# and not available in Azure Linux. Remove the yasm BuildRequires and switch to
-# the non-asm makefile on x86_64. This loses asm-optimized CRC32/AES but is
-# functionally identical.
-
-[[components.p7zip.overlays]]
-description = "Remove yasm BuildRequires — yasm is not available in Azure Linux"
-type = "spec-search-replace"
-regex = 'BuildRequires: yasm'
-replacement = "# BuildRequires: yasm — removed, not available in Azure Linux"
-
-[[components.p7zip.overlays]]
-description = "Use non-asm makefile on x86_64 to avoid yasm dependency"
-type = "spec-search-replace"
-section = "%build"
-regex = 'makefile.linux_amd64_asm'
-replacement = "makefile.linux_amd64"
diff --git a/base/comps/pipewire/overlays/0001-add-release-upstream-baserelease.overlay.toml b/base/comps/pipewire/overlays/0001-add-release-upstream-baserelease.overlay.toml
new file mode 100644
index 00000000000..654ab847474
--- /dev/null
+++ b/base/comps/pipewire/overlays/0001-add-release-upstream-baserelease.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-release-management"
+upstreamable = false
+
+[[overlays]]
+description = "Add azl_release to upstream %{baserelease} so we can bump release independently of upstream while keeping a single-number Fedora-style Release schema"
+type = "spec-search-replace"
+regex = "^Release:\\s+%\\{baserelease\\}%\\{\\?snapdate:\\.%\\{snapdate\\}git%\\{shortcommit\\}\\}%\\{\\?dist\\}$"
+replacement = "Release:        %[%{baserelease} + %{azl_release}]%{?snapdate:.%{snapdate}git%{shortcommit}}%{?dist}"
diff --git a/base/comps/pipewire/overlays/0002-force-disable-meson-features.overlay.toml b/base/comps/pipewire/overlays/0002-force-disable-meson-features.overlay.toml
new file mode 100644
index 00000000000..48c8f1acb26
--- /dev/null
+++ b/base/comps/pipewire/overlays/0002-force-disable-meson-features.overlay.toml
@@ -0,0 +1,39 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Force-disable meson features whose dependencies are not shipped in AZL.\nRequired because Fedora's %meson macro always passes --auto-features=enabled,\nwhich flips every auto-default feature to mandatory and would otherwise turn\nthese missing deps into hard build failures:\n  - opus / bluez5-codec-opus: opus codec library not shipped in AZL\n  - echo-cancel-webrtc: webrtc-audio-processing not shipped in AZL\n    (see the component removal and BR-drop overlays below)\n  - v4l2 / pipewire-v4l2: v4l-utils not shipped in AZL\nThe modules themselves still build; only the codec/backend implementations\nthat need the unavailable libraries are skipped.\n"
+type = "spec-search-replace"
+section = "%build"
+regex = "%meson \\\\"
+replacement = "%meson \\\n    -D opus=disabled -D bluez5-codec-opus=disabled \\\n    -D echo-cancel-webrtc=disabled \\\n    -D v4l2=disabled -D pipewire-v4l2=disabled \\"
+
+# Drop the webrtc-audio-processing BuildRequires lines. The library is not
+# shipped in AZL (Google-derived AEC code that is significantly behind upstream
+# and carries downstream-only patches just to keep building); see the matching
+# component removal in this PR.
+#
+# The BR is gated only by an unconditional `%if 0%{?fedora} >= 40 || ...`
+# block — there is no upstream %bcond, so `build.without` cannot reach it and
+# spec-remove-tag is the only path. The matching -D echo-cancel-webrtc=disabled
+# meson flag is injected by the combined opus/echo-cancel-webrtc overlay above
+# (required because Fedora's %meson uses --auto-features=enabled).
+#
+# libpipewire-module-echo-cancel.so still ships (with the speex / null
+# backends); only the WebRTC backend (libspa-aec-webrtc.so) is dropped.
+#
+# If a spec-remove-tag eventually stops matching after a Fedora rebase,
+# update the value to the new BR spelling — do NOT remove the overlay; the
+# constraint is permanent (webrtc-audio-processing is not shipped in AZL).
+[[overlays]]
+description = "Drop webrtc-audio-processing-1 BR (fedora>=40 / rhel>=10 branch); library not shipped in AZL"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(webrtc-audio-processing-1)"
+
+[[overlays]]
+description = "Drop legacy webrtc-audio-processing BR (else branch, EL<10 / F<40); library not shipped in AZL"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(webrtc-audio-processing) >= 0.2"
diff --git a/base/comps/pipewire/overlays/0003-remove-spa-v4l2-plugin.overlay.toml b/base/comps/pipewire/overlays/0003-remove-spa-v4l2-plugin.overlay.toml
new file mode 100644
index 00000000000..27ffd857b23
--- /dev/null
+++ b/base/comps/pipewire/overlays/0003-remove-spa-v4l2-plugin.overlay.toml
@@ -0,0 +1,21 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove SPA v4l2 plugin from %files (disabled at meson level)"
+type = "spec-search-replace"
+section = "%files"
+regex = "%{_libdir}/spa-%{spaversion}/v4l2/"
+replacement = ""
+
+[[overlays]]
+description = "Drop libv4l-devel BR (v4l-utils not shipped in AZL); not gated by the v4l2 bcond"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "libv4l-devel"
+
+[[overlays]]
+description = "Remove pw-v4l2 man page in %install (meson generates it even with -D pipewire-v4l2=disabled)"
+type = "spec-append-lines"
+section = "%install"
+lines = ["# Remove pw-v4l2 man page (generated even with -D pipewire-v4l2=disabled)", "rm -f %{buildroot}%{_mandir}/man1/pw-v4l2.1*"]
diff --git a/base/comps/pipewire/overlays/0004-remove-pkgconfig-fdk-aac.overlay.toml b/base/comps/pipewire/overlays/0004-remove-pkgconfig-fdk-aac.overlay.toml
new file mode 100644
index 00000000000..ad2d1e7d39e
--- /dev/null
+++ b/base/comps/pipewire/overlays/0004-remove-pkgconfig-fdk-aac.overlay.toml
@@ -0,0 +1,26 @@
+# AZL does not ship fdk-aac-free. Disable the bluez5 AAC codec module
+# so the build doesn't require pkgconfig(fdk-aac); the other bluez5
+# codecs (SBC, lc3, ldac on non-s390x) remain enabled for Bluetooth
+# audio streaming.
+#
+# Update regex on Fedora rebase; do NOT remove the overlays.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove pkgconfig(fdk-aac) BuildRequires (fdk-aac-free not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(fdk-aac)"
+
+# Narrowly anchor on the single `-D bluez5-codec-aptx=disabled` option
+# (rather than a joint phrase like `-D volume=disabled -D bluez5-codec-
+# aptx=disabled`) so this overlay survives upstream Fedora reordering
+# of the meson options.
+[[overlays]]
+description = "Inject -D bluez5-codec-aac=disabled into the %meson invocation (no fdk-aac-free in AZL). Anchored on the neighbouring bluez5-codec-aptx option so the overlay is resilient to upstream reordering of other -D flags."
+type = "spec-search-replace"
+section = "%build"
+regex = "-D bluez5-codec-aptx=disabled"
+replacement = "-D bluez5-codec-aac=disabled -D bluez5-codec-aptx=disabled"
diff --git a/base/comps/pipewire/pipewire.comp.toml b/base/comps/pipewire/pipewire.comp.toml
index d47c997bece..743f732979d 100644
--- a/base/comps/pipewire/pipewire.comp.toml
+++ b/base/comps/pipewire/pipewire.comp.toml
@@ -17,105 +17,3 @@ build.without = ["v4l2", "roc"]
 #   7 - drop AAC bluetooth codec
 azl_release = "7"
 
-[[components.pipewire.overlays]]
-description = "Add azl_release to upstream %{baserelease} so we can bump release independently of upstream while keeping a single-number Fedora-style Release schema"
-type = "spec-search-replace"
-regex = '^Release:\s+%\{baserelease\}%\{\?snapdate:\.%\{snapdate\}git%\{shortcommit\}\}%\{\?dist\}$'
-replacement = 'Release:        %[%{baserelease} + %{azl_release}]%{?snapdate:.%{snapdate}git%{shortcommit}}%{?dist}'
-
-[[components.pipewire.overlays]]
-description = """
-Force-disable meson features whose dependencies are not shipped in AZL.
-Required because Fedora's %meson macro always passes --auto-features=enabled,
-which flips every auto-default feature to mandatory and would otherwise turn
-these missing deps into hard build failures:
-  - opus / bluez5-codec-opus: opus codec library not shipped in AZL
-  - echo-cancel-webrtc: webrtc-audio-processing not shipped in AZL
-    (see the component removal and BR-drop overlays below)
-  - v4l2 / pipewire-v4l2: v4l-utils not shipped in AZL
-The modules themselves still build; only the codec/backend implementations
-that need the unavailable libraries are skipped.
-"""
-type = "spec-search-replace"
-section = "%build"
-regex = '%meson \\'
-replacement = '''%meson \
-    -D opus=disabled -D bluez5-codec-opus=disabled \
-    -D echo-cancel-webrtc=disabled \
-    -D v4l2=disabled -D pipewire-v4l2=disabled \'''
-
-# Drop the webrtc-audio-processing BuildRequires lines. The library is not
-# shipped in AZL (Google-derived AEC code that is significantly behind upstream
-# and carries downstream-only patches just to keep building); see the matching
-# component removal in this PR.
-#
-# The BR is gated only by an unconditional `%if 0%{?fedora} >= 40 || ...`
-# block — there is no upstream %bcond, so `build.without` cannot reach it and
-# spec-remove-tag is the only path. The matching -D echo-cancel-webrtc=disabled
-# meson flag is injected by the combined opus/echo-cancel-webrtc overlay above
-# (required because Fedora's %meson uses --auto-features=enabled).
-#
-# libpipewire-module-echo-cancel.so still ships (with the speex / null
-# backends); only the WebRTC backend (libspa-aec-webrtc.so) is dropped.
-#
-# If a spec-remove-tag eventually stops matching after a Fedora rebase,
-# update the value to the new BR spelling — do NOT remove the overlay; the
-# constraint is permanent (webrtc-audio-processing is not shipped in AZL).
-
-[[components.pipewire.overlays]]
-description = "Drop webrtc-audio-processing-1 BR (fedora>=40 / rhel>=10 branch); library not shipped in AZL"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(webrtc-audio-processing-1)"
-
-[[components.pipewire.overlays]]
-description = "Drop legacy webrtc-audio-processing BR (else branch, EL<10 / F<40); library not shipped in AZL"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(webrtc-audio-processing) >= 0.2"
-
-[[components.pipewire.overlays]]
-description = "Remove SPA v4l2 plugin from %files (disabled at meson level)"
-type = "spec-search-replace"
-section = "%files"
-regex = '%{_libdir}/spa-%{spaversion}/v4l2/'
-replacement = ""
-
-[[components.pipewire.overlays]]
-description = "Drop libv4l-devel BR (v4l-utils not shipped in AZL); not gated by the v4l2 bcond"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "libv4l-devel"
-
-[[components.pipewire.overlays]]
-description = "Remove pw-v4l2 man page in %install (meson generates it even with -D pipewire-v4l2=disabled)"
-type = "spec-append-lines"
-section = "%install"
-lines = [
-    "# Remove pw-v4l2 man page (generated even with -D pipewire-v4l2=disabled)",
-    "rm -f %{buildroot}%{_mandir}/man1/pw-v4l2.1*",
-]
-
-# AZL does not ship fdk-aac-free. Disable the bluez5 AAC codec module
-# so the build doesn't require pkgconfig(fdk-aac); the other bluez5
-# codecs (SBC, lc3, ldac on non-s390x) remain enabled for Bluetooth
-# audio streaming.
-#
-# Update regex on Fedora rebase; do NOT remove the overlays.
-
-[[components.pipewire.overlays]]
-description = "Remove pkgconfig(fdk-aac) BuildRequires (fdk-aac-free not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(fdk-aac)"
-
-# Narrowly anchor on the single `-D bluez5-codec-aptx=disabled` option
-# (rather than a joint phrase like `-D volume=disabled -D bluez5-codec-
-# aptx=disabled`) so this overlay survives upstream Fedora reordering
-# of the meson options.
-[[components.pipewire.overlays]]
-description = "Inject -D bluez5-codec-aac=disabled into the %meson invocation (no fdk-aac-free in AZL). Anchored on the neighbouring bluez5-codec-aptx option so the overlay is resilient to upstream reordering of other -D flags."
-type = "spec-search-replace"
-section = "%build"
-regex = '-D bluez5-codec-aptx=disabled'
-replacement = '-D bluez5-codec-aac=disabled -D bluez5-codec-aptx=disabled'
diff --git a/base/comps/plasma-desktop/overlays/0001-drop-buildrequires-kpipewire-removing.overlay.toml b/base/comps/plasma-desktop/overlays/0001-drop-buildrequires-kpipewire-removing.overlay.toml
new file mode 100644
index 00000000000..aec89b58dd5
--- /dev/null
+++ b/base/comps/plasma-desktop/overlays/0001-drop-buildrequires-kpipewire-removing.overlay.toml
@@ -0,0 +1,15 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop BuildRequires on kpipewire — removing ffmpeg/libav* from the distro"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "kpipewire"
+
+[[overlays]]
+description = "Drop Requires on kpipewire — removing ffmpeg/libav* from the distro"
+type = "spec-remove-tag"
+tag = "Requires"
+value = "kpipewire%{?_isa}"
diff --git a/base/comps/plasma-desktop/plasma-desktop.comp.toml b/base/comps/plasma-desktop/plasma-desktop.comp.toml
index 5700444f0ff..56b049f01e8 100644
--- a/base/comps/plasma-desktop/plasma-desktop.comp.toml
+++ b/base/comps/plasma-desktop/plasma-desktop.comp.toml
@@ -8,14 +8,3 @@
 # media features are unavailable.
 [components.plasma-desktop]
 
-[[components.plasma-desktop.overlays]]
-description = "Drop BuildRequires on kpipewire — removing ffmpeg/libav* from the distro"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "kpipewire"
-
-[[components.plasma-desktop.overlays]]
-description = "Drop Requires on kpipewire — removing ffmpeg/libav* from the distro"
-type = "spec-remove-tag"
-tag = "Requires"
-value = "kpipewire%{?_isa}"
diff --git a/base/comps/plasma-workspace/overlays/0001-drop-buildrequires-kpipewire-devel.overlay.toml b/base/comps/plasma-workspace/overlays/0001-drop-buildrequires-kpipewire-devel.overlay.toml
new file mode 100644
index 00000000000..104300ad047
--- /dev/null
+++ b/base/comps/plasma-workspace/overlays/0001-drop-buildrequires-kpipewire-devel.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop BuildRequires on kpipewire-devel — removing ffmpeg/libav* from the distro"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "kpipewire-devel"
diff --git a/base/comps/plasma-workspace/plasma-workspace.comp.toml b/base/comps/plasma-workspace/plasma-workspace.comp.toml
index 5bc7d1e79df..8181bb5e50c 100644
--- a/base/comps/plasma-workspace/plasma-workspace.comp.toml
+++ b/base/comps/plasma-workspace/plasma-workspace.comp.toml
@@ -7,8 +7,3 @@
 # integration component.
 [components.plasma-workspace]
 
