@@ -117,6 +117,7 @@ The configuration currently reads the following top-level fields:
   "useSnapshot": false,  // Default: false
   "useCodeCache": true, // Default: false
   "useVfs": true, // Default: false
+  "vfsArchive": "/path/to/assets.zip", // Optional
   "execArgv": ["--no-warnings", "--max-old-space-size=4096"], // Optional
   "execArgvExtension": "env", // Default: "env", options: "none", "env", "cli"
   "assets": {  // Optional
@@ -260,6 +261,41 @@ Module format detection works the same way as on the real file
 system: name bundled ES modules with the `.mjs` extension (or provide the
 relevant `package.json` files as assets) so they are interpreted as ESM.
 
+#### Serving the assets from a ZIP archive with `"vfsArchive"`
+
+Instead of listing individual `"assets"`, the configuration can point
+`"vfsArchive"` at a prebuilt ZIP archive. The archive is embedded into the
+executable as-is, and the virtual file system serves the files inside it,
+inflating each one when it is read. When the assets are compressible (such
+as JavaScript, JSON, or other text), a deflate-compressed archive can
+substantially reduce the size of the generated executable.
+
+The archive can be built with any ZIP tool, or with the ZIP support in
+[`node:zlib`][]:
+
+```mjs
+import { zipFiles } from 'node:zlib';
+import { createWriteStream } from 'node:fs';
+import { pipeline } from 'node:stream/promises';
+
+await pipeline(
+  zipFiles([
+    ['./dist/config.json', 'config.json'],
+    ['./dist/data.txt', 'data/data.txt'],
+  ]),
+  createWriteStream('assets.zip'),
+);
+```
+
+The mounted file tree looks the same as with `"assets"`: the entries appear
+under the mount point using their archive names, the main script is placed
+at the mount point root, and access through `__dirname`-relative paths,
+`require()`, and `import` is unchanged. However, `sea.getAsset()` and
+`sea.getAssetAsBlob()` do not serve the individual files, because the
+executable only embeds the archive; read the files through the file system
+APIs instead. `"vfsArchive"` requires `"useVfs": true` and cannot be
+combined with `"assets"`.
+
 #### Snapshot and code caching limitations
 
 `"useVfs": true` cannot be used together with `"useSnapshot": true` or
@@ -751,6 +787,7 @@ to help us document them.
 [Using native addons in the injected main script]: #using-native-addons-in-the-injected-main-script
 [VFS documentation]: vfs.md
 [Windows SDK]: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/
+[`node:zlib`]: zlib.md
 [`process.execPath`]: process.md#processexecpath
 [`require()`]: modules.md#requireid
 [`require.main`]: modules.md#accessing-the-main-module
 
@@ -453,6 +453,11 @@ is loaded from inside the mount through the ESM loader, and
 `"useVfs"` cannot be used together with `"useSnapshot"` or `"useCodeCache"`.
 The SEA configuration parser will error if either combination is detected.
 
+Instead of listing individual `"assets"`, the SEA configuration can point
+`"vfsArchive"` at a prebuilt ZIP archive; the mount is then backed by a
+[`ZipProvider`][] over the embedded archive, and each file is inflated when
+it is read. See [Serving the assets from a ZIP archive][] for details.
+
 See the [Single Executable Application][] documentation for more information
 on creating SEA builds with assets.
 
@@ -628,6 +633,7 @@ fields use synthetic but stable values:
 [CommonJS resolution algorithm]: modules.md#all-together
 [ES modules resolution algorithm]: esm.md#resolution-algorithm
 [Explicit Resource Management]: https://github.com/tc39/proposal-explicit-resource-management
+[Serving the assets from a ZIP archive]: single-executable-applications.md#serving-the-assets-from-a-zip-archive-with-vfsarchive
 [Single Executable Application]: single-executable-applications.md
 [`MemoryProvider`]: #class-memoryprovider
 [`RealFSProvider`]: #class-realfsprovider
 
@@ -1,6 +1,15 @@
 'use strict';
 
-const { isSea, isVfsEnabled } = internalBinding('sea');
+const {
+  ObjectKeys,
+} = primordials;
+
+const {
+  isSea,
+  isVfsEnabled,
+  isVfsArchiveEnabled,
+  getAsset,
+} = internalBinding('sea');
 const { kEmptyObject } = require('internal/util');
 const {
   codes: {
@@ -38,9 +47,14 @@ function initSeaVfs(options = kEmptyObject) {
   }
 
   const { VirtualFileSystem } = require('internal/vfs/file_system');
-  const { SEAProvider } = require('internal/vfs/providers/sea');
 
-  const provider = new SEAProvider({ extraFiles: options.extraFiles });
+  let provider;
+  if (isVfsArchiveEnabled()) {
+    provider = createZipProvider(options.extraFiles);
+  } else {
+    const { SEAProvider } = require('internal/vfs/providers/sea');
+    provider = new SEAProvider({ extraFiles: options.extraFiles });
+  }
   // The SEA warning already covers the feature; don't emit the
   // VirtualFileSystem experimental warning for the implicit SEA mount.
   const vfs = new VirtualFileSystem(provider, {
@@ -51,6 +65,43 @@ function initSeaVfs(options = kEmptyObject) {
   return vfs;
 }
 
