diff --git a/base/comps/kata-containers/kata-containers.comp.toml b/base/comps/kata-containers/kata-containers.comp.toml
index 9748496903a..49e1ae4f7a1 100644
--- a/base/comps/kata-containers/kata-containers.comp.toml
+++ b/base/comps/kata-containers/kata-containers.comp.toml
@@ -1,3 +1,29 @@
 [components.kata-containers]
-# Release: 1%{?rcrel}%{?dist}
+# Release: %[1 + %{azl_release}]%{?rcrel}%{?dist}
 release = { calculation = "manual" }
+
+[components.kata-containers.build.defines]
+# AZL-only release counter added to upstream's Release. Bump for an AZL rebuild,
+# since manual release calculation can't auto-bump the Release.
+azl_release = "1"
+
+[[components.kata-containers.overlays]]
+description = "Fold azl_release into upstream Release so AZL rebuilds bump independently (manual release calculation can't auto-bump)"
+type = "spec-set-tag"
+tag = "Release"
+value = "%[1 + %{azl_release}]%{?rcrel}%{?dist}"
+[components.kata-containers.overlays.metadata]
+category = "azl-release-management"
+upstream-status = "inapplicable"
+
+# The Windows-only import-library removal and the matching cargo-checksum pruning are one
+# logical change; they live in overlays/0001-remove-windows-import-libraries.overlay.toml
+# (auto-loaded via the project-wide overlay-files glob) under a single azl-pruning metadata
+# block. The repacked vendor tarball they produce is pinned below.
+[[components.kata-containers.source-files]]
+filename = "kata-containers-3.26.0-vendor.tar.gz"
+hash = "2a9018a423a83ca80741b203b6b96a6895bae8734751f293e3ce7de772664cd69c87ae2fb8d556e77f31ae52051ce518d7075315858a05b5638290f7ea447e4c"
+hash-type = "SHA512"
+origin = { type = "overlay" }
+replace-upstream = true
+replace-reason = "Removes the Windows-only winapi-*-pc-windows-* and windows_*_{gnu,gnullvm,msvc} static import libraries (lib/*.a and .lib) that are flagged during source package signing, and drops the corresponding entries from each crate's .cargo-checksum.json; the crates are target-gated to Windows and never built on Linux."
diff --git a/base/comps/kata-containers/overlays/0001-remove-windows-import-libraries.overlay.toml b/base/comps/kata-containers/overlays/0001-remove-windows-import-libraries.overlay.toml
new file mode 100644
index 00000000000..2924ca553de
--- /dev/null
+++ b/base/comps/kata-containers/overlays/0001-remove-windows-import-libraries.overlay.toml
@@ -0,0 +1,60 @@
+# Remove the Windows-only import libraries from the vendored-dependencies archive and
+# drop their now-dangling entries from each crate's .cargo-checksum.json.
+#
+# The winapi-*-pc-windows-* and windows_*_{gnu,gnullvm,msvc} crates are all target-gated
+# (`[target.*-pc-windows-*]` / `cfg(target_env = ...)`), so they are never compiled on a
+# Linux build (the vendor archive is fully unpacked in %prep, but cargo only verifies
+# manifests for crates it actually builds). Their lib/ static-import archives (`.a`/`.lib`)
+# ship ~1.6M ar members in aggregate (vendored several times over per arch/toolchain), which
+# blows up recursive source-package scanning. Only the lib/ archives are dropped; each
+# crate's Cargo.toml/src/skeleton is kept so cargo's resolve stays intact.
+#
+# Cargo's directory source verifies every path listed in a manifest's `files` map and fails
+# with "failed to verify the checksum of <pkg>" when one is missing; it does not object to
+# files that exist but are unlisted, so deleting the removed lib/ entries is the correct fix.
+# In every affected manifest the lib/ keys sort between `build.rs` and `src/lib.rs`, so a
+# trailing comma is always present and the JSON stays valid. The archive is repacked; the
+# resulting hash is pinned via the source-files entry in kata-containers.comp.toml.