-[[components.plasma-workspace.overlays]]
-description = "Drop BuildRequires on kpipewire-devel — removing ffmpeg/libav* from the distro"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "kpipewire-devel"
diff --git a/base/comps/plexus-velocity/overlays/0001-remove-buildrequires-maven-local.overlay.toml b/base/comps/plexus-velocity/overlays/0001-remove-buildrequires-maven-local.overlay.toml
new file mode 100644
index 00000000000..fecd5676791
--- /dev/null
+++ b/base/comps/plexus-velocity/overlays/0001-remove-buildrequires-maven-local.overlay.toml
@@ -0,0 +1,18 @@
+# AZL ships only java-25-openjdk; there is no java-21-openjdk, so the
+# upstream BuildRequires on maven-local-openjdk21 is unsatisfiable.
+# Retarget to the openjdk25 variant.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove BuildRequires on maven-local-openjdk21 — AZL does not ship java-21-openjdk"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "maven-local-openjdk21"
+
+[[overlays]]
+description = "Add BuildRequires on maven-local-openjdk25 in place of maven-local-openjdk21"
+type = "spec-add-tag"
+tag = "BuildRequires"
+value = "maven-local-openjdk25"
diff --git a/base/comps/plexus-velocity/plexus-velocity.comp.toml b/base/comps/plexus-velocity/plexus-velocity.comp.toml
index 2c2cdab8144..29bcc5bb4d5 100644
--- a/base/comps/plexus-velocity/plexus-velocity.comp.toml
+++ b/base/comps/plexus-velocity/plexus-velocity.comp.toml
@@ -1,16 +1 @@
 [components.plexus-velocity]
-
-# AZL ships only java-25-openjdk; there is no java-21-openjdk, so the
-# upstream BuildRequires on maven-local-openjdk21 is unsatisfiable.
-# Retarget to the openjdk25 variant.
-[[components.plexus-velocity.overlays]]
-description = "Remove BuildRequires on maven-local-openjdk21 — AZL does not ship java-21-openjdk"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "maven-local-openjdk21"
-
-[[components.plexus-velocity.overlays]]
-description = "Add BuildRequires on maven-local-openjdk25 in place of maven-local-openjdk21"
-type = "spec-add-tag"
-tag = "BuildRequires"
-value = "maven-local-openjdk25"
diff --git a/base/comps/plymouth/overlays/0001-disable-fedora-specific-charge.overlay.toml b/base/comps/plymouth/overlays/0001-disable-fedora-specific-charge.overlay.toml
new file mode 100644
index 00000000000..71dfe1c89de
--- /dev/null
+++ b/base/comps/plymouth/overlays/0001-disable-fedora-specific-charge.overlay.toml
@@ -0,0 +1,23 @@
+# Drop the plymouth-theme-charge subpackage — it requires fedora-logos-classic,
+# which does not exist in Azure Linux. The theme is Fedora-specific branding
+# ("shadowy hull of a Fedora logo") with no AZL equivalent needed.
+# The upstream spec gates it behind %if ! 0%{?rhel}, which excludes it on RHEL
+# but not on AZL (since %rhel is undefined on our builders).
+# Upstream: https://src.fedoraproject.org/rpms/plymouth
+# Ref: microsoft/azurelinux#18865
+#
+# Note: spec-remove-section cannot be used here because each charge-theme
+# section is wrapped in %if/%endif guards. Removing the section also eats
+# the %endif, leaving an unclosed %if that breaks rpmbuild.
+# The same guard appears in 4 spec sections (%package, %install, %postun,
+# %files) and all must be disabled.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable Fedora-specific charge theme subpackage (plymouth-theme-charge) — requires fedora-logos-classic which AZL does not ship"
+type = "spec-search-replace"
+regex = "^%if\\s+!\\s+0%\\{\\?rhel\\}\\s*$"
+replacement = "%if 0"
diff --git a/base/comps/plymouth/plymouth.comp.toml b/base/comps/plymouth/plymouth.comp.toml
index d12f82ecf17..74f077edea4 100644
--- a/base/comps/plymouth/plymouth.comp.toml
+++ b/base/comps/plymouth/plymouth.comp.toml
@@ -1,20 +1 @@
 [components.plymouth]
-
-# Drop the plymouth-theme-charge subpackage — it requires fedora-logos-classic,
-# which does not exist in Azure Linux. The theme is Fedora-specific branding
-# ("shadowy hull of a Fedora logo") with no AZL equivalent needed.
-# The upstream spec gates it behind %if ! 0%{?rhel}, which excludes it on RHEL
-# but not on AZL (since %rhel is undefined on our builders).
-# Upstream: https://src.fedoraproject.org/rpms/plymouth
-# Ref: microsoft/azurelinux#18865
-#
-# Note: spec-remove-section cannot be used here because each charge-theme
-# section is wrapped in %if/%endif guards. Removing the section also eats
-# the %endif, leaving an unclosed %if that breaks rpmbuild.
-# The same guard appears in 4 spec sections (%package, %install, %postun,
-# %files) and all must be disabled.
-[[components.plymouth.overlays]]
-description = "Disable Fedora-specific charge theme subpackage (plymouth-theme-charge) — requires fedora-logos-classic which AZL does not ship"
-type = "spec-search-replace"
-regex = '^%if\s+!\s+0%\{\?rhel\}\s*$'
-replacement = '%if 0'
diff --git a/base/comps/po4a/overlays/0001-drop-texlive-kpathsea-requires.overlay.toml b/base/comps/po4a/overlays/0001-drop-texlive-kpathsea-requires.overlay.toml
new file mode 100644
index 00000000000..f24be084c4a
--- /dev/null
+++ b/base/comps/po4a/overlays/0001-drop-texlive-kpathsea-requires.overlay.toml
@@ -0,0 +1,24 @@
+# Drop the runtime Requires on texlive-kpathsea / texlive-kpathsea-bin.
+# po4a is a multi-format documentation translation tool (~15 format
+# modules: man, sgml, xml, asciidoc, markdown, docbook, dia, halibut,
+# tex, ...). The kpathsea Requires are only consumed by Locale::Po4a::TeX
+# (which shells out to `kpsewhich` to resolve TeX \input/\include paths).
+# All other format modules work without it. AZL is a headless cloud distro
+# where TeX is sdk-tier; this overlay lets po4a stay in base while
+# texlive-kpathsea(-bin) live in sdk. Users translating TeX sources can
+# install texlive-kpathsea-bin from sdk on demand.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Drop texlive-kpathsea Requires - TeX format support is optional, texlive is sdk-tier"
+type = "spec-remove-tag"
+tag = "Requires"
+value = "texlive-kpathsea"
+
+[[overlays]]
+description = "Drop texlive-kpathsea-bin Requires - TeX format support is optional, texlive is sdk-tier"
+type = "spec-remove-tag"
+tag = "Requires"
+value = "texlive-kpathsea-bin"
diff --git a/base/comps/po4a/po4a.comp.toml b/base/comps/po4a/po4a.comp.toml
index 8a16af6ac98..03aa0bdba75 100644
--- a/base/comps/po4a/po4a.comp.toml
+++ b/base/comps/po4a/po4a.comp.toml
@@ -1,22 +1 @@
 [components.po4a]
-
-# Drop the runtime Requires on texlive-kpathsea / texlive-kpathsea-bin.
-# po4a is a multi-format documentation translation tool (~15 format
-# modules: man, sgml, xml, asciidoc, markdown, docbook, dia, halibut,
-# tex, ...). The kpathsea Requires are only consumed by Locale::Po4a::TeX
-# (which shells out to `kpsewhich` to resolve TeX \input/\include paths).
-# All other format modules work without it. AZL is a headless cloud distro
-# where TeX is sdk-tier; this overlay lets po4a stay in base while
-# texlive-kpathsea(-bin) live in sdk. Users translating TeX sources can
-# install texlive-kpathsea-bin from sdk on demand.
-[[components.po4a.overlays]]
-description = "Drop texlive-kpathsea Requires - TeX format support is optional, texlive is sdk-tier"
-type = "spec-remove-tag"
-tag = "Requires"
-value = "texlive-kpathsea"
-
-[[components.po4a.overlays]]
-description = "Drop texlive-kpathsea-bin Requires - TeX format support is optional, texlive is sdk-tier"
-type = "spec-remove-tag"
-tag = "Requires"
-value = "texlive-kpathsea-bin"
diff --git a/base/comps/pulseaudio/overlays/0001-add-release-upstream-release.overlay.toml b/base/comps/pulseaudio/overlays/0001-add-release-upstream-release.overlay.toml
new file mode 100644
index 00000000000..cdbe3a7f9a1
--- /dev/null
+++ b/base/comps/pulseaudio/overlays/0001-add-release-upstream-release.overlay.toml
@@ -0,0 +1,17 @@
+# Add azl_release to upstream's hardcoded Release (9) so we can bump release
+# independently of upstream while keeping a single-number Fedora-style Release
+# schema. The regex matches the current upstream Release verbatim and acts as
+# a tripwire: if Fedora bumps the upstream number (e.g. 9 → 10), the regex
+# will stop matching and force a conscious re-evaluation of the baseline.
+# When that happens, update the regex *and* the baseline number in the
+# replacement to the new upstream value, and reset azl_release to "1".
+
+[metadata]
+category = "azl-release-management"
+upstreamable = false
+
+[[overlays]]
+description = "Add azl_release to upstream Release so we can bump release independently of upstream while keeping a single-number Fedora-style Release schema"
+type = "spec-search-replace"
+regex = "^Release:\\s+9%\\{\\?snap:\\.%\\{snap\\}git%\\{shortcommit\\}\\}%\\{\\?dist\\}$"
+replacement = "Release:        %[9 + %{azl_release}]%{?snap:.%{snap}git%{shortcommit}}%{?dist}"
diff --git a/base/comps/pulseaudio/overlays/0002-disable-gdm-hooks-subpackage.overlay.toml b/base/comps/pulseaudio/overlays/0002-disable-gdm-hooks-subpackage.overlay.toml
new file mode 100644
index 00000000000..4896a3820ac
--- /dev/null
+++ b/base/comps/pulseaudio/overlays/0002-disable-gdm-hooks-subpackage.overlay.toml
@@ -0,0 +1,13 @@
+# The gdm-hooks subpackage was moved to gdm packaging in Fedora 28+,
+# so this subpackage should not be built. The upstream conditional mis-fires
+# when %fedora is undefined, but regardless we force gdm_hooks to 0 so the
+# subpackage is never built.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Disable gdm-hooks subpackage (moved to gdm packaging in Fedora 28+)"
+type = "spec-search-replace"
+regex = "%global gdm_hooks 1"
+replacement = "%global gdm_hooks 0"
diff --git a/base/comps/pulseaudio/overlays/0003-disable-webrtc-aec-backend.overlay.toml b/base/comps/pulseaudio/overlays/0003-disable-webrtc-aec-backend.overlay.toml
new file mode 100644
index 00000000000..9f6dddb57a5
--- /dev/null
+++ b/base/comps/pulseaudio/overlays/0003-disable-webrtc-aec-backend.overlay.toml
@@ -0,0 +1,30 @@
+# Disable WebRTC-based acoustic echo cancellation. AZL does not ship the
+# webrtc-audio-processing component (Google-derived code that is significantly
+# behind upstream and carries downstream patches just to keep building), so
+# PulseAudio's module-echo-cancel falls back to its other AEC implementations
+# (speex, null). Drops the BuildRequires on pkgconfig(webrtc-audio-processing-1)
+# and the module-echo-cancel webrtc backend (libwebrtc-util.so). See PR #17329.
+#
+# Note: we %undefine (rather than set to 0) because the spec also uses
+# `%{?with_webrtc:enabled}%{!?with_webrtc:disabled}` to compute the meson
+# `-D webrtc-aec=` flag — that conditional tests for *definition*, not
+# truthiness, so `%global with_webrtc 0` would still pass `enabled` to meson.
+# Leaving the macro undefined makes every `%if 0%{?with_webrtc}` and
+# `%{?with_webrtc:...}` evaluate to the disabled branch consistently.
+#
+# Regex is anchored to a full line (with optional trailing whitespace) to
+# guard against benign Fedora reformatting and to avoid accidentally
+# matching e.g. `%global with_webrtc 10` in some hypothetical future variant.
+# If this regex stops matching after a Fedora rebase, *update* it to the
+# new macro shape — do NOT remove the overlay; the constraint is permanent
+# (webrtc-audio-processing is not shipped in AZL).
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable WebRTC AEC backend (webrtc-audio-processing not shipped in AZL)"
+type = "spec-search-replace"
+regex = "^%global with_webrtc 1\\s*$"
+replacement = "%undefine with_webrtc"
diff --git a/base/comps/pulseaudio/pulseaudio.comp.toml b/base/comps/pulseaudio/pulseaudio.comp.toml
index 297aeb90c52..f87e3817e88 100644
--- a/base/comps/pulseaudio/pulseaudio.comp.toml
+++ b/base/comps/pulseaudio/pulseaudio.comp.toml
@@ -13,52 +13,3 @@ release = { calculation = "manual" }
 #   4 - introduce azl_release for pulseaudio
 #   5 - disable WebRTC AEC backend
 azl_release = "5"
-
-# Add azl_release to upstream's hardcoded Release (9) so we can bump release
-# independently of upstream while keeping a single-number Fedora-style Release
-# schema. The regex matches the current upstream Release verbatim and acts as
-# a tripwire: if Fedora bumps the upstream number (e.g. 9 → 10), the regex
-# will stop matching and force a conscious re-evaluation of the baseline.
-# When that happens, update the regex *and* the baseline number in the
-# replacement to the new upstream value, and reset azl_release to "1".
-[[components.pulseaudio.overlays]]
-description = "Add azl_release to upstream Release so we can bump release independently of upstream while keeping a single-number Fedora-style Release schema"
-type = "spec-search-replace"
-regex = '^Release:\s+9%\{\?snap:\.%\{snap\}git%\{shortcommit\}\}%\{\?dist\}$'
-replacement = 'Release:        %[9 + %{azl_release}]%{?snap:.%{snap}git%{shortcommit}}%{?dist}'
-
-# The gdm-hooks subpackage was moved to gdm packaging in Fedora 28+,
-# so this subpackage should not be built. The upstream conditional mis-fires
-# when %fedora is undefined, but regardless we force gdm_hooks to 0 so the
-# subpackage is never built.
-[[components.pulseaudio.overlays]]
-description = "Disable gdm-hooks subpackage (moved to gdm packaging in Fedora 28+)"
-type = "spec-search-replace"
-regex = "%global gdm_hooks 1"
-replacement = "%global gdm_hooks 0"
-
-# Disable WebRTC-based acoustic echo cancellation. AZL does not ship the
-# webrtc-audio-processing component (Google-derived code that is significantly
-# behind upstream and carries downstream patches just to keep building), so
-# PulseAudio's module-echo-cancel falls back to its other AEC implementations
-# (speex, null). Drops the BuildRequires on pkgconfig(webrtc-audio-processing-1)
-# and the module-echo-cancel webrtc backend (libwebrtc-util.so). See PR #17329.
-#
-# Note: we %undefine (rather than set to 0) because the spec also uses
-# `%{?with_webrtc:enabled}%{!?with_webrtc:disabled}` to compute the meson
-# `-D webrtc-aec=` flag — that conditional tests for *definition*, not
-# truthiness, so `%global with_webrtc 0` would still pass `enabled` to meson.
-# Leaving the macro undefined makes every `%if 0%{?with_webrtc}` and
-# `%{?with_webrtc:...}` evaluate to the disabled branch consistently.
-#
-# Regex is anchored to a full line (with optional trailing whitespace) to
-# guard against benign Fedora reformatting and to avoid accidentally
-# matching e.g. `%global with_webrtc 10` in some hypothetical future variant.
-# If this regex stops matching after a Fedora rebase, *update* it to the
-# new macro shape — do NOT remove the overlay; the constraint is permanent
-# (webrtc-audio-processing is not shipped in AZL).
-[[components.pulseaudio.overlays]]
-description = "Disable WebRTC AEC backend (webrtc-audio-processing not shipped in AZL)"
-type = "spec-search-replace"
-regex = '^%global with_webrtc 1\s*$'
-replacement = "%undefine with_webrtc"
diff --git a/base/comps/python-geographiclib/overlays/0001-remove-mingw32-python3-geographiclib.overlay.toml b/base/comps/python-geographiclib/overlays/0001-remove-mingw32-python3-geographiclib.overlay.toml
new file mode 100644
index 00000000000..c3a84c79f07
--- /dev/null
+++ b/base/comps/python-geographiclib/overlays/0001-remove-mingw32-python3-geographiclib.overlay.toml
@@ -0,0 +1,52 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# Remove all mingw subpackages and their build dependencies.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove mingw32-python3-geographiclib subpackage — Azure Linux does not ship mingw toolchains"
+type = "spec-remove-subpackage"
+package = "mingw32-python3-%{pkg_name}"
+
+[[overlays]]
+description = "Remove mingw64-python3-geographiclib subpackage"
+type = "spec-remove-subpackage"
+package = "mingw64-python3-%{pkg_name}"
+
+[[overlays]]
+description = "Remove mingw32-filesystem BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-filesystem"
+
+[[overlays]]
+description = "Remove mingw32-python3 BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-python3"
+
+[[overlays]]
+description = "Remove mingw32-python3-build BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw32-python3-build"
+
+[[overlays]]
+description = "Remove mingw64-filesystem BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-filesystem"
+
+[[overlays]]
+description = "Remove mingw64-python3 BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-python3"
+
+[[overlays]]
+description = "Remove mingw64-python3-build BuildRequires"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "mingw64-python3-build"
diff --git a/base/comps/python-geographiclib/overlays/0002-neutralize-mingw32-wheel-build.overlay.toml b/base/comps/python-geographiclib/overlays/0002-neutralize-mingw32-wheel-build.overlay.toml
new file mode 100644
index 00000000000..5f5bc8c8502
--- /dev/null
+++ b/base/comps/python-geographiclib/overlays/0002-neutralize-mingw32-wheel-build.overlay.toml
@@ -0,0 +1,38 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Neutralize mingw32 wheel build step (replace with bash no-op `:` to preserve subshell structure)"
+type = "spec-search-replace"
+section = "%build"
+regex = "^\\%mingw32_py3_build_wheel$"
+replacement = ":"
+
+[[overlays]]
+description = "Neutralize mingw64 wheel build step"
+type = "spec-search-replace"
+section = "%build"
+regex = "^\\%mingw64_py3_build_wheel$"
+replacement = ":"
+
+[[overlays]]
+description = "Neutralize mingw32 wheel install step — `:` keeps the upstream `( ... )` subshell non-empty so bash doesn't fail with `syntax error near unexpected token ')'`"
+type = "spec-search-replace"
+section = "%install"
+regex = "^\\%mingw32_py3_install_wheel$"
+replacement = ":"
+
+[[overlays]]
+description = "Neutralize mingw64 wheel install step"
+type = "spec-search-replace"
+section = "%install"
+regex = "^\\%mingw64_py3_install_wheel$"
+replacement = ":"
+
+[[overlays]]
+description = "Neutralize mingw debug install post step"
+type = "spec-search-replace"
+section = "%install"
+regex = "^\\%mingw_debug_install_post$"
+replacement = ":"
diff --git a/base/comps/python-geographiclib/python-geographiclib.comp.toml b/base/comps/python-geographiclib/python-geographiclib.comp.toml
index 89dc751f1b1..f29c474dde6 100644
--- a/base/comps/python-geographiclib/python-geographiclib.comp.toml
+++ b/base/comps/python-geographiclib/python-geographiclib.comp.toml
@@ -1,85 +1 @@
 [components.python-geographiclib]
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# Remove all mingw subpackages and their build dependencies.
-
-[[components.python-geographiclib.overlays]]
-description = "Remove mingw32-python3-geographiclib subpackage — Azure Linux does not ship mingw toolchains"
-type = "spec-remove-subpackage"
-package = "mingw32-python3-%{pkg_name}"
-
-[[components.python-geographiclib.overlays]]
-description = "Remove mingw64-python3-geographiclib subpackage"
-type = "spec-remove-subpackage"
-package = "mingw64-python3-%{pkg_name}"
-
-[[components.python-geographiclib.overlays]]
-description = "Remove mingw32-filesystem BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-filesystem"
-
-[[components.python-geographiclib.overlays]]
-description = "Remove mingw32-python3 BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-python3"
-
-[[components.python-geographiclib.overlays]]
-description = "Remove mingw32-python3-build BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw32-python3-build"
-
-[[components.python-geographiclib.overlays]]
-description = "Remove mingw64-filesystem BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-filesystem"
-
-[[components.python-geographiclib.overlays]]
-description = "Remove mingw64-python3 BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-python3"
-
-[[components.python-geographiclib.overlays]]
-description = "Remove mingw64-python3-build BuildRequires"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "mingw64-python3-build"
-
-[[components.python-geographiclib.overlays]]
-description = "Neutralize mingw32 wheel build step (replace with bash no-op `:` to preserve subshell structure)"
-type = "spec-search-replace"
-section = "%build"
-regex = '^\%mingw32_py3_build_wheel$'
-replacement = ':'
-
-[[components.python-geographiclib.overlays]]
-description = "Neutralize mingw64 wheel build step"
-type = "spec-search-replace"
-section = "%build"
-regex = '^\%mingw64_py3_build_wheel$'
-replacement = ':'
-
-[[components.python-geographiclib.overlays]]
-description = "Neutralize mingw32 wheel install step — `:` keeps the upstream `( ... )` subshell non-empty so bash doesn't fail with `syntax error near unexpected token ')'`"
-type = "spec-search-replace"
-section = "%install"
-regex = '^\%mingw32_py3_install_wheel$'
-replacement = ':'
-
-[[components.python-geographiclib.overlays]]
-description = "Neutralize mingw64 wheel install step"
-type = "spec-search-replace"
-section = "%install"
-regex = '^\%mingw64_py3_install_wheel$'
-replacement = ':'
-
-[[components.python-geographiclib.overlays]]
-description = "Neutralize mingw debug install post step"
-type = "spec-search-replace"
-section = "%install"
-regex = '^\%mingw_debug_install_post$'
-replacement = ':'
diff --git a/base/comps/python-openstackclient/overlays/0001-disable-doc-generation-work.overlay.toml b/base/comps/python-openstackclient/overlays/0001-disable-doc-generation-work.overlay.toml
new file mode 100644
index 00000000000..5fffdd85848
--- /dev/null
+++ b/base/comps/python-openstackclient/overlays/0001-disable-doc-generation-work.overlay.toml
@@ -0,0 +1,13 @@
+# Disable doc generation to avoid cliff sphinxext Python 3.14 incompatibility.
+# TODO: re-enable doc once cliff sphinxext fix is released upstream
+# Upstream fix: https://github.com/openstack/cliff/commit/391261c849c994ca2d3f42926497e633047ed8c7
+
+[metadata]
+category = "azl-pruning"
+upstreamable = true
+
+[[overlays]]
+description = "Disable doc generation to work around cliff sphinxext Python 3.14 incompatibility"
+type = "spec-search-replace"
+regex = "^%global with_doc 1$"
+replacement = "%global with_doc 0"
diff --git a/base/comps/python-openstackclient/python-openstackclient.comp.toml b/base/comps/python-openstackclient/python-openstackclient.comp.toml
index 97a70ca1dcc..d34ca102f27 100644
--- a/base/comps/python-openstackclient/python-openstackclient.comp.toml
+++ b/base/comps/python-openstackclient/python-openstackclient.comp.toml
@@ -1,10 +1 @@
 [components.python-openstackclient]
-
-# Disable doc generation to avoid cliff sphinxext Python 3.14 incompatibility.
-# TODO: re-enable doc once cliff sphinxext fix is released upstream
-# Upstream fix: https://github.com/openstack/cliff/commit/391261c849c994ca2d3f42926497e633047ed8c7
-[[components.python-openstackclient.overlays]]
-description = "Disable doc generation to work around cliff sphinxext Python 3.14 incompatibility"
-type = "spec-search-replace"
-regex = '^%global with_doc 1$'
-replacement = '%global with_doc 0'
diff --git a/base/comps/python-pikepdf/overlays/0001-remove-python-xmp-toolkit.overlay.toml b/base/comps/python-pikepdf/overlays/0001-remove-python-xmp-toolkit.overlay.toml
new file mode 100644
index 00000000000..146d6a09294
--- /dev/null
+++ b/base/comps/python-pikepdf/overlays/0001-remove-python-xmp-toolkit.overlay.toml
@@ -0,0 +1,13 @@
+# python-xmp-toolkit is not packaged in Azure Linux and is only a test
+# dependency for XMP metadata tests on x86_64. Strip it from the pyproject.toml
+# test extras so %pyproject_buildrequires doesn't pull in the missing package.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove python-xmp-toolkit from test dependencies (not available in Azure Linux)"
+type = "spec-append-lines"
+section = "%prep"
+lines = ["tomcli set pyproject.toml arrays delitem 'project.optional-dependencies.test' 'python-xmp-toolkit.*'"]
diff --git a/base/comps/python-pikepdf/python-pikepdf.comp.toml b/base/comps/python-pikepdf/python-pikepdf.comp.toml
index 6d0063fa41a..8d0ef97477d 100644
--- a/base/comps/python-pikepdf/python-pikepdf.comp.toml
+++ b/base/comps/python-pikepdf/python-pikepdf.comp.toml
@@ -1,12 +1 @@
 [components.python-pikepdf]
-
-# python-xmp-toolkit is not packaged in Azure Linux and is only a test
-# dependency for XMP metadata tests on x86_64. Strip it from the pyproject.toml
-# test extras so %pyproject_buildrequires doesn't pull in the missing package.
-[[components.python-pikepdf.overlays]]
-description = "Remove python-xmp-toolkit from test dependencies (not available in Azure Linux)"
-type = "spec-append-lines"
-section = "%prep"
-lines = [
-    "tomcli set pyproject.toml arrays delitem 'project.optional-dependencies.test' 'python-xmp-toolkit.*'",
-]
diff --git a/base/comps/python-stestr/overlays/0001-disable-doc-generation-cliff.overlay.toml b/base/comps/python-stestr/overlays/0001-disable-doc-generation-cliff.overlay.toml
new file mode 100644
index 00000000000..20554f65072
--- /dev/null
+++ b/base/comps/python-stestr/overlays/0001-disable-doc-generation-cliff.overlay.toml
@@ -0,0 +1,14 @@
+# cliff.sphinxext uses argparse.HelpFormatter._format_actions_usage, a private API
+# removed in Python 3.14. This crashes sphinx-build during %build when generating docs.
+# Disable doc generation while we figure out what to do about this.
+# Fixed in cliff: https://opendev.org/openstack/cliff/commit/391261c849c994ca2d3f42926497e633047ed8c7
+
+[metadata]
+category = "azl-pruning"
+upstreamable = true
+
+[[overlays]]
+description = "Disable doc generation — cliff.sphinxext is incompatible with Python 3.14 (uses removed argparse._format_actions_usage)"
+type = "spec-search-replace"
+regex = "^%global with_doc 1$"
+replacement = "%global with_doc 0"
diff --git a/base/comps/python-stestr/python-stestr.comp.toml b/base/comps/python-stestr/python-stestr.comp.toml
index d2799a72682..3a3157f6f52 100644
--- a/base/comps/python-stestr/python-stestr.comp.toml
+++ b/base/comps/python-stestr/python-stestr.comp.toml
@@ -1,11 +1 @@
 [components.python-stestr]
-
-# cliff.sphinxext uses argparse.HelpFormatter._format_actions_usage, a private API
-# removed in Python 3.14. This crashes sphinx-build during %build when generating docs.
-# Disable doc generation while we figure out what to do about this.
-# Fixed in cliff: https://opendev.org/openstack/cliff/commit/391261c849c994ca2d3f42926497e633047ed8c7
-[[components.python-stestr.overlays]]
-description = "Disable doc generation — cliff.sphinxext is incompatible with Python 3.14 (uses removed argparse._format_actions_usage)"
-type = "spec-search-replace"
-regex = '^%global with_doc 1$'
-replacement = '%global with_doc 0'
diff --git a/base/comps/qemu/overlays/0001-disable-unneeded-features-and-subpackages.overlay.toml b/base/comps/qemu/overlays/0001-disable-unneeded-features-and-subpackages.overlay.toml
new file mode 100644
index 00000000000..8254ec0160d
--- /dev/null
+++ b/base/comps/qemu/overlays/0001-disable-unneeded-features-and-subpackages.overlay.toml
@@ -0,0 +1,339 @@
+# Disable features not needed in Azure Linux's Hyper-V/KVM environment, and strip
+# audio backends + sub-packages to avoid pulling in heavy sdk-tier dependencies.
+
+# All qemu overlays form a single azl-pruning logical change (their report
+# groups interleave in apply order), so they live in one file to preserve the
+# exact original sequence. Category aligned with overlay_report.md (azl-pruning).
+metadata = { category = "azl-pruning" }
+
+overlays = [
+    # --- Feature toggles ---
+    # Upstream enables Xen when %fedora is set (which it is on our builders), so force it off.
+    {
+        description = 'Disable Xen support - not needed for Azure Linux (Hyper-V/KVM only)',
+        type = 'spec-search-replace',
+        regex = '^%global have_xen 1$',
+        replacement = '%global have_xen 0',
+    },
+    # brltty pulls in bluetooth, audio, and more runtime deps.
+    {
+        description = 'Disable Baum Braille device backend',
+        type = 'spec-search-replace',
+        regex = '^%global have_brlapi 1$',
+        replacement = '%global have_brlapi 0',
+    },
+    # jack audio backend is enabled by default, but we disable it.
+    {
+        description = 'Disable JACK audio backend',
+        type = 'spec-search-replace',
+        regex = '^%global have_jack 1$',
+        replacement = '%global have_jack 0',
+    },
+    # Disable spice support for remote display.
+    {
+        description = 'Disable SPICE support',
+        type = 'spec-search-replace',
+        regex = '^%global have_spice 1$',
+        replacement = '%global have_spice 0',
+    },
+    # Disable D-Bus display server (and its audio module). Without this, qemu's meson unconditionally
+    # builds audio-dbus.so when have_dbus_display=1, which causes "Installed (but unpackaged)" errors
+    # since we strip the audio-dbus subpackage.
+    {
+        description = 'Disable D-Bus display server',
+        type = 'spec-search-replace',
+        regex = '^%global have_dbus_display 1$',
+        replacement = '%global have_dbus_display 0',
+    },
+
+    # --- Audio backend removal: configure flags ---
+    # Upstream lacks macros to disable these; we flip the flags and clear the driver list directly.
+    {
+        description = 'configure: disable-pipewire',
+        type = 'spec-search-replace',
+        section = '%build',
+        regex = '--enable-pipewire \\',
+        replacement = '--disable-pipewire \',
+    },
+    {
+        description = 'configure: disable pulseaudio',
+        type = 'spec-search-replace',
+        section = '%build',
+        regex = '--enable-pa \\',
+        replacement = '--disable-pa \',
+    },
+    {
+        description = 'configure: disable sdl',
+        type = 'spec-search-replace',
+        section = '%build',
+        regex = '--enable-sdl \\',
+        replacement = '--disable-sdl \',
+    },
+    {
+        description = 'configure: disable sdl-image',
+        type = 'spec-search-replace',
+        section = '%build',
+        regex = '--enable-sdl-image \\',
+        replacement = '--disable-sdl-image \',
+    },
+    {
+        description = 'configure: disable alsa',
+        type = 'spec-search-replace',
+        section = '%build',
+        regex = '--enable-alsa \\',
+        replacement = '--disable-alsa \',
+    },
+    {
+        description = 'configure: disable oss',
+        type = 'spec-search-replace',
+        section = '%build',
+        regex = '--enable-oss \\',
+        replacement = '--disable-oss \',
+    },
+    {
+        description = 'configure: remove all audio drivers',
+        type = 'spec-search-replace',
+        section = '%build',
+        regex = '--audio-drv-list=.* \\',
+        replacement = '--audio-drv-list= \',
+    },
+
+    # --- Unhook audio Requires from qemu-system-* emulators ---
+    {
+        description = 'Empty requires_audio_pipewire macro',
+        type = 'spec-search-replace',
+        regex = '%define requires_audio_pipewire .*',
+        replacement = '%define requires_audio_pipewire %{nil}',
+    },
+    {
+        description = 'Empty requires_audio_pa macro',
+        type = 'spec-search-replace',
+        regex = '%define requires_audio_pa .*',
+        replacement = '%define requires_audio_pa %{nil}',
+    },
+    {
+        description = 'Empty requires_audio_sdl macro',
+        type = 'spec-search-replace',
+        regex = '%define requires_audio_sdl .*',
+        replacement = '%define requires_audio_sdl %{nil}',
+    },
+    {
+        description = 'Empty requires_audio_alsa macro',
+        type = 'spec-search-replace',
+        regex = '%define requires_audio_alsa .*',
+        replacement = '%define requires_audio_alsa %{nil}',
+    },
+    {
+        description = 'Empty requires_audio_dbus macro',
+        type = 'spec-search-replace',
+        regex = '%define requires_audio_dbus .*',
+        replacement = '%define requires_audio_dbus %{nil}',
+    },
+    {
+        description = 'Empty requires_audio_oss macro',
+        type = 'spec-search-replace',
+        regex = '%define requires_audio_oss .*',
+        replacement = '%define requires_audio_oss %{nil}',
+    },
+
+    # --- Unhook ui-sdl Requires from qemu-system-* emulators (configure --disable-sdl is set above) ---
+    {
+        description = 'Empty requires_ui_sdl macro',
+        type = 'spec-search-replace',
+        regex = '%define requires_ui_sdl .*',
+        replacement = '%define requires_ui_sdl %{nil}',
+    },
+
+    # --- Remove audio sub-packages (no longer built) ---
+    # Remove qemu-audio-pipewire
+    {
+        description = 'Remove %package audio-pipewire',
+        type = 'spec-remove-section',
+        package = 'audio-pipewire',
+        section = '%package',
+    },
+    {
+        description = 'Remove %description audio-pipewire',
+        type = 'spec-remove-section',
+        package = 'audio-pipewire',
+        section = '%description',
+    },
+    {
+        description = 'Remove %files audio-pipewire',
+        type = 'spec-remove-section',
+        package = 'audio-pipewire',
+        section = '%files',
+    },
+
+    # Remove qemu-audio-pa
+    {
+        description = 'Remove %package audio-pa',
+        type = 'spec-remove-section',
+        package = 'audio-pa',
+        section = '%package',
+    },
+    {
+        description = 'Remove %description audio-pa',
+        type = 'spec-remove-section',
+        package = 'audio-pa',
+        section = '%description',
+    },
+    {
+        description = 'Remove %files audio-pa',
+        type = 'spec-remove-section',
+        package = 'audio-pa',
+        section = '%files',
+    },
+
+    # Remove qemu-audio-sdl
+    {
+        description = 'Remove %package audio-sdl',
+        type = 'spec-remove-section',
+        package = 'audio-sdl',
+        section = '%package',
+    },
+    {
+        description = 'Remove %description audio-sdl',
+        type = 'spec-remove-section',
+        package = 'audio-sdl',
+        section = '%description',
+    },
+    {
+        description = 'Remove %files audio-sdl',
+        type = 'spec-remove-section',
+        package = 'audio-sdl',
+        section = '%files',
+    },
+
+    # Remove qemu-audio-alsa
+    {
+        description = 'Remove %package audio-alsa',
+        type = 'spec-remove-section',
+        package = 'audio-alsa',
+        section = '%package',
+    },
+    {
+        description = 'Remove %description audio-alsa',
+        type = 'spec-remove-section',
+        package = 'audio-alsa',
+        section = '%description',
+    },
+    {
+        description = 'Remove %files audio-alsa',
+        type = 'spec-remove-section',
+        package = 'audio-alsa',
+        section = '%files',
+    },
+
+    # Remove qemu-audio-dbus
+    {
+        description = 'Remove %package audio-dbus',
+        type = 'spec-remove-section',
+        package = 'audio-dbus',
+        section = '%package',
+    },
+    {
+        description = 'Remove %description audio-dbus',
+        type = 'spec-remove-section',
+        package = 'audio-dbus',
+        section = '%description',
+    },
+    {
+        description = 'Remove %files audio-dbus',
+        type = 'spec-remove-section',
+        package = 'audio-dbus',
+        section = '%files',
+    },
+
+    # Remove qemu-audio-oss
+    {
+        description = 'Remove %package audio-oss',
+        type = 'spec-remove-section',
+        package = 'audio-oss',
+        section = '%package',
+    },
+    {
+        description = 'Remove %description audio-oss',
+        type = 'spec-remove-section',
+        package = 'audio-oss',
+        section = '%description',
+    },
+    {
+        description = 'Remove %files audio-oss',
+        type = 'spec-remove-section',
+        package = 'audio-oss',
+        section = '%files',
+    },
+
+    # Remove qemu-audio-jack
+    {
+        description = 'Remove %package audio-jack',
+        type = 'spec-remove-section',
+        package = 'audio-jack',
+        section = '%package',
+    },
+    {
+        description = 'Remove %description audio-jack',
+        type = 'spec-remove-section',
+        package = 'audio-jack',
+        section = '%description',
+    },
+    {
+        description = 'Remove %files audio-jack',
+        type = 'spec-remove-section',
+        package = 'audio-jack',
+        section = '%files',
+    },
+
+    # Remove SDL UI sub-package
+    {
+        description = 'Remove %package ui-sdl',
+        type = 'spec-remove-section',
+        package = 'ui-sdl',
+        section = '%package',
+    },
+    {
+        description = 'Remove %description ui-sdl',
+        type = 'spec-remove-section',
+        package = 'ui-sdl',
+        section = '%description',
+    },
+    {
+        description = 'Remove %files ui-sdl',
+        type = 'spec-remove-section',
+        package = 'ui-sdl',
+        section = '%files',
+    },
+
+    # --- Drop tests subpackage ---
+    # qemu-tests ships per-arch test binaries, qemu-iotests fixture images, and
+    # related artefacts that trip the automated package-signing pipeline's
+    # FS-aware deep scanner. The subpackage is test-only and not shipped in any
+    # Azure Linux image, so we drop it entirely.
+    #
+    # Implementation notes:
+    # * `%define testsdir` lives inside the removed `%package tests` block but
+    #   is referenced from `%install`; we re-hoist it via `%define` (lazy
+    #   expansion of `%{name}` / `%{_libdir}`) near the other top-of-spec
+    #   `%global` declarations so `%install` still expands cleanly.
+    # * The `%install` section still writes test artefacts under `%{testsdir}`
+    #   and builds `accel-qtest-*.so` plugins, so we rm them from the buildroot
+    #   after install to avoid "Installed (but unpackaged)" errors.
+    {
+        description = 'Hoist `%define testsdir` so %install expands correctly after %package tests is removed',
+        type = 'spec-search-replace',
+        regex = '^%global enable_werror 0$',
+        replacement = "%global enable_werror 0\n%define testsdir %{_libdir}/%{name}/tests-src",
+    },
+    {
+        description = 'Remove qemu-tests subpackage (test-only payload trips signing-pipeline deep scanner; not shipped in any Azure Linux image)',
+        type = 'spec-remove-subpackage',
+        package = 'tests',
+    },
+    {
+        description = 'Drop test artefacts from buildroot after install (paired with qemu-tests subpackage removal)',
+        type = 'spec-append-lines',
+        section = '%install',
+        lines = ['# Azure Linux: qemu-tests subpackage removed; drop its payload from buildroot.', 'rm -rf %{buildroot}%{testsdir}', 'rm -f %{buildroot}%{_libdir}/%{name}/accel-qtest-*.so'],
+    },
+]
diff --git a/base/comps/qemu/qemu.comp.toml b/base/comps/qemu/qemu.comp.toml
index 7ae7c2d2f0c..b767f03e9e0 100644
--- a/base/comps/qemu/qemu.comp.toml
+++ b/base/comps/qemu/qemu.comp.toml
@@ -1,99 +1 @@
 [components.qemu]
-
-# Disable features not needed in Azure Linux's Hyper-V/KVM environment, and strip
-# audio backends + sub-packages to avoid pulling in heavy sdk-tier dependencies.
-overlays = [
-    # --- Feature toggles ---
-    # Upstream enables Xen when %fedora is set (which it is on our builders), so force it off.
-    { description = "Disable Xen support - not needed for Azure Linux (Hyper-V/KVM only)", type = "spec-search-replace", regex = '^%global have_xen 1$', replacement = '%global have_xen 0' },
-    # brltty pulls in bluetooth, audio, and more runtime deps.
-    { description = "Disable Baum Braille device backend", type = "spec-search-replace", regex = '^%global have_brlapi 1$', replacement = '%global have_brlapi 0' },
-    # jack audio backend is enabled by default, but we disable it.
-    { description = "Disable JACK audio backend",          type = "spec-search-replace", regex = '^%global have_jack 1$',   replacement = '%global have_jack 0' },
-    # Disable spice support for remote display.
-    { description = "Disable SPICE support",               type = "spec-search-replace", regex = '^%global have_spice 1$',  replacement = '%global have_spice 0' },
-    # Disable D-Bus display server (and its audio module). Without this, qemu's meson unconditionally
-    # builds audio-dbus.so when have_dbus_display=1, which causes "Installed (but unpackaged)" errors
-    # since we strip the audio-dbus subpackage.
-    { description = "Disable D-Bus display server",        type = "spec-search-replace", regex = '^%global have_dbus_display 1$', replacement = '%global have_dbus_display 0' },
-
-    # --- Audio backend removal: configure flags ---
-    # Upstream lacks macros to disable these; we flip the flags and clear the driver list directly.
-    { description = "configure: disable-pipewire",         type = "spec-search-replace", section = "%build", regex = '--enable-pipewire \\',  replacement = '--disable-pipewire \' },
-    { description = "configure: disable pulseaudio",       type = "spec-search-replace", section = "%build", regex = '--enable-pa \\',        replacement = '--disable-pa \' },
-    { description = "configure: disable sdl",              type = "spec-search-replace", section = "%build", regex = '--enable-sdl \\',       replacement = '--disable-sdl \' },
-    { description = "configure: disable sdl-image",        type = "spec-search-replace", section = "%build", regex = '--enable-sdl-image \\', replacement = '--disable-sdl-image \' },
-    { description = "configure: disable alsa",             type = "spec-search-replace", section = "%build", regex = '--enable-alsa \\',      replacement = '--disable-alsa \' },
-    { description = "configure: disable oss",              type = "spec-search-replace", section = "%build", regex = '--enable-oss \\',       replacement = '--disable-oss \' },
-    { description = "configure: remove all audio drivers", type = "spec-search-replace", section = "%build", regex = '--audio-drv-list=.* \\', replacement = '--audio-drv-list= \' },
-
-    # --- Unhook audio Requires from qemu-system-* emulators ---
-    { description = "Empty requires_audio_pipewire macro", type = "spec-search-replace", regex = '%define requires_audio_pipewire .*', replacement = '%define requires_audio_pipewire %{nil}' },
-    { description = "Empty requires_audio_pa macro",       type = "spec-search-replace", regex = '%define requires_audio_pa .*',       replacement = '%define requires_audio_pa %{nil}' },
-    { description = "Empty requires_audio_sdl macro",      type = "spec-search-replace", regex = '%define requires_audio_sdl .*',      replacement = '%define requires_audio_sdl %{nil}' },
-    { description = "Empty requires_audio_alsa macro",     type = "spec-search-replace", regex = '%define requires_audio_alsa .*',     replacement = '%define requires_audio_alsa %{nil}' },
-    { description = "Empty requires_audio_dbus macro",     type = "spec-search-replace", regex = '%define requires_audio_dbus .*',     replacement = '%define requires_audio_dbus %{nil}' },
-    { description = "Empty requires_audio_oss macro",      type = "spec-search-replace", regex = '%define requires_audio_oss .*',      replacement = '%define requires_audio_oss %{nil}' },
-
-    # --- Unhook ui-sdl Requires from qemu-system-* emulators (configure --disable-sdl is set above) ---
-    { description = "Empty requires_ui_sdl macro",         type = "spec-search-replace", regex = '%define requires_ui_sdl .*',         replacement = '%define requires_ui_sdl %{nil}' },
-
-    # --- Remove audio sub-packages (no longer built) ---
-    # Remove qemu-audio-pipewire
-    { description = "Remove %package audio-pipewire",     type = "spec-remove-section", package = "audio-pipewire", section = "%package"     },
-    { description = "Remove %description audio-pipewire", type = "spec-remove-section", package = "audio-pipewire", section = "%description" },
-    { description = "Remove %files audio-pipewire",       type = "spec-remove-section", package = "audio-pipewire", section = "%files"       },
-
-    # Remove qemu-audio-pa
-    { description = "Remove %package audio-pa",           type = "spec-remove-section", package = "audio-pa",       section = "%package" },
-    { description = "Remove %description audio-pa",       type = "spec-remove-section", package = "audio-pa",       section = "%description" },
-    { description = "Remove %files audio-pa",             type = "spec-remove-section", package = "audio-pa",       section = "%files" },
-
-    # Remove qemu-audio-sdl
-    { description = "Remove %package audio-sdl",          type = "spec-remove-section", package = "audio-sdl",      section = "%package" },
-    { description = "Remove %description audio-sdl",      type = "spec-remove-section", package = "audio-sdl",      section = "%description" },
-    { description = "Remove %files audio-sdl",            type = "spec-remove-section", package = "audio-sdl",      section = "%files" },
-
-    # Remove qemu-audio-alsa
-    { description = "Remove %package audio-alsa",         type = "spec-remove-section", package = "audio-alsa",     section = "%package" },
-    { description = "Remove %description audio-alsa",     type = "spec-remove-section", package = "audio-alsa",     section = "%description" },
-    { description = "Remove %files audio-alsa",           type = "spec-remove-section", package = "audio-alsa",     section = "%files" },
-
-    # Remove qemu-audio-dbus
-    { description = "Remove %package audio-dbus",         type = "spec-remove-section", package = "audio-dbus",     section = "%package" },
-    { description = "Remove %description audio-dbus",     type = "spec-remove-section", package = "audio-dbus",     section = "%description" },
-    { description = "Remove %files audio-dbus",           type = "spec-remove-section", package = "audio-dbus",     section = "%files" },
-
-    # Remove qemu-audio-oss
-    { description = "Remove %package audio-oss",          type = "spec-remove-section", package = "audio-oss",      section = "%package" },
-    { description = "Remove %description audio-oss",      type = "spec-remove-section", package = "audio-oss",      section = "%description" },
-    { description = "Remove %files audio-oss",            type = "spec-remove-section", package = "audio-oss",      section = "%files" },
-
-    # Remove qemu-audio-jack
-    { description = "Remove %package audio-jack",         type = "spec-remove-section", package = "audio-jack",     section = "%package" },
-    { description = "Remove %description audio-jack",     type = "spec-remove-section", package = "audio-jack",     section = "%description" },
-    { description = "Remove %files audio-jack",           type = "spec-remove-section", package = "audio-jack",     section = "%files" },
-
-    # Remove SDL UI sub-package
-    { description = "Remove %package ui-sdl",             type = "spec-remove-section", package = "ui-sdl",         section = "%package" },
-    { description = "Remove %description ui-sdl",         type = "spec-remove-section", package = "ui-sdl",         section = "%description" },
-    { description = "Remove %files ui-sdl",               type = "spec-remove-section", package = "ui-sdl",         section = "%files" },
-
-    # --- Drop tests subpackage ---
-    # qemu-tests ships per-arch test binaries, qemu-iotests fixture images, and
-    # related artefacts that trip the automated package-signing pipeline's
-    # FS-aware deep scanner. The subpackage is test-only and not shipped in any
-    # Azure Linux image, so we drop it entirely.
-    #
-    # Implementation notes:
-    # * `%define testsdir` lives inside the removed `%package tests` block but
-    #   is referenced from `%install`; we re-hoist it via `%define` (lazy
-    #   expansion of `%{name}` / `%{_libdir}`) near the other top-of-spec
-    #   `%global` declarations so `%install` still expands cleanly.
-    # * The `%install` section still writes test artefacts under `%{testsdir}`
-    #   and builds `accel-qtest-*.so` plugins, so we rm them from the buildroot
-    #   after install to avoid "Installed (but unpackaged)" errors.
-    { description = "Hoist `%define testsdir` so %install expands correctly after %package tests is removed",                                                     type = "spec-search-replace",      regex = '^%global enable_werror 0$', replacement = "%global enable_werror 0\n%define testsdir %{_libdir}/%{name}/tests-src" },
-    { description = "Remove qemu-tests subpackage (test-only payload trips signing-pipeline deep scanner; not shipped in any Azure Linux image)",                  type = "spec-remove-subpackage",   package = "tests" },
-    { description = "Drop test artefacts from buildroot after install (paired with qemu-tests subpackage removal)",                                                type = "spec-append-lines",        section = "%install",                                lines = ["# Azure Linux: qemu-tests subpackage removed; drop its payload from buildroot.", "rm -rf %{buildroot}%{testsdir}", "rm -f %{buildroot}%{_libdir}/%{name}/accel-qtest-*.so"] },
-]
diff --git a/base/comps/qt6-qtmultimedia/overlays/0001-remove-gstreamer-plugins-bad.overlay.toml b/base/comps/qt6-qtmultimedia/overlays/0001-remove-gstreamer-plugins-bad.overlay.toml
new file mode 100644
index 00000000000..7b3d08bd378
--- /dev/null
+++ b/base/comps/qt6-qtmultimedia/overlays/0001-remove-gstreamer-plugins-bad.overlay.toml
@@ -0,0 +1,47 @@
+# gstreamer1-plugins-bad-free is not shipped in AZL4. Remove the BR to avoid
+# linking against libgstplay/libgstphotography (unresolved runtime deps that
+# break all transitive consumers up to libplasma).
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove gstreamer-plugins-bad BR — gstreamer1-plugins-bad-free not shipped in AZL"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(gstreamer-plugins-bad-%{gst})"
+
+# Without gstreamer-plugins-bad headers, the GStreamer media plugin
+# (libgstreamermediaplugin.so) is not built. Remove it from %files
+# along with the empty multimedia plugin directory.
+# Note: replacement leaves blank lines — the tool operates per-line and
+# cannot delete lines entirely. This is cosmetic only; RPM ignores blanks
+# in %files.
+[[overlays]]
+description = "Remove empty multimedia plugin dir from %files — no plugins install here (gst-bad disabled, ffmpeg gated by bcond), so %dir would fail the build"
+type = "spec-search-replace"
+section = "%files"
+regex = "^%dir %\\{_qt6_plugindir\\}/multimedia$"
+replacement = ""
+
+[[overlays]]
+description = "Remove libgstreamermediaplugin.so from %files (not built without gstreamer-plugins-bad)"
+type = "spec-search-replace"
+section = "%files"
+regex = "^%\\{_qt6_plugindir\\}/multimedia/libgstreamermediaplugin\\.so$"
+replacement = ""
+
+# Dropping the gstreamer-plugins-bad BR also stops the GStreamer media plugin
+# devel artifacts (QtGstreamerMediaPluginImpl headers/.a/.prl/cmake) from being
+# built. The runtime %files entries were removed above, but the matching
+# %files devel entries were missed, so qt6-qtmultimedia-devel packaging fails
+# with "File/Directory not found". A single line-based regex drops every devel
+# %files entry that references QtGstreamerMediaPluginImpl (headers, .a, .prl,
+# the cmake %dir, and the cmake glob).
+[[overlays]]
+description = "Remove all QtGstreamerMediaPluginImpl devel %files entries (not built without gstreamer-plugins-bad)"
+type = "spec-search-replace"
+section = "%files"
+package = "devel"
+regex = "^.*GstreamerMediaPluginImpl.*$"
+replacement = ""
diff --git a/base/comps/qt6-qtmultimedia/qt6-qtmultimedia.comp.toml b/base/comps/qt6-qtmultimedia/qt6-qtmultimedia.comp.toml
index ab6553dd1d3..b9451f70348 100644
--- a/base/comps/qt6-qtmultimedia/qt6-qtmultimedia.comp.toml
+++ b/base/comps/qt6-qtmultimedia/qt6-qtmultimedia.comp.toml
@@ -7,47 +7,3 @@
 # Part of the distro-wide effort to remove ffmpeg/libav* from Azure Linux.
 [components.qt6-qtmultimedia]
 build.without = ["ffmpeg"]
-
-# gstreamer1-plugins-bad-free is not shipped in AZL4. Remove the BR to avoid
-# linking against libgstplay/libgstphotography (unresolved runtime deps that
-# break all transitive consumers up to libplasma).
-[[components.qt6-qtmultimedia.overlays]]
-description = "Remove gstreamer-plugins-bad BR — gstreamer1-plugins-bad-free not shipped in AZL"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(gstreamer-plugins-bad-%{gst})"
-
-# Without gstreamer-plugins-bad headers, the GStreamer media plugin
-# (libgstreamermediaplugin.so) is not built. Remove it from %files
-# along with the empty multimedia plugin directory.
-# Note: replacement leaves blank lines — the tool operates per-line and
-# cannot delete lines entirely. This is cosmetic only; RPM ignores blanks
-# in %files.
-[[components.qt6-qtmultimedia.overlays]]
-description = "Remove empty multimedia plugin dir from %files — no plugins install here (gst-bad disabled, ffmpeg gated by bcond), so %dir would fail the build"
-type = "spec-search-replace"
-section = "%files"
-regex = '^%dir %\{_qt6_plugindir\}/multimedia$'
-replacement = ''
-
-[[components.qt6-qtmultimedia.overlays]]
-description = "Remove libgstreamermediaplugin.so from %files (not built without gstreamer-plugins-bad)"
-type = "spec-search-replace"
-section = "%files"
-regex = '^%\{_qt6_plugindir\}/multimedia/libgstreamermediaplugin\.so$'
-replacement = ''
-
-# Dropping the gstreamer-plugins-bad BR also stops the GStreamer media plugin
-# devel artifacts (QtGstreamerMediaPluginImpl headers/.a/.prl/cmake) from being
-# built. The runtime %files entries were removed above, but the matching
-# %files devel entries were missed, so qt6-qtmultimedia-devel packaging fails
-# with "File/Directory not found". A single line-based regex drops every devel
-# %files entry that references QtGstreamerMediaPluginImpl (headers, .a, .prl,
-# the cmake %dir, and the cmake glob).
-[[components.qt6-qtmultimedia.overlays]]
-description = "Remove all QtGstreamerMediaPluginImpl devel %files entries (not built without gstreamer-plugins-bad)"
-type = "spec-search-replace"
-section = "%files"
-package = "devel"
-regex = '^.*GstreamerMediaPluginImpl.*$'
-replacement = ''
diff --git a/base/comps/qt6/overlays/0001-clear-qt6-qtwebengine-arches.overlay.toml b/base/comps/qt6/overlays/0001-clear-qt6-qtwebengine-arches.overlay.toml
new file mode 100644
index 00000000000..e7914847c9e
--- /dev/null
+++ b/base/comps/qt6/overlays/0001-clear-qt6-qtwebengine-arches.overlay.toml
@@ -0,0 +1,19 @@
+# Override the qt6_qtwebengine_arches macro to a non-existent architecture so
+# that dependent packages (gpsbabel, libksysguard, python-pyside6, python-pyqt6,
+# qt6-qtwebview) skip their qtwebengine-related code paths, breaking the
+# dependency on qt6-qtwebengine which has pre-existing build failures on AZL.
+#
+# qt6_qtwebengine_arches is a list of supported architectures. To avoid match
+# fail if it changes upstream, we match a word followed by anything.
+# Note: %{nil} cannot be used as the macro value because %ifarch requires at
+# least one argument.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Clear qt6_qtwebengine_arches macro to disable qtwebengine across dependent packages"
+type = "file-search-replace"
+file = "macros.qt6-srpm"
+regex = "%qt6_qtwebengine_arches \\w+\\b.*"
+replacement = "%qt6_qtwebengine_arches no_qtwebengine_support"
diff --git a/base/comps/qt6/qt6.comp.toml b/base/comps/qt6/qt6.comp.toml
index 170d2e726c4..90e57fae42b 100644
--- a/base/comps/qt6/qt6.comp.toml
+++ b/base/comps/qt6/qt6.comp.toml
@@ -1,17 +1 @@
 [components.qt6]
-
-# Override the qt6_qtwebengine_arches macro to a non-existent architecture so
-# that dependent packages (gpsbabel, libksysguard, python-pyside6, python-pyqt6,
-# qt6-qtwebview) skip their qtwebengine-related code paths, breaking the
-# dependency on qt6-qtwebengine which has pre-existing build failures on AZL.
-#
-# qt6_qtwebengine_arches is a list of supported architectures. To avoid match
-# fail if it changes upstream, we match a word followed by anything.
-# Note: %{nil} cannot be used as the macro value because %ifarch requires at
-# least one argument.
-[[components.qt6.overlays]]
-description = "Clear qt6_qtwebengine_arches macro to disable qtwebengine across dependent packages"
-type = "file-search-replace"
-file = "macros.qt6-srpm"
-regex = '%qt6_qtwebengine_arches \w+\b.*'
-replacement = '%qt6_qtwebengine_arches no_qtwebengine_support'
diff --git a/base/comps/resteasy/overlays/0001-remove-buildrequires-maven-local.overlay.toml b/base/comps/resteasy/overlays/0001-remove-buildrequires-maven-local.overlay.toml
new file mode 100644
index 00000000000..fecd5676791
--- /dev/null
+++ b/base/comps/resteasy/overlays/0001-remove-buildrequires-maven-local.overlay.toml
@@ -0,0 +1,18 @@
+# AZL ships only java-25-openjdk; there is no java-21-openjdk, so the
+# upstream BuildRequires on maven-local-openjdk21 is unsatisfiable.
+# Retarget to the openjdk25 variant.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove BuildRequires on maven-local-openjdk21 — AZL does not ship java-21-openjdk"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "maven-local-openjdk21"
+
+[[overlays]]
+description = "Add BuildRequires on maven-local-openjdk25 in place of maven-local-openjdk21"
+type = "spec-add-tag"
+tag = "BuildRequires"
+value = "maven-local-openjdk25"
diff --git a/base/comps/resteasy/resteasy.comp.toml b/base/comps/resteasy/resteasy.comp.toml
index a9c5c575cdf..1adda5733dd 100644
--- a/base/comps/resteasy/resteasy.comp.toml
+++ b/base/comps/resteasy/resteasy.comp.toml
@@ -1,16 +1 @@
 [components.resteasy]
-
-# AZL ships only java-25-openjdk; there is no java-21-openjdk, so the
-# upstream BuildRequires on maven-local-openjdk21 is unsatisfiable.
-# Retarget to the openjdk25 variant.
-[[components.resteasy.overlays]]
-description = "Remove BuildRequires on maven-local-openjdk21 — AZL does not ship java-21-openjdk"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "maven-local-openjdk21"
-
-[[components.resteasy.overlays]]
-description = "Add BuildRequires on maven-local-openjdk25 in place of maven-local-openjdk21"
-type = "spec-add-tag"
-tag = "BuildRequires"
-value = "maven-local-openjdk25"
diff --git a/base/comps/rubygem-actionpack/overlays/0001-remove-chromedriver-chromium-buildrequires.overlay.toml b/base/comps/rubygem-actionpack/overlays/0001-remove-chromedriver-chromium-buildrequires.overlay.toml
new file mode 100644
index 00000000000..9f59ee84c07
--- /dev/null
+++ b/base/comps/rubygem-actionpack/overlays/0001-remove-chromedriver-chromium-buildrequires.overlay.toml
@@ -0,0 +1,15 @@
+# Chromium/chromedriver are not packaged in Azure Linux. They are only used by
+# the %check test suite. Despite the `:remote` option set in abstract_unit.rb,
+# every test in test/dispatch/system_testing/ instantiates Selenium drivers
+# eagerly and fails without chromedriver. Disable that entire directory; the
+# rest of the actionpack test suite still runs.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove chromedriver/chromium BuildRequires - not packaged in Azure Linux"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "chromedriver chromium chromium-headless"
diff --git a/base/comps/rubygem-actionpack/overlays/0002-disable-system-testing-tests.overlay.toml b/base/comps/rubygem-actionpack/overlays/0002-disable-system-testing-tests.overlay.toml
new file mode 100644
index 00000000000..fed6d73bdb6
--- /dev/null
+++ b/base/comps/rubygem-actionpack/overlays/0002-disable-system-testing-tests.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-disable-unsupported-tests"
+upstreamable = false
+
+[[overlays]]
+description = "Disable system_testing tests - all instantiate chrome drivers and fail without chromedriver"
+type = "spec-search-replace"
+regex = "# Tests need to run in isolation"
+replacement = "# Azure Linux: no chromedriver available, so skip all system_testing tests\n# (driver_test.rb, system_test_case_test.rb, screenshot_helper_test.rb,\n# server_test.rb all instantiate Selenium drivers).\nrm -rf test/dispatch/system_testing\n\n# Tests need to run in isolation"
diff --git a/base/comps/rubygem-actionpack/rubygem-actionpack.comp.toml b/base/comps/rubygem-actionpack/rubygem-actionpack.comp.toml
index 946b9a1b358..6b3c39ffd70 100644
--- a/base/comps/rubygem-actionpack/rubygem-actionpack.comp.toml
+++ b/base/comps/rubygem-actionpack/rubygem-actionpack.comp.toml
@@ -1,23 +1 @@
 [components.rubygem-actionpack]
-
-# Chromium/chromedriver are not packaged in Azure Linux. They are only used by
-# the %check test suite. Despite the `:remote` option set in abstract_unit.rb,
-# every test in test/dispatch/system_testing/ instantiates Selenium drivers
-# eagerly and fails without chromedriver. Disable that entire directory; the
-# rest of the actionpack test suite still runs.
-[[components.rubygem-actionpack.overlays]]
-description = "Remove chromedriver/chromium BuildRequires - not packaged in Azure Linux"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "chromedriver chromium chromium-headless"
-
-[[components.rubygem-actionpack.overlays]]
-description = "Disable system_testing tests - all instantiate chrome drivers and fail without chromedriver"
-type = "spec-search-replace"
-regex = "# Tests need to run in isolation"
-replacement = """# Azure Linux: no chromedriver available, so skip all system_testing tests
-# (driver_test.rb, system_test_case_test.rb, screenshot_helper_test.rb,
-# server_test.rb all instantiate Selenium drivers).
-rm -rf test/dispatch/system_testing
-
-# Tests need to run in isolation"""
diff --git a/base/comps/rubygem-activestorage/overlays/0001-drop-buildrequires-bindir-ffmpeg.overlay.toml b/base/comps/rubygem-activestorage/overlays/0001-drop-buildrequires-bindir-ffmpeg.overlay.toml
new file mode 100644
index 00000000000..f981a25b200
--- /dev/null
+++ b/base/comps/rubygem-activestorage/overlays/0001-drop-buildrequires-bindir-ffmpeg.overlay.toml
@@ -0,0 +1,27 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop BuildRequires on %{_bindir}/ffmpeg — removing ffmpeg from the distro"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "%{_bindir}/ffmpeg"
+
+[[overlays]]
+description = "Drop BuildRequires on %{_bindir}/ffprobe — removing ffmpeg from the distro"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "%{_bindir}/ffprobe"
+
+[[overlays]]
+description = "Drop Suggests on %{_bindir}/ffmpeg — removing ffmpeg from the distro"
+type = "spec-remove-tag"
+tag = "Suggests"
+value = "%{_bindir}/ffmpeg"
+
+[[overlays]]
+description = "Drop Suggests on %{_bindir}/ffprobe — removing ffmpeg from the distro"
+type = "spec-remove-tag"
+tag = "Suggests"
+value = "%{_bindir}/ffprobe"
diff --git a/base/comps/rubygem-activestorage/overlays/0002-skip-audio-video-analyzer.overlay.toml b/base/comps/rubygem-activestorage/overlays/0002-skip-audio-video-analyzer.overlay.toml
new file mode 100644
index 00000000000..bc8eca96a5c
--- /dev/null
+++ b/base/comps/rubygem-activestorage/overlays/0002-skip-audio-video-analyzer.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-disable-unsupported-tests"
+upstreamable = false
+
+[[overlays]]
+description = "Skip audio/video analyzer/previewer tests — they shell out to ffmpeg/ffprobe, which are no longer available"
+type = "spec-search-replace"
+regex = "^bundle exec ruby "
+replacement = "rm -f test/analyzer/audio_analyzer_test.rb test/analyzer/video_analyzer_test.rb test/previewer/video_previewer_test.rb\nbundle exec ruby "
diff --git a/base/comps/rubygem-activestorage/rubygem-activestorage.comp.toml b/base/comps/rubygem-activestorage/rubygem-activestorage.comp.toml
index 900ac323df5..180b2503abf 100644
--- a/base/comps/rubygem-activestorage/rubygem-activestorage.comp.toml
+++ b/base/comps/rubygem-activestorage/rubygem-activestorage.comp.toml
@@ -5,32 +5,3 @@
 # video previews would have had to install ffmpeg explicitly anyway.
 [components.rubygem-activestorage]
 