+
+[metadata]
+category = "azl-pruning"
+upstream-status = "inapplicable"
+
+[[overlays]]
+description = "Remove Windows-only winapi import libraries"
+type = "file-remove"
+archive = "kata-containers-3.26.0-vendor.tar.gz"
+file = "**/winapi-*-pc-windows-*/lib/**"
+
+[[overlays]]
+description = "Remove Windows-only windows_* gnu/gnullvm import libraries"
+type = "file-remove"
+archive = "kata-containers-3.26.0-vendor.tar.gz"
+file = "**/windows_*_gnu*/lib/**"
+
+[[overlays]]
+description = "Remove Windows-only windows_* msvc import libraries"
+type = "file-remove"
+archive = "kata-containers-3.26.0-vendor.tar.gz"
+file = "**/windows_*_msvc*/lib/**"
+
+[[overlays]]
+description = "Drop removed winapi import libraries from cargo checksum manifests"
+type = "file-search-replace"
+archive = "kata-containers-3.26.0-vendor.tar.gz"
+file = "**/winapi-*-pc-windows-*/.cargo-checksum.json"
+regex = '"lib/[^"]*":"[a-f0-9]{64}",'
+
+[[overlays]]
+description = "Drop removed windows_* gnu/gnullvm import libraries from cargo checksum manifests"
+type = "file-search-replace"
+archive = "kata-containers-3.26.0-vendor.tar.gz"
+file = "**/windows_*_gnu*/.cargo-checksum.json"
+regex = '"lib/[^"]*":"[a-f0-9]{64}",'
+
+[[overlays]]
+description = "Drop removed windows_* msvc import libraries from cargo checksum manifests"
+type = "file-search-replace"
+archive = "kata-containers-3.26.0-vendor.tar.gz"
+file = "**/windows_*_msvc*/.cargo-checksum.json"
+regex = '"lib/[^"]*":"[a-f0-9]{64}",'
diff --git a/locks/kata-containers.lock b/locks/kata-containers.lock
index 1facb366214..6f054425671 100644
--- a/locks/kata-containers.lock
+++ b/locks/kata-containers.lock
@@ -3,5 +3,5 @@ version = 1
 import-commit = 'd4a94fd83f31e8a88a8c7d72e424d4f5d83bcdfa'
 upstream-commit = 'd4a94fd83f31e8a88a8c7d72e424d4f5d83bcdfa'
 manual-bump = 2
-input-fingerprint = 'sha256:12f7166a983055a79dd08a7770729bba4af6edee9a6d035d9c66cd35ffc9da0a'
+input-fingerprint = 'sha256:7af9ed5d24d194c5e606597883d2437524b26367d248e189d3fdc2eb9962e0fe'
 resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
diff --git a/specs/k/kata-containers/kata-containers.azl.macros b/specs/k/kata-containers/kata-containers.azl.macros
new file mode 100644
index 00000000000..60187b70289
--- /dev/null
+++ b/specs/k/kata-containers/kata-containers.azl.macros
@@ -0,0 +1,3 @@
+# Macros file automatically generated by azldev.
+# Do not edit manually; changes will be overwritten.
+%azl_release 1
diff --git a/specs/k/kata-containers/kata-containers.spec b/specs/k/kata-containers/kata-containers.spec
index 51c4b1f2305..d03dbc06776 100644
--- a/specs/k/kata-containers/kata-containers.spec
+++ b/specs/k/kata-containers/kata-containers.spec
@@ -1,6 +1,9 @@
 # This spec file has been modified by azldev to include build configuration overlays.
 # Do not edit manually; changes may be overwritten.
 
+# All Azure Linux specs with overlays include this macro file, irrespective of whether new macros have been added.
+%{load:%{_sourcedir}/kata-containers.azl.macros}
+
 # go-rpm-macros are not available on RHEL.
 %global have_go_rpm_macros 1
 %global with_debug 0
@@ -59,7 +62,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.}
 # Unlike for RHEL, we cannot strip it down because we build all components
 # (RHEL builds only build kata-agent)
 Name:       %{repo}
-Release:    1%{?rcrel}%{?dist}
+Release: %[1 + %{azl_release}]%{?rcrel}%{?dist}
 Summary:    Kata Containers version 3.x repository
 License:    Apache-2.0
 Url:        https://%{download}
@@ -69,6 +72,7 @@ Source2:    kata-osbuilder.sh
 Source3:    kata-osbuilder-generate.service
 Source4:    15-dracut.conf
 Source5:    50-kata
+Source9999: kata-containers.azl.macros
 
 # Keep this patch downstream as it'd be hard to justify such change upstream
 Patch0999:  0999-osbuilder-Adjust-agent_version-for-our-builds.patch
diff --git a/specs/k/kata-containers/sources b/specs/k/kata-containers/sources
index 8957fa978da..361019e3301 100644
--- a/specs/k/kata-containers/sources
+++ b/specs/k/kata-containers/sources
@@ -1,2 +1,2 @@
 SHA512 (kata-containers-3.26.0.tar.gz) = 836cf4c0882a9813d854b98cacf22b86806f7e27db903256b6c2a2a6ff4345f50e8c1b2c60c74f08e094471cb08b8fba208412667700a330204d82834220b271
-SHA512 (kata-containers-3.26.0-vendor.tar.gz) = ca216accbb9aeb1f4bb68547d6e1bb7ffceb2b3da58cff4d6bfff1d5af4b5bf52f9a4ae687a56bd7d6269b15437de178b8892acaffe627724c39c375ef6ea56a
+SHA512 (kata-containers-3.26.0-vendor.tar.gz) = 2a9018a423a83ca80741b203b6b96a6895bae8734751f293e3ce7de772664cd69c87ae2fb8d556e77f31ae52051ce518d7075315858a05b5638290f7ea447e4c