-[[components.rubygem-activestorage.overlays]]
-description = "Drop BuildRequires on %{_bindir}/ffmpeg — removing ffmpeg from the distro"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "%{_bindir}/ffmpeg"
-
-[[components.rubygem-activestorage.overlays]]
-description = "Drop BuildRequires on %{_bindir}/ffprobe — removing ffmpeg from the distro"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "%{_bindir}/ffprobe"
-
-[[components.rubygem-activestorage.overlays]]
-description = "Drop Suggests on %{_bindir}/ffmpeg — removing ffmpeg from the distro"
-type = "spec-remove-tag"
-tag = "Suggests"
-value = "%{_bindir}/ffmpeg"
-
-[[components.rubygem-activestorage.overlays]]
-description = "Drop Suggests on %{_bindir}/ffprobe — removing ffmpeg from the distro"
-type = "spec-remove-tag"
-tag = "Suggests"
-value = "%{_bindir}/ffprobe"
-
-[[components.rubygem-activestorage.overlays]]
-description = "Skip audio/video analyzer/previewer tests — they shell out to ffmpeg/ffprobe, which are no longer available"
-type = "spec-search-replace"
-regex = '^bundle exec ruby '
-replacement = "rm -f test/analyzer/audio_analyzer_test.rb test/analyzer/video_analyzer_test.rb test/previewer/video_previewer_test.rb\nbundle exec ruby "
diff --git a/base/comps/rubygem-railties/overlays/0001-remove-chromedriver-chromium-buildrequires.overlay.toml b/base/comps/rubygem-railties/overlays/0001-remove-chromedriver-chromium-buildrequires.overlay.toml
new file mode 100644
index 00000000000..3067940537c
--- /dev/null
+++ b/base/comps/rubygem-railties/overlays/0001-remove-chromedriver-chromium-buildrequires.overlay.toml
@@ -0,0 +1,18 @@
+# Chromium/chromedriver are not available in Azure Linux;
+# selenium-webdriver depends on chromedriver at runtime, so the whole
+# browser-testing stack must be removed.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove chromedriver/chromium BuildRequires - not available in Azure Linux"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "chromedriver chromium chromium-headless"
+
+[[overlays]]
+description = "Remove selenium-webdriver BuildRequires - depends on chromedriver which is unavailable"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "rubygem(selenium-webdriver)"
diff --git a/base/comps/rubygem-railties/overlays/0002-remove-selenium-webdriver-test.overlay.toml b/base/comps/rubygem-railties/overlays/0002-remove-selenium-webdriver-test.overlay.toml
new file mode 100644
index 00000000000..81b51ed2dde
--- /dev/null
+++ b/base/comps/rubygem-railties/overlays/0002-remove-selenium-webdriver-test.overlay.toml
@@ -0,0 +1,15 @@
+[metadata]
+category = "azl-disable-unsupported-tests"
+upstreamable = false
+
+[[overlays]]
+description = "Remove selenium-webdriver from test Gemfile - no chromedriver available"
+type = "spec-search-replace"
+regex = "echo.*selenium-webdriver.*Gemfile"
+replacement = "# selenium-webdriver removed - no chromedriver in Azure Linux"
+
+[[overlays]]
+description = "Disable tests incompatible with Azure Linux (selenium-webdriver/chromedriver unavailable; sprockets digest flake)"
+type = "spec-search-replace"
+regex = "mv test/application/active_storage/uploads_integration_test.rb.,.disable."
+replacement = "mv test/application/active_storage/uploads_integration_test.rb{,.disable}\nmv test/application/active_job_adapter_test.rb{,.disable}\nmv test/application/system_test_case_test.rb{,.disable}\nmv test/application/test_runner_test.rb{,.disable}\nmv test/application/sprockets_assets_test.rb{,.disable}"
diff --git a/base/comps/rubygem-railties/rubygem-railties.comp.toml b/base/comps/rubygem-railties/rubygem-railties.comp.toml
index f83ba0468fa..932527bac5d 100644
--- a/base/comps/rubygem-railties/rubygem-railties.comp.toml
+++ b/base/comps/rubygem-railties/rubygem-railties.comp.toml
@@ -1,32 +1 @@
 [components.rubygem-railties]
-
-# Chromium/chromedriver are not available in Azure Linux;
-# selenium-webdriver depends on chromedriver at runtime, so the whole
-# browser-testing stack must be removed.
-[[components.rubygem-railties.overlays]]
-description = "Remove chromedriver/chromium BuildRequires - not available in Azure Linux"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "chromedriver chromium chromium-headless"
-
-[[components.rubygem-railties.overlays]]
-description = "Remove selenium-webdriver BuildRequires - depends on chromedriver which is unavailable"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "rubygem(selenium-webdriver)"
-
-[[components.rubygem-railties.overlays]]
-description = "Remove selenium-webdriver from test Gemfile - no chromedriver available"
-type = "spec-search-replace"
-regex = "echo.*selenium-webdriver.*Gemfile"
-replacement = "# selenium-webdriver removed - no chromedriver in Azure Linux"
-
-[[components.rubygem-railties.overlays]]
-description = "Disable tests incompatible with Azure Linux (selenium-webdriver/chromedriver unavailable; sprockets digest flake)"
-type = "spec-search-replace"
-regex = "mv test/application/active_storage/uploads_integration_test.rb.,.disable."
-replacement = """mv test/application/active_storage/uploads_integration_test.rb{,.disable}
-mv test/application/active_job_adapter_test.rb{,.disable}
-mv test/application/system_test_case_test.rb{,.disable}
-mv test/application/test_runner_test.rb{,.disable}
-mv test/application/sprockets_assets_test.rb{,.disable}"""
diff --git a/base/comps/rubygem-selenium-webdriver/overlays/0001-remove-chromedriver-buildrequires-packaged.overlay.toml b/base/comps/rubygem-selenium-webdriver/overlays/0001-remove-chromedriver-buildrequires-packaged.overlay.toml
new file mode 100644
index 00000000000..089f0462af9
--- /dev/null
+++ b/base/comps/rubygem-selenium-webdriver/overlays/0001-remove-chromedriver-buildrequires-packaged.overlay.toml
@@ -0,0 +1,22 @@
+# Chromium and chromedriver are not packaged in Azure Linux. They are only
+# referenced from the spec_integration test suite (gated by `%bcond_without
+# spec_integration`) and as runtime `Recommends:` (weak deps, harmless if
+# absent). The %check section is already disabled distro-wide via
+# component-check-disablement.toml, so dropping these BuildRequires is purely a
+# dependency-resolution change with no behavioral impact.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove chromedriver BuildRequires - not packaged in Azure Linux"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "chromedriver"
+
+[[overlays]]
+description = "Remove chromium/chromium-headless BuildRequires - not packaged in Azure Linux"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "chromium chromium-headless"
diff --git a/base/comps/rubygem-selenium-webdriver/rubygem-selenium-webdriver.comp.toml b/base/comps/rubygem-selenium-webdriver/rubygem-selenium-webdriver.comp.toml
index 626d434aef4..1255114e727 100644
--- a/base/comps/rubygem-selenium-webdriver/rubygem-selenium-webdriver.comp.toml
+++ b/base/comps/rubygem-selenium-webdriver/rubygem-selenium-webdriver.comp.toml
@@ -1,19 +1 @@
 [components.rubygem-selenium-webdriver]
-
-# Chromium and chromedriver are not packaged in Azure Linux. They are only
-# referenced from the spec_integration test suite (gated by `%bcond_without
-# spec_integration`) and as runtime `Recommends:` (weak deps, harmless if
-# absent). The %check section is already disabled distro-wide via
-# component-check-disablement.toml, so dropping these BuildRequires is purely a
-# dependency-resolution change with no behavioral impact.
-[[components.rubygem-selenium-webdriver.overlays]]
-description = "Remove chromedriver BuildRequires - not packaged in Azure Linux"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "chromedriver"
-
-[[components.rubygem-selenium-webdriver.overlays]]
-description = "Remove chromium/chromium-headless BuildRequires - not packaged in Azure Linux"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "chromium chromium-headless"
diff --git a/base/comps/rust-vm-memory/overlays/0001-remove-package-xen-devel.overlay.toml b/base/comps/rust-vm-memory/overlays/0001-remove-package-xen-devel.overlay.toml
new file mode 100644
index 00000000000..ad4964d25b7
--- /dev/null
+++ b/base/comps/rust-vm-memory/overlays/0001-remove-package-xen-devel.overlay.toml
@@ -0,0 +1,23 @@
+# Remove the +xen feature subpackage — Xen is not applicable to Azure Linux.
+
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove %package +xen-devel section"
+type = "spec-remove-section"
+section = "%package"
+package = "%{name}+xen-devel"
+
+[[overlays]]
+description = "Remove %description +xen-devel section"
+type = "spec-remove-section"
+section = "%description"
+package = "%{name}+xen-devel"
+
+[[overlays]]
+description = "Remove %files +xen-devel section"
+type = "spec-remove-section"
+section = "%files"
+package = "%{name}+xen-devel"
diff --git a/base/comps/rust-vm-memory/rust-vm-memory.comp.toml b/base/comps/rust-vm-memory/rust-vm-memory.comp.toml
index 688655fb08b..1d83764b0f5 100644
--- a/base/comps/rust-vm-memory/rust-vm-memory.comp.toml
+++ b/base/comps/rust-vm-memory/rust-vm-memory.comp.toml
@@ -1,20 +1 @@
 [components.rust-vm-memory]
-
-# Remove the +xen feature subpackage — Xen is not applicable to Azure Linux.
-[[components.rust-vm-memory.overlays]]
-description = "Remove %package +xen-devel section"
-type = "spec-remove-section"
-section = "%package"
-package = "%{name}+xen-devel"
-
-[[components.rust-vm-memory.overlays]]
-description = "Remove %description +xen-devel section"
-type = "spec-remove-section"
-section = "%description"
-package = "%{name}+xen-devel"
-
-[[components.rust-vm-memory.overlays]]
-description = "Remove %files +xen-devel section"
-type = "spec-remove-section"
-section = "%files"
-package = "%{name}+xen-devel"
diff --git a/base/comps/sblim-cmpi-base/overlays/0001-disable-test-sub-package.overlay.toml b/base/comps/sblim-cmpi-base/overlays/0001-disable-test-sub-package.overlay.toml
new file mode 100644
index 00000000000..f6f082b8a77
--- /dev/null
+++ b/base/comps/sblim-cmpi-base/overlays/0001-disable-test-sub-package.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Disable test sub-package - sblim-testsuite is sdk-tier in AZL"
+type = "spec-search-replace"
+regex = "^%global with_test_subpackage 1$"
+replacement = "%global with_test_subpackage 0"
diff --git a/base/comps/sblim-cmpi-base/sblim-cmpi-base.comp.toml b/base/comps/sblim-cmpi-base/sblim-cmpi-base.comp.toml
index fd208b4906a..880c3e361de 100644
--- a/base/comps/sblim-cmpi-base/sblim-cmpi-base.comp.toml
+++ b/base/comps/sblim-cmpi-base/sblim-cmpi-base.comp.toml
@@ -8,8 +8,3 @@
 # sblim-testsuite Requires.
 [components.sblim-cmpi-base]
 
-[[components.sblim-cmpi-base.overlays]]
-description = "Disable test sub-package - sblim-testsuite is sdk-tier in AZL"
-type = "spec-search-replace"
-regex = '^%global with_test_subpackage 1$'
-replacement = '%global with_test_subpackage 0'
diff --git a/base/comps/spice-gtk/overlays/0001-remove-opus-devel-buildrequires.overlay.toml b/base/comps/spice-gtk/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..e6da3b7c8c2
--- /dev/null
+++ b/base/comps/spice-gtk/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
@@ -0,0 +1,17 @@
+# AZL does not ship opus — disable opus in the meson build.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove opus-devel BuildRequires (opus not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "opus-devel"
+
+[[overlays]]
+description = "Disable opus audio codec in meson build"
+type = "spec-search-replace"
+section = "%build"
+regex = "%meson \\\\"
+replacement = "%meson \\\n   -Dopus=disabled \\"
diff --git a/base/comps/spice-gtk/spice-gtk.comp.toml b/base/comps/spice-gtk/spice-gtk.comp.toml
index 0387184ea14..55ba8ee89c5 100644
--- a/base/comps/spice-gtk/spice-gtk.comp.toml
+++ b/base/comps/spice-gtk/spice-gtk.comp.toml
@@ -1,17 +1 @@
 [components.spice-gtk]
-
-# AZL does not ship opus — disable opus in the meson build.
-
-[[components.spice-gtk.overlays]]
-description = "Remove opus-devel BuildRequires (opus not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "opus-devel"
-
-[[components.spice-gtk.overlays]]
-description = "Disable opus audio codec in meson build"
-type = "spec-search-replace"
-section = "%build"
-regex = '%meson \\'
-replacement = """%meson \\
-   -Dopus=disabled \\"""
diff --git a/base/comps/spice/overlays/0001-remove-opus-devel-buildrequires.overlay.toml b/base/comps/spice/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..477e0521c23
--- /dev/null
+++ b/base/comps/spice/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
@@ -0,0 +1,17 @@
+# AZL does not ship opus — disable opus in the meson build.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove opus-devel BuildRequires (opus not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "opus-devel"
+
+[[overlays]]
+description = "Disable opus in meson build"
+type = "spec-search-replace"
+section = "%build"
+regex = "-Dopus=enabled"
+replacement = "-Dopus=disabled"
diff --git a/base/comps/spice/spice.comp.toml b/base/comps/spice/spice.comp.toml
index 39528702be0..7e90f61db2a 100644
--- a/base/comps/spice/spice.comp.toml
+++ b/base/comps/spice/spice.comp.toml
@@ -1,16 +1 @@
 [components.spice]
-
-# AZL does not ship opus — disable opus in the meson build.
-
-[[components.spice.overlays]]
-description = "Remove opus-devel BuildRequires (opus not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "opus-devel"
-
-[[components.spice.overlays]]
-description = "Disable opus in meson build"
-type = "spec-search-replace"
-section = "%build"
-regex = '-Dopus=enabled'
-replacement = '-Dopus=disabled'
diff --git a/base/comps/syslinux/overlays/0001-bump-release-0-33.overlay.toml b/base/comps/syslinux/overlays/0001-bump-release-0-33.overlay.toml
new file mode 100644
index 00000000000..2a1c5282d77
--- /dev/null
+++ b/base/comps/syslinux/overlays/0001-bump-release-0-33.overlay.toml
@@ -0,0 +1,19 @@
+# Azure Linux does not ship mingw cross-compilation toolchains.
+# The mingw-gcc BuildRequires are used to cross-compile syslinux.exe/syslinux64.exe
+# (Windows tools for installing syslinux from Windows), which are not needed on AZL.
+
+# Bump upstream Release 0.33 → 0.34 to force a rebuild that picks up the
+# mingw-disabling overlays below. Without this, the previously-published SRPM
+# (built before the overlays landed) would continue to advertise mingw
+# BuildRequires and break build-dep closure for the AZL repo. Drop this
+# overlay the next time the upstream Release bumps past 0.33.
+
+[metadata]
+category = "azl-release-management"
+upstreamable = false
+
+[[overlays]]
+description = "Bump Release 0.33 → 0.34 to force a rebuild that drops stale mingw BRs"
+type = "spec-search-replace"
+regex = "^Release: 0\\.33%\\{\\?dist\\}$"
+replacement = "Release: 0.34%{?dist}"
diff --git a/base/comps/syslinux/overlays/0002-remove-mingw32-gcc-buildrequires.overlay.toml b/base/comps/syslinux/overlays/0002-remove-mingw32-gcc-buildrequires.overlay.toml
new file mode 100644
index 00000000000..d9d3c9e498a
--- /dev/null
+++ b/base/comps/syslinux/overlays/0002-remove-mingw32-gcc-buildrequires.overlay.toml
@@ -0,0 +1,44 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove mingw32-gcc BuildRequires (ix86) — Azure Linux does not ship mingw toolchains"
+type = "spec-search-replace"
+regex = "^BuildRequires: mingw32-gcc$"
+replacement = ""
+
+[[overlays]]
+description = "Remove mingw32-gcc mingw64-gcc BuildRequires (x86_64)"
+type = "spec-search-replace"
+regex = "^BuildRequires: mingw32-gcc mingw64-gcc$"
+replacement = ""
+
+[[overlays]]
+description = "Remove syslinux.exe from main package files (ix86)"
+type = "spec-search-replace"
+section = "%files"
+regex = "^%\\{_datadir\\}/syslinux/syslinux\\.exe$"
+replacement = ""
+
+[[overlays]]
+description = "Remove syslinux64.exe from main package files (x86_64)"
+type = "spec-search-replace"
+section = "%files"
+regex = "^%\\{_datadir\\}/syslinux/syslinux64\\.exe$"
+replacement = ""
+
+[[overlays]]
+description = "Remove *.exe glob from nonlinux subpackage files"
+type = "spec-search-replace"
+section = "%files"
+package = "nonlinux"
+regex = "^%\\{_datadir\\}/syslinux/\\*\\.exe$"
+replacement = ""
+
+[[overlays]]
+description = "Remove *.exe exclude for non-x86_64"
+type = "spec-search-replace"
+section = "%files"
+regex = "^%exclude %\\{_datadir\\}/syslinux/\\*\\.exe$"
+replacement = ""
diff --git a/base/comps/syslinux/syslinux.comp.toml b/base/comps/syslinux/syslinux.comp.toml
index 0f16991413a..2ecc80d8095 100644
--- a/base/comps/syslinux/syslinux.comp.toml
+++ b/base/comps/syslinux/syslinux.comp.toml
@@ -1,59 +1,3 @@
 [components.syslinux]
 # Release: 0.34%{?dist}
 release = { calculation = "manual" }
-
-# Azure Linux does not ship mingw cross-compilation toolchains.
-# The mingw-gcc BuildRequires are used to cross-compile syslinux.exe/syslinux64.exe
-# (Windows tools for installing syslinux from Windows), which are not needed on AZL.
-
-# Bump upstream Release 0.33 → 0.34 to force a rebuild that picks up the
-# mingw-disabling overlays below. Without this, the previously-published SRPM
-# (built before the overlays landed) would continue to advertise mingw
-# BuildRequires and break build-dep closure for the AZL repo. Drop this
-# overlay the next time the upstream Release bumps past 0.33.
-[[components.syslinux.overlays]]
-description = "Bump Release 0.33 → 0.34 to force a rebuild that drops stale mingw BRs"
-type = "spec-search-replace"
-regex = '^Release: 0\.33%\{\?dist\}$'
-replacement = 'Release: 0.34%{?dist}'
-
-[[components.syslinux.overlays]]
-description = "Remove mingw32-gcc BuildRequires (ix86) — Azure Linux does not ship mingw toolchains"
-type = "spec-search-replace"
-regex = '^BuildRequires: mingw32-gcc$'
-replacement = ''
-
-[[components.syslinux.overlays]]
-description = "Remove mingw32-gcc mingw64-gcc BuildRequires (x86_64)"
-type = "spec-search-replace"
-regex = '^BuildRequires: mingw32-gcc mingw64-gcc$'
-replacement = ''
-
-[[components.syslinux.overlays]]
-description = "Remove syslinux.exe from main package files (ix86)"
-type = "spec-search-replace"
-section = "%files"
-regex = '^%\{_datadir\}/syslinux/syslinux\.exe$'
-replacement = ''
-
-[[components.syslinux.overlays]]
-description = "Remove syslinux64.exe from main package files (x86_64)"
-type = "spec-search-replace"
-section = "%files"
-regex = '^%\{_datadir\}/syslinux/syslinux64\.exe$'
-replacement = ''
-
-[[components.syslinux.overlays]]
-description = "Remove *.exe glob from nonlinux subpackage files"
-type = "spec-search-replace"
-section = "%files"
-package = "nonlinux"
-regex = '^%\{_datadir\}/syslinux/\*\.exe$'
-replacement = ''
-
-[[components.syslinux.overlays]]
-description = "Remove *.exe exclude for non-x86_64"
-type = "spec-search-replace"
-section = "%files"
-regex = '^%exclude %\{_datadir\}/syslinux/\*\.exe$'
-replacement = ''
diff --git a/base/comps/systemd/overlays/0001-lower-buildrequires-setup-2.overlay.toml b/base/comps/systemd/overlays/0001-lower-buildrequires-setup-2.overlay.toml
new file mode 100644
index 00000000000..31cbb37b8ee
--- /dev/null
+++ b/base/comps/systemd/overlays/0001-lower-buildrequires-setup-2.overlay.toml
@@ -0,0 +1,19 @@
+# AZL's setup package is 2.15.0-1, but upstream Fedora 41+ systemd requires >= 2.15.0-3.
+# Lower the version threshold to match what's available in AZL.
+# Ref: https://src.fedoraproject.org/rpms/setup/commits/rawhide (2.15.0-3 added /usr/lib/sysusers.d ownership)
+
+[metadata]
+category = "azl-dep-missing-workaround"
+upstreamable = false
+
+[[overlays]]
+description = "Lower BuildRequires on setup from 2.15.0-3 to 2.15.0-1 to match AZL's available version"
+type = "spec-search-replace"
+regex = "^BuildRequires:\\s+setup >= 2\\.15\\.0-3$"
+replacement = "BuildRequires:  setup >= 2.15.0-1"
+
+[[overlays]]
+description = "Lower Conflicts on setup from 2.15.0-3 to 2.15.0-1 to match AZL's available version"
+type = "spec-search-replace"
+regex = "^Conflicts:\\s+setup < 2\\.15\\.0-3$"
+replacement = "Conflicts:      setup < 2.15.0-1"
diff --git a/base/comps/systemd/overlays/0002-remove-xen-devel-buildrequires.overlay.toml b/base/comps/systemd/overlays/0002-remove-xen-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..a94d1a1217f
--- /dev/null
+++ b/base/comps/systemd/overlays/0002-remove-xen-devel-buildrequires.overlay.toml
@@ -0,0 +1,15 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Remove xen-devel BuildRequires — not available in AZL (AZL targets Hyper-V/Azure, not Xen)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "xen-devel"
+
+[[overlays]]
+description = "Disable Xen in meson — set have_xen to 0 so -Dxenctrl=disabled (no targeted overlay for %global)"
+type = "spec-search-replace"
+regex = "%global have_xen 1"
+replacement = "%global have_xen 0"
diff --git a/base/comps/systemd/overlays/0003-disable-udev-rule-sets.overlay.toml b/base/comps/systemd/overlays/0003-disable-udev-rule-sets.overlay.toml
new file mode 100644
index 00000000000..b6a65575ce4
--- /dev/null
+++ b/base/comps/systemd/overlays/0003-disable-udev-rule-sets.overlay.toml
@@ -0,0 +1,10 @@
+[metadata]
+category = "azl-platform-adaptation"
+upstreamable = false
+
+[[overlays]]
+description = "Disable udev rule that sets default io scheduler to bfq"
+type = "file-search-replace"
+file = "60-block-scheduler.rules"
+regex = "(?m)^"
+replacement = "#"
diff --git a/base/comps/systemd/overlays/0004-set-default-llmnr-support.overlay.toml b/base/comps/systemd/overlays/0004-set-default-llmnr-support.overlay.toml
new file mode 100644
index 00000000000..ddc9e00e13c
--- /dev/null
+++ b/base/comps/systemd/overlays/0004-set-default-llmnr-support.overlay.toml
@@ -0,0 +1,9 @@
+[metadata]
+category = "azl-security-compliance"
+upstreamable = false
+
+[[overlays]]
+description = "Set default llmnr support to disabled"
+type = "spec-search-replace"
+regex = "-Ddefault-llmnr=.*$"
+replacement = "-Ddefault-llmnr=no"
diff --git a/base/comps/systemd/overlays/0005-remove-build-params-reducing.overlay.toml b/base/comps/systemd/overlays/0005-remove-build-params-reducing.overlay.toml
new file mode 100644
index 00000000000..34fc313cd63
--- /dev/null
+++ b/base/comps/systemd/overlays/0005-remove-build-params-reducing.overlay.toml
@@ -0,0 +1,15 @@
+[metadata]
+category = "azl-branding-policy"
+upstreamable = false
+
+[[overlays]]
+description = "Remove build params reducing default timeout to 45s; leaving upstream default of 90s"
+type = "spec-search-replace"
+regex = "-Ddefault-timeout-sec=45"
+replacement = "#-Ddefault-timeout-sec=45"
+
+[[overlays]]
+description = "Remove build params reducing default timeout to 45s; leaving upstream default of 90s"
+type = "spec-search-replace"
+regex = "-Ddefault-user-timeout-sec=45"
+replacement = "#-Ddefault-user-timeout-sec=45"
diff --git a/base/comps/systemd/systemd.comp.toml b/base/comps/systemd/systemd.comp.toml
index 25259e34c6d..e2eecb41bb5 100644
--- a/base/comps/systemd/systemd.comp.toml
+++ b/base/comps/systemd/systemd.comp.toml
@@ -1,54 +1 @@
 [components.systemd]
-
-# AZL's setup package is 2.15.0-1, but upstream Fedora 41+ systemd requires >= 2.15.0-3.
-# Lower the version threshold to match what's available in AZL.
-# Ref: https://src.fedoraproject.org/rpms/setup/commits/rawhide (2.15.0-3 added /usr/lib/sysusers.d ownership)
-
-[[components.systemd.overlays]]
-description = "Lower BuildRequires on setup from 2.15.0-3 to 2.15.0-1 to match AZL's available version"
-type = "spec-search-replace"
-regex = '^BuildRequires:\s+setup >= 2\.15\.0-3$'
-replacement = "BuildRequires:  setup >= 2.15.0-1"
-
-[[components.systemd.overlays]]
-description = "Lower Conflicts on setup from 2.15.0-3 to 2.15.0-1 to match AZL's available version"
-type = "spec-search-replace"
-regex = '^Conflicts:\s+setup < 2\.15\.0-3$'
-replacement = "Conflicts:      setup < 2.15.0-1"
-
-[[components.systemd.overlays]]
-description = "Remove xen-devel BuildRequires — not available in AZL (AZL targets Hyper-V/Azure, not Xen)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "xen-devel"
-
-[[components.systemd.overlays]]
-description = "Disable Xen in meson — set have_xen to 0 so -Dxenctrl=disabled (no targeted overlay for %global)"
-type = "spec-search-replace"
-regex = '%global have_xen 1'
-replacement = "%global have_xen 0"
-
-[[components.systemd.overlays]]
-description = "Disable udev rule that sets default io scheduler to bfq"
-type = "file-search-replace"
-file = "60-block-scheduler.rules"
-regex = "(?m)^"
-replacement = "#"
-
-[[components.systemd.overlays]]
-description = "Set default llmnr support to disabled"
-type = "spec-search-replace"
-regex = '-Ddefault-llmnr=.*$'
-replacement = "-Ddefault-llmnr=no"
-
-[[components.systemd.overlays]]
-description = "Remove build params reducing default timeout to 45s; leaving upstream default of 90s"
-type = "spec-search-replace"
-regex = '-Ddefault-timeout-sec=45'
-replacement = "#-Ddefault-timeout-sec=45"
-
-[[components.systemd.overlays]]
-description = "Remove build params reducing default timeout to 45s; leaving upstream default of 90s"
-type = "spec-search-replace"
-regex = '-Ddefault-user-timeout-sec=45'
-replacement = "#-Ddefault-user-timeout-sec=45"
diff --git a/base/comps/tuna/overlays/0001-remove-unpackaged-usr-bin.overlay.toml b/base/comps/tuna/overlays/0001-remove-unpackaged-usr-bin.overlay.toml
new file mode 100644
index 00000000000..28e1c16995d
--- /dev/null
+++ b/base/comps/tuna/overlays/0001-remove-unpackaged-usr-bin.overlay.toml
@@ -0,0 +1,14 @@
+# The upstream spec gates only the `%package -n oscilloscope` and
+# `%files -n oscilloscope` blocks on the bcond. The `oscilloscope`
+# console-script entry-point is still installed by `%pyproject_install`,
+# leaving an unpackaged file when the bcond is off (rpmbuild fails). Strip
+# it explicitly when oscilloscope is disabled.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove unpackaged /usr/bin/oscilloscope when oscilloscope bcond is off"
+type = "spec-append-lines"
+section = "%install"
+lines = ["%if %{without oscilloscope}", "rm -f %{buildroot}%{_bindir}/oscilloscope", "%endif"]
diff --git a/base/comps/tuna/tuna.comp.toml b/base/comps/tuna/tuna.comp.toml
index 1edc356a8ba..eee4608d3a0 100644
--- a/base/comps/tuna/tuna.comp.toml
+++ b/base/comps/tuna/tuna.comp.toml
@@ -8,18 +8,3 @@
 # the oscilloscope sub-pkg entirely and removes the corresponding
 # Requires.
 build.without = ["oscilloscope"]
-
-# The upstream spec gates only the `%package -n oscilloscope` and
-# `%files -n oscilloscope` blocks on the bcond. The `oscilloscope`
-# console-script entry-point is still installed by `%pyproject_install`,
-# leaving an unpackaged file when the bcond is off (rpmbuild fails). Strip
-# it explicitly when oscilloscope is disabled.
-[[components.tuna.overlays]]
-description = "Remove unpackaged /usr/bin/oscilloscope when oscilloscope bcond is off"
-type = "spec-append-lines"
-section = "%install"
-lines = [
-    "%if %{without oscilloscope}",
-    "rm -f %{buildroot}%{_bindir}/oscilloscope",
-    "%endif",
-]
diff --git a/base/comps/vips/overlays/0001-drop-libheif-build-dependency.overlay.toml b/base/comps/vips/overlays/0001-drop-libheif-build-dependency.overlay.toml
new file mode 100644
index 00000000000..77f226c32b2
--- /dev/null
+++ b/base/comps/vips/overlays/0001-drop-libheif-build-dependency.overlay.toml
@@ -0,0 +1,50 @@
+# Disable HEIF support — libheif is being retired from Azure Linux 4.0.
+# Upstream spec auto-detects libheif via pkg-config (no explicit meson flag)
+# and ships the heif plugin in a dedicated `vips-heif` subpackage. Drop the
+# BR and the soft `Recommends`, then strip the now-unbuildable subpackage
+# entirely so the build does not fail with "unpackaged file" or
+# "non-existent file in %files" errors.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Drop libheif build dependency ahead of libheif removal from Azure Linux 4.0"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(libheif)"
+
+[[overlays]]
+description = "Drop soft Recommends on vips-heif now that the subpackage is removed"
+type = "spec-remove-tag"
+tag = "Recommends"
+value = "%{name}-heif"
+
+# libvips defines `option('heif', type : 'feature', value : 'auto')`, so meson
+# fails when libheif is not found rather than silently skipping it. Force the
+# feature off explicitly. We piggyback on the existing `-Dpdfium=disabled \`
+# line to keep the diff minimal.
+[[overlays]]
+description = "Force `-Dheif=disabled` so meson does not fail trying to auto-detect libheif"
+type = "spec-search-replace"
+section = "%build"
+regex = "-Dpdfium=disabled \\\\"
+replacement = "-Dpdfium=disabled \\\n    -Dheif=disabled \\"
+
+[[overlays]]
+description = "Remove %package heif now that vips-heif.so is not built"
+type = "spec-remove-section"
+package = "heif"
+section = "%package"
+
+[[overlays]]
+description = "Remove %description heif now that vips-heif.so is not built"
+type = "spec-remove-section"
+package = "heif"
+section = "%description"
+
+[[overlays]]
+description = "Remove %files heif now that vips-heif.so is not built"
+type = "spec-remove-section"
+package = "heif"
+section = "%files"
diff --git a/base/comps/vips/vips.comp.toml b/base/comps/vips/vips.comp.toml
index f5bdbe3ae46..c8895f3d4eb 100644
--- a/base/comps/vips/vips.comp.toml
+++ b/base/comps/vips/vips.comp.toml
@@ -1,49 +1 @@
 [components.vips]
-
-# Disable HEIF support — libheif is being retired from Azure Linux 4.0.
-# Upstream spec auto-detects libheif via pkg-config (no explicit meson flag)
-# and ships the heif plugin in a dedicated `vips-heif` subpackage. Drop the
-# BR and the soft `Recommends`, then strip the now-unbuildable subpackage
-# entirely so the build does not fail with "unpackaged file" or
-# "non-existent file in %files" errors.
-
-[[components.vips.overlays]]
-description = "Drop libheif build dependency ahead of libheif removal from Azure Linux 4.0"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(libheif)"
-
-[[components.vips.overlays]]
-description = "Drop soft Recommends on vips-heif now that the subpackage is removed"
-type = "spec-remove-tag"
-tag = "Recommends"
-value = "%{name}-heif"
-
-# libvips defines `option('heif', type : 'feature', value : 'auto')`, so meson
-# fails when libheif is not found rather than silently skipping it. Force the
-# feature off explicitly. We piggyback on the existing `-Dpdfium=disabled \`
-# line to keep the diff minimal.
-[[components.vips.overlays]]
-description = "Force `-Dheif=disabled` so meson does not fail trying to auto-detect libheif"
-type = "spec-search-replace"
-section = "%build"
-regex = '-Dpdfium=disabled \\'
-replacement = "-Dpdfium=disabled \\\n    -Dheif=disabled \\"
-
-[[components.vips.overlays]]
-description = "Remove %package heif now that vips-heif.so is not built"
-type = "spec-remove-section"
-package = "heif"
-section = "%package"
-
-[[components.vips.overlays]]
-description = "Remove %description heif now that vips-heif.so is not built"
-type = "spec-remove-section"
-package = "heif"
-section = "%description"
-
-[[components.vips.overlays]]
-description = "Remove %files heif now that vips-heif.so is not built"
-type = "spec-remove-section"
-package = "heif"
-section = "%files"
diff --git a/base/comps/webkitgtk/overlays/0001-remove-libavif-buildrequires-libavif.overlay.toml b/base/comps/webkitgtk/overlays/0001-remove-libavif-buildrequires-libavif.overlay.toml
new file mode 100644
index 00000000000..45e94e50a52
--- /dev/null
+++ b/base/comps/webkitgtk/overlays/0001-remove-libavif-buildrequires-libavif.overlay.toml
@@ -0,0 +1,8 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove libavif BuildRequires (libavif not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(libavif)"
diff --git a/base/comps/webkitgtk/overlays/0002-remove-gstreamer-plugins-bad.overlay.toml b/base/comps/webkitgtk/overlays/0002-remove-gstreamer-plugins-bad.overlay.toml
new file mode 100644
index 00000000000..0776ab046f6
--- /dev/null
+++ b/base/comps/webkitgtk/overlays/0002-remove-gstreamer-plugins-bad.overlay.toml
@@ -0,0 +1,15 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove gstreamer-plugins-bad-1.0 BuildRequires (gstreamer1-plugins-bad-free not shipped in AZL; vestigial in upstream spec, no gst-bad headers are #included under default cmake options)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "pkgconfig(gstreamer-plugins-bad-1.0)"
+
+[[overlays]]
+description = "Disable avif support in WebKitGTK cmake builds (libavif not available in AZL)"
+type = "spec-search-replace"
+section = "%build"
+regex = "%cmake \\\\"
+replacement = "%cmake \\\n  -DUSE_AVIF=OFF \\"
diff --git a/base/comps/webkitgtk/overlays/0003-remove-recommends-gstreamer1-plugins.overlay.toml b/base/comps/webkitgtk/overlays/0003-remove-recommends-gstreamer1-plugins.overlay.toml
new file mode 100644
index 00000000000..91814b032c3
--- /dev/null
+++ b/base/comps/webkitgtk/overlays/0003-remove-recommends-gstreamer1-plugins.overlay.toml
@@ -0,0 +1,18 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove Recommends on gstreamer1-plugins-bad-free from webkitgtk6.0 package — not shipped in AZL"
+type = "spec-remove-tag"
+section = "%package"
+package = "webkitgtk6.0"
+tag = "Recommends"
+value = "gstreamer1-plugins-bad-free"
+
+[[overlays]]
+description = "Remove Recommends on gstreamer1-plugins-bad-free from webkit2gtk4.1 package — not shipped in AZL"
+type = "spec-remove-tag"
+section = "%package"
+package = "webkit2gtk4.1"
+tag = "Recommends"
+value = "gstreamer1-plugins-bad-free"
diff --git a/base/comps/webkitgtk/webkitgtk.comp.toml b/base/comps/webkitgtk/webkitgtk.comp.toml
index 27c35acbd3b..1d0f99d38d2 100644
--- a/base/comps/webkitgtk/webkitgtk.comp.toml
+++ b/base/comps/webkitgtk/webkitgtk.comp.toml
@@ -16,38 +16,3 @@
 
 [components.webkitgtk]
 
-[[components.webkitgtk.overlays]]
-description = "Remove libavif BuildRequires (libavif not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(libavif)"
-
-[[components.webkitgtk.overlays]]
-description = "Remove gstreamer-plugins-bad-1.0 BuildRequires (gstreamer1-plugins-bad-free not shipped in AZL; vestigial in upstream spec, no gst-bad headers are #included under default cmake options)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "pkgconfig(gstreamer-plugins-bad-1.0)"
-
-[[components.webkitgtk.overlays]]
-description = "Disable avif support in WebKitGTK cmake builds (libavif not available in AZL)"
-type = "spec-search-replace"
-section = "%build"
-regex = '%cmake \\'
-replacement = '''%cmake \
-  -DUSE_AVIF=OFF \'''
-
-[[components.webkitgtk.overlays]]
-description = "Remove Recommends on gstreamer1-plugins-bad-free from webkitgtk6.0 package — not shipped in AZL"
-type = "spec-remove-tag"
-section = "%package"
-package = "webkitgtk6.0"
-tag = "Recommends"
-value = "gstreamer1-plugins-bad-free"
-
-[[components.webkitgtk.overlays]]
-description = "Remove Recommends on gstreamer1-plugins-bad-free from webkit2gtk4.1 package — not shipped in AZL"
-type = "spec-remove-tag"
-section = "%package"
-package = "webkit2gtk4.1"
-tag = "Recommends"
-value = "gstreamer1-plugins-bad-free"
diff --git a/base/comps/weston/overlays/0001-drop-buildrequires-neatvnc-removing.overlay.toml b/base/comps/weston/overlays/0001-drop-buildrequires-neatvnc-removing.overlay.toml
new file mode 100644
index 00000000000..4cebcea8e01
--- /dev/null
+++ b/base/comps/weston/overlays/0001-drop-buildrequires-neatvnc-removing.overlay.toml
@@ -0,0 +1,27 @@
+[metadata]
+category = "azl-pruning"
+upstreamable = false
+
+[[overlays]]
+description = "Drop BuildRequires on neatvnc — removing ffmpeg/libav* and neatvnc from the distro"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "(pkgconfig(neatvnc) >= 0.7.0 with pkgconfig(neatvnc) < 0.10.0)"
+
+[[overlays]]
+description = "Pass -Dbackend-vnc=false to meson — neatvnc no longer available"
+type = "spec-search-replace"
+regex = "^%meson$"
+replacement = "%meson -Dbackend-vnc=false"
+
+[[overlays]]
+description = "Drop vnc-backend.so from %files — no longer built"
+type = "spec-search-replace"
+regex = "^%\\{_libdir\\}/libweston-%\\{apiver\\}/vnc-backend\\.so$"
+replacement = ""
+
+[[overlays]]
+description = "Drop weston-remote-access PAM config from %files — only installed by the VNC backend, which is now disabled"
+type = "spec-search-replace"
+regex = "^%config\\(noreplace\\) %\\{_sysconfdir\\}/pam\\.d/weston-remote-access$"
+replacement = ""
diff --git a/base/comps/weston/weston.comp.toml b/base/comps/weston/weston.comp.toml
index 483e892afd6..938a2ea3e69 100644
--- a/base/comps/weston/weston.comp.toml
+++ b/base/comps/weston/weston.comp.toml
@@ -7,26 +7,3 @@
 # x11, headless, pipewire, rdp) are unaffected.
 [components.weston]
 
-[[components.weston.overlays]]
-description = "Drop BuildRequires on neatvnc — removing ffmpeg/libav* and neatvnc from the distro"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "(pkgconfig(neatvnc) >= 0.7.0 with pkgconfig(neatvnc) < 0.10.0)"
-
-[[components.weston.overlays]]
-description = "Pass -Dbackend-vnc=false to meson — neatvnc no longer available"
-type = "spec-search-replace"
-regex = '^%meson$'
-replacement = "%meson -Dbackend-vnc=false"
-
-[[components.weston.overlays]]
-description = "Drop vnc-backend.so from %files — no longer built"
-type = "spec-search-replace"
-regex = '^%\{_libdir\}/libweston-%\{apiver\}/vnc-backend\.so$'
-replacement = ""
-
-[[components.weston.overlays]]
-description = "Drop weston-remote-access PAM config from %files — only installed by the VNC backend, which is now disabled"
-type = "spec-search-replace"
-regex = '^%config\(noreplace\) %\{_sysconfdir\}/pam\.d/weston-remote-access$'
-replacement = ""
diff --git a/base/comps/wireshark/overlays/0001-remove-opus-devel-buildrequires.overlay.toml b/base/comps/wireshark/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
new file mode 100644
index 00000000000..cf2202d1799
--- /dev/null
+++ b/base/comps/wireshark/overlays/0001-remove-opus-devel-buildrequires.overlay.toml
@@ -0,0 +1,11 @@
+# AZL does not ship opus — remove the BR so wireshark builds without
+# the Opus RTP audio playback feature.
+
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove opus-devel BuildRequires (opus not available in AZL)"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "opus-devel"
diff --git a/base/comps/wireshark/wireshark.comp.toml b/base/comps/wireshark/wireshark.comp.toml
index dfb5b6c8a5d..47efc51eb17 100644
--- a/base/comps/wireshark/wireshark.comp.toml
+++ b/base/comps/wireshark/wireshark.comp.toml
@@ -1,10 +1 @@
 [components.wireshark]
-
-# AZL does not ship opus — remove the BR so wireshark builds without
-# the Opus RTP audio playback feature.
-
-[[components.wireshark.overlays]]
-description = "Remove opus-devel BuildRequires (opus not available in AZL)"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "opus-devel"
diff --git a/base/comps/wxGTK/overlays/0001-remove-gstreamer1-plugins-bad.overlay.toml b/base/comps/wxGTK/overlays/0001-remove-gstreamer1-plugins-bad.overlay.toml
new file mode 100644
index 00000000000..7d186096241
--- /dev/null
+++ b/base/comps/wxGTK/overlays/0001-remove-gstreamer1-plugins-bad.overlay.toml
@@ -0,0 +1,28 @@
+[metadata]
+category = "azl-pruning"
+
+[[overlays]]
+description = "Remove gstreamer1-plugins-bad-free-devel BuildRequires — gstreamer1-plugins-bad-free not shipped in AZL"
+type = "spec-remove-tag"
+tag = "BuildRequires"
+value = "gstreamer1-plugins-bad-free-devel"
+
+[[overlays]]
+description = "Disable wxMediaCtrl at configure time — gstreamer1-plugins-bad-free not shipped in AZL"
+type = "spec-search-replace"
+section = "%build"
+regex = "%configure \\\\"
+replacement = "%configure \\\n  --disable-mediactrl \\"
+
+[[overlays]]
+description = "Remove wxGTK-devel Requires on wxGTK-media — media subpackage is empty (mediactrl disabled)"
+type = "spec-remove-tag"
+section = "%package"
+package = "devel"
+tag = "Requires"
+value = "%{name}-media = %{version}-%{release}"
+
+[[overlays]]
+description = "Remove wxGTK-media subpackage — mediactrl is disabled and no media library is built"
+type = "spec-remove-subpackage"
+package = "media"
diff --git a/base/comps/wxGTK/wxGTK.comp.toml b/base/comps/wxGTK/wxGTK.comp.toml
index cca320d222d..d6c29d97bce 100644
--- a/base/comps/wxGTK/wxGTK.comp.toml
+++ b/base/comps/wxGTK/wxGTK.comp.toml
@@ -10,29 +10,3 @@ without = [
     "tests"
 ]
 
-[[components.wxGTK.overlays]]
-description = "Remove gstreamer1-plugins-bad-free-devel BuildRequires — gstreamer1-plugins-bad-free not shipped in AZL"
-type = "spec-remove-tag"
-tag = "BuildRequires"
-value = "gstreamer1-plugins-bad-free-devel"
-
-[[components.wxGTK.overlays]]
-description = "Disable wxMediaCtrl at configure time — gstreamer1-plugins-bad-free not shipped in AZL"
-type = "spec-search-replace"
-section = "%build"
-regex = '%configure \\'
-replacement = '''%configure \
-  --disable-mediactrl \'''
-
-[[components.wxGTK.overlays]]
-description = "Remove wxGTK-devel Requires on wxGTK-media — media subpackage is empty (mediactrl disabled)"
-type = "spec-remove-tag"
-section = "%package"
-package = "devel"
-tag = "Requires"
-value = "%{name}-media = %{version}-%{release}"
-
-[[components.wxGTK.overlays]]
-description = "Remove wxGTK-media subpackage — mediactrl is disabled and no media library is built"
-type = "spec-remove-subpackage"
-package = "media"

From 1b2a546560a1dd0d403a8daa42e144515152d923 Mon Sep 17 00:00:00 2001
From: Nan Liu <liunan@microsoft.com>
Date: Wed, 1 Jul 2026 21:08:45 +0000
Subject: [PATCH 2/3] chore(distro): set overlay-files default-component-config

Enable per-file overlay discovery for every component by setting
overlay-files = ["overlays/*.overlay.toml"] in the 4.0 stage1/stage2
default-component-config. This is what makes the migrated components'
overlays/*.overlay.toml files load. Kept as a standalone latest commit so
it can be reverted independently of the annotation migration.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 distro/azurelinux.distro.toml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/distro/azurelinux.distro.toml b/distro/azurelinux.distro.toml
index 2662f685e26..21f8bb08a9a 100644
--- a/distro/azurelinux.distro.toml
+++ b/distro/azurelinux.distro.toml
@@ -19,6 +19,10 @@ mock-config-aarch64 = "mock/azl4/stage1/azurelinux-4.0-aarch64.cfg"
 [distros.azurelinux.versions.'4.0-stage1'.default-component-config]
 # NOTE: Ensure that the snapshot date matches the snapshot date used below for stage2.
 spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43", snapshot = "2026-02-24T00:00:00-08:00" } }
+# Discover per-file overlay documents from each component's ./overlays/ directory.
+# Inherited relative pattern is resolved per-component; globs that match no files
+# are ignored, so components without an overlays/ dir are unaffected.
+overlay-files = ["overlays/*.overlay.toml"]
 
 #
 # Azure Linux 4.0 Stage2
@@ -36,3 +40,7 @@ mock-config-aarch64 = "mock/azl4/stage2/azurelinux-4.0-aarch64.cfg"
 [distros.azurelinux.versions.'4.0-stage2'.default-component-config]
 # NOTE: Ensure that the snapshot date matches the snapshot date used above for stage1.
 spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43", snapshot = "2026-02-24T00:00:00-08:00" } }
+# Discover per-file overlay documents from each component's ./overlays/ directory.
+# Inherited relative pattern is resolved per-component; globs that match no files
+# are ignored, so components without an overlays/ dir are unaffected.
+overlay-files = ["overlays/*.overlay.toml"]

From e5821f1c9be6ec311c2fe049be4fbdc52a3f7ec1 Mon Sep 17 00:00:00 2001
From: Nan Liu <liunan@microsoft.com>
Date: Wed, 1 Jul 2026 21:13:19 +0000
Subject: [PATCH 3/3] chore(azldev): pin to 35d8fae and regenerate schema
 [PR-CHECK, REVERT BEFORE MERGE]

TEMPORARY: this commit exists solely so the PR checks run against an azldev
build that understands the new overlay-files / metadata / BugRef config. It
MUST be reverted before the PR is merged.

Pin azldev to 35d8fae562980db7bda057d79322cc51ddad8d62, the merged form of the
overlay-files-after-resolution change (microsoft/azure-linux-dev-tools#256).
This version supports inheriting overlay-files from a project-wide
[default-component-config] and allows an empty overlay-files list to disable
inherited patterns. Regenerate external/schemas/azldev.schema.json against the
pinned tool so the authoritative schema knows the new metadata / overlay-files /
BugRef fields.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .azldev-version                     |   2 +-
 external/schemas/azldev.schema.json | 354 ++++++++++++++++++++++++++++
 2 files changed, 355 insertions(+), 1 deletion(-)

diff --git a/.azldev-version b/.azldev-version
index 95552389490..cad168e1ff6 100644
--- a/.azldev-version
+++ b/.azldev-version
@@ -1 +1 @@
-0256227f5434d9e00d7c8501b16848efa400a72b
+35d8fae562980db7bda057d79322cc51ddad8d62
diff --git a/external/schemas/azldev.schema.json b/external/schemas/azldev.schema.json
index e2e8dd16836..d665b45f9bd 100644
--- a/external/schemas/azldev.schema.json
+++ b/external/schemas/azldev.schema.json
@@ -3,6 +3,22 @@
   "$id": "https://github.com/microsoft/azure-linux-dev-tools/internal/projectconfig/config-file",
   "$ref": "#/$defs/ConfigFile",
   "$defs": {
+    "BugRef": {
+      "properties": {
+        "url": {
+          "type": "string",
+          "pattern": "^https?://",
+          "format": "uri",
+          "title": "URL",
+          "description": "HTTP(S) link to the bug entry"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "url"
+      ]
+    },
     "CheckConfig": {
       "properties": {
         "skip": {
@@ -119,6 +135,14 @@
           "title": "Overlays",
           "description": "Overlays to apply to this component's spec and/or sources"
         },
+        "overlay-files": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "Overlay files",
+          "description": "Path or glob patterns (relative to the component config file or matched spec directory) matched against the filesystem to locate per-file overlay documents after component config resolution. Use an empty list to disable inherited overlay-file patterns"
+        },
         "build": {
           "$ref": "#/$defs/ComponentBuildConfig",
           "title": "Build configuration",
@@ -278,6 +302,11 @@
           "type": "string",
           "title": "Source",
           "description": "For overlays that require a source file as input"
+        },
+        "metadata": {
+          "$ref": "#/$defs/OverlayMetadata",
+          "title": "Metadata",
+          "description": "Optional documentation metadata describing the overlay's intent and provenance"
         }
       },
       "additionalProperties": false,
@@ -344,6 +373,11 @@
           "title": "Distros",
           "description": "Definitions of distros to build for or consume from"
         },
+        "resources": {
+          "$ref": "#/$defs/ResourcesConfig",
+          "title": "Resources",
+          "description": "Reusable named resource definitions"
+        },
         "component-groups": {
           "additionalProperties": {
             "$ref": "#/$defs/ComponentGroupConfig"
@@ -513,6 +547,11 @@
           "type": "string",
           "title": "Mock config file",
           "description": "Path to the aarch64 mock config file for this version"
+        },
+        "inputs": {
+          "$ref": "#/$defs/DistroVersionInputs",
+          "title": "Inputs",
+          "description": "Per-use-case input repositories"
         }
       },
       "additionalProperties": false,
@@ -521,6 +560,44 @@
         "release-ver"
       ]
     },
+    "DistroVersionInput": {
+      "properties": {
+        "repo": {
+          "type": "string",
+          "title": "Repo",
+          "description": "Name of an entry under [resources.rpm-repos]; mutually exclusive with set"
+        },
+        "set": {
+          "type": "string",
+          "title": "Set",
+          "description": "Name of an entry under [resources.rpm-repo-sets]; mutually exclusive with repo"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "DistroVersionInputs": {
+      "properties": {
+        "rpm-build": {
+          "items": {
+            "$ref": "#/$defs/DistroVersionInput"
+          },
+          "type": "array",
+          "title": "RPM-build inputs",
+          "description": "Repos and repo-sets made available to mock when building RPMs"
+        },
+        "image-build": {
+          "items": {
+            "$ref": "#/$defs/DistroVersionInput"
+          },
+          "type": "array",
+          "title": "Image-build inputs",
+          "description": "Repos and repo-sets made available to kiwi when building images"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
     "ImageCapabilities": {
       "properties": {
         "machine-bootable": {
@@ -663,6 +740,53 @@
         "type"
       ]
     },
+    "OverlayMetadata": {
+      "properties": {
+        "category": {
+          "type": "string",
+          "enum": [
+            "backport-dist-git",
+            "azl-pruning",
+            "azl-compatibility",
+            "azl-dep-missing-workaround",
+            "azl-branding-policy",
+            "azl-disable-flaky-tests",
+            "azl-disable-unsupported-tests",
+            "azl-security-compliance",
+            "azl-release-management",
+            "azl-platform-adaptation"
+          ],
+          "title": "Category",
+          "description": "Classification of the overlay's intent"
+        },
+        "commits": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "Commits",
+          "description": "URLs of upstream commits this overlay backports or references"
+        },
+        "bugs": {
+          "items": {
+            "$ref": "#/$defs/BugRef"
+          },
+          "type": "array",
+          "title": "Bug references",
+          "description": "References to issue-tracker entries related to this overlay"
+        },
+        "upstreamable": {
+          "type": "boolean",
+          "title": "Upstreamable",
+          "description": "Whether this overlay's change can be upstreamed; omit if not yet assessed"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "category"
+      ]
+    },
     "PackageConfig": {
       "properties": {
         "publish": {
@@ -846,6 +970,206 @@
       "additionalProperties": false,
       "type": "object"
     },
+    "ResourcesConfig": {
+      "properties": {
+        "rpm-repos": {
+          "additionalProperties": {
+            "$ref": "#/$defs/RpmRepoResource"
+          },
+          "propertyNames": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
+            "description": "Name; projected verbatim into dnf section headers and kiwi --add-repo arguments."
+          },
+          "type": "object",
+          "title": "RPM repositories",
+          "description": "Reusable named RPM repository definitions"
+        },
+        "rpm-repo-set-templates": {
+          "additionalProperties": {
+            "$ref": "#/$defs/RpmRepoSetTemplate"
+          },
+          "propertyNames": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
+            "description": "Name; projected verbatim into dnf section headers and kiwi --add-repo arguments."
+          },
+          "type": "object",
+          "title": "RPM repo set templates",
+          "description": "Named layout templates that describe a fixed matrix of sub-repos"
+        },
+        "rpm-repo-sets": {
+          "additionalProperties": {
+            "$ref": "#/$defs/RpmRepoSet"
+          },
+          "propertyNames": {
+            "type": "string",
+            "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
+            "description": "Name; projected verbatim into dnf section headers and kiwi --add-repo arguments."
+          },
+          "type": "object",
+          "title": "RPM repo sets",
+          "description": "Template instantiations that expand to a group of related RPM repos"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "RpmRepoResource": {
+      "oneOf": [
+        {
+          "not": {
+            "required": [
+              "metalink"
+            ]
+          },
+          "required": [
+            "base-uri"
+          ]
+        },
+        {
+          "not": {
+            "required": [
+              "base-uri"
+            ]
+          },
+          "required": [
+            "metalink"
+          ]
+        }
+      ],
+      "properties": {
+        "description": {
+          "type": "string",
+          "title": "Description",
+          "description": "Human-readable description (diagnostic only)"
+        },
+        "type": {
+          "type": "string",
+          "enum": [
+            "rpm-md"
+          ],
+          "title": "Type",
+          "description": "Repository access protocol; defaults to rpm-md"
+        },
+        "base-uri": {
+          "type": "string",
+          "pattern": "^https?://[^\\s]+$",
+          "format": "uri",
+          "title": "Base URI",
+          "description": "Repository base URI (dnf baseurl). Mutually exclusive with metalink. Must be an http(s) URL."
+        },
+        "metalink": {
+          "type": "string",
+          "pattern": "^https?://[^\\s]+$",
+          "format": "uri",
+          "title": "Metalink",
+          "description": "Repository metalink URL. Mutually exclusive with base-uri. Must be an http(s) URL."
+        },
+        "disable-gpg-check": {
+          "type": "boolean",
+          "title": "Disable GPG check",
+          "description": "Opt out of GPG signature verification for this repo (zero value = checking enabled)"
+        },
+        "gpg-key": {
+          "type": "string",
+          "pattern": "^((https?|file)://\\S+|[^\\s:]\\S*)$",
+          "title": "GPG key",
+          "description": "Path or URI to the GPG key file. Accepted URI schemes: http, https, file. Bare paths are resolved relative to the defining TOML file."
+        },
+        "arches": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "Arches",
+          "description": "Restrict to specific target architectures; empty = all"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "RpmRepoSet": {
+      "properties": {
+        "description": {
+          "type": "string",
+          "title": "Description",
+          "description": "Human-readable description (diagnostic only)"
+        },
+        "template": {
+          "type": "string",
+          "title": "Template",
+          "description": "Name of the rpm-repo-set-template to instantiate"
+        },
+        "base-uri": {
+          "type": "string",
+          "pattern": "^https?://[^\\s]+$",
+          "format": "uri",
+          "title": "Base URI",
+          "description": "URL prefix under which all sub-repos in this set live"
+        },
+        "name-prefix": {
+          "type": "string",
+          "title": "Name prefix",
+          "description": "Prepended to each sub-repo's name to form the repo ID"
+        },
+        "gpg-key": {
+          "type": "string",
+          "pattern": "^\\S+$",
+          "title": "GPG key",
+          "description": "Path or URI to the GPG key file. Accepted URI schemes: http, https, file. Bare paths are resolved relative to the defining TOML file."
+        },
+        "disable-gpg-check": {
+          "type": "boolean",
+          "title": "Disable GPG check",
+          "description": "Opt out of GPG signature verification for repos in this set"
+        },
+        "arches": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "Arches",
+          "description": "Restrict to specific target architectures; empty = all"
+        },
+        "subrepos": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "Sub-repos",
+          "description": "Allowlist of template sub-repos to instantiate (default: all)"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "template",
+        "base-uri"
+      ]
+    },
+    "RpmRepoSetTemplate": {
+      "properties": {
+        "description": {
+          "type": "string",
+          "title": "Description",
+          "description": "Human-readable description (diagnostic only)"
+        },
+        "subrepos": {
+          "items": {
+            "$ref": "#/$defs/SubrepoSpec"
+          },
+          "type": "array",
+          "title": "Sub-repos",
+          "description": "Ordered list of sub-repos in the layout"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "subrepos"
+      ]
+    },
     "SourceFileReference": {
       "properties": {
         "filename": {
@@ -934,6 +1258,36 @@
         "type"
       ]
     },
+    "SubrepoSpec": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "title": "Name",
+          "description": "Stable short identifier; combined with the set's name-prefix to form the repo ID"
+        },
+        "subpath": {
+          "type": "string",
+          "title": "Sub-path",
+          "description": "Relative path under the set's base URI; may contain $basearch"
+        },
+        "kind": {
+          "type": "string",
+          "enum": [
+            "binary",
+            "debug",
+            "source"
+          ],
+          "title": "Kind",
+          "description": "Sub-repo classification; defaults to binary"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "name",
+        "subpath"
+      ]
+    },
     "TestSuiteConfig": {
       "properties": {
         "description": {