+// The reserved asset key under which --build-sea stores the ZIP archive
+// named by "vfsArchive". Must match kVfsArchiveAssetName in src/node_sea.cc.
+const kVfsArchiveAssetName = 'node:sea:vfs.zip';
+
+/**
+ * Creates a ZipProvider over the ZIP archive embedded by `"vfsArchive"`.
+ * The archive bytes are used in place (a zero-copy view over the SEA
+ * blob); entries are inflated on demand when they are opened.
+ * The extra files (the SEA main script) are added to the in-memory archive
+ * index as stored entries, leaving the embedded bytes untouched.
+ * @param {Record<string, string|Buffer>} [extraFiles] Additional files to
+ *   serve alongside the assets (used for the SEA main script)
+ * @returns {ZipProvider}
+ */
+function createZipProvider(extraFiles) {
+  const { Buffer } = require('buffer');
+  const { ZipBuffer } = require('internal/zip');
+  const { ZipProvider } = require('internal/vfs/providers/ziparchive');
+
+  // getAsset returns a zero-copy ArrayBuffer over the (possibly read-only)
+  // SEA blob; ZipBuffer only reads from it, and decompressed contents are
+  // fresh buffers, so the view can be used without copying the archive.
+  const archive = getAsset(kVfsArchiveAssetName);
+  const zip = new ZipBuffer(Buffer.from(archive));
+
+  if (extraFiles !== undefined) {
+    const names = ObjectKeys(extraFiles);
+    for (let i = 0; i < names.length; i++) {
+      const content = extraFiles[names[i]];
+      const data = typeof content === 'string' ? Buffer.from(content) : content;
+      zip.addSync(names[i], data, { __proto__: null, method: 'store' });
+    }
+  }
+
+  return new ZipProvider(zip);
+}
+
 /* c8 ignore stop */
 
 module.exports = {
 
@@ -44,6 +44,10 @@ using v8::Value;
 namespace node {
 namespace sea {
 
+// The reserved asset key under which the ZIP archive named by "vfsArchive"
+// is stored. Must match the name used by lib/internal/vfs/sea.js.
+constexpr std::string_view kVfsArchiveAssetName = "node:sea:vfs.zip";
+
 namespace {
 
 SeaFlags operator|(SeaFlags x, SeaFlags y) {
@@ -272,6 +276,15 @@ void IsVfsEnabled(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(enabled);
 }
 
+void IsVfsArchiveEnabled(const FunctionCallbackInfo<Value>& args) {
+  bool enabled = false;
+  if (IsSingleExecutable()) {
+    const SeaResource& sea_resource = FindSingleExecutableResource();
+    enabled = static_cast<bool>(sea_resource.flags & SeaFlags::kVfsArchive);
+  }
+  args.GetReturnValue().Set(enabled);
+}
+
 void IsExperimentalSeaWarningNeeded(const FunctionCallbackInfo<Value>& args) {
   bool is_building_sea =
       !per_process::cli_options->experimental_sea_config.empty();
@@ -466,6 +479,16 @@ std::optional<SeaConfig> ParseSingleExecutableConfig(
       if (use_vfs) {
         result.flags |= SeaFlags::kEnableVfs;
       }
+    } else if (key == "vfsArchive") {
+      std::string_view archive_path;
+      if (field.value().get_string().get(archive_path)) {
+        FPrintF(stderr,
+                "\"vfsArchive\" field of %s is not a string\n",
+                config_path);
+        return std::nullopt;
+      }
+      result.vfs_archive_path = archive_path;
+      result.flags |= SeaFlags::kVfsArchive;
     } else if (key == "assets") {
       simdjson::ondemand::object assets_object;
       if (field.value().get_object().get(assets_object)) {
@@ -597,6 +620,26 @@ std::optional<SeaConfig> ParseSingleExecutableConfig(
     }
   }
 
+  if (static_cast<bool>(result.flags & SeaFlags::kVfsArchive)) {
+    if (!static_cast<bool>(result.flags & SeaFlags::kEnableVfs)) {
+      FPrintF(stderr, "\"vfsArchive\" requires \"useVfs\" to be true\n");
+      return std::nullopt;
+    }
+    if (!result.assets.empty()) {
+      FPrintF(stderr,
+              "\"vfsArchive\" cannot be used together with \"assets\"\n");
+      return std::nullopt;
+    }
+    if (result.vfs_archive_path.empty()) {
+      FPrintF(stderr,
+              "\"vfsArchive\" field of %s is not a non-empty string\n",
+              config_path);
+      return std::nullopt;
+    }
+    // The archive is embedded as a single reserved asset.
+    result.flags |= SeaFlags::kIncludeAssets;
+  }
+
   if (result.main_path.empty()) {
     FPrintF(stderr,
             "\"main\" field of %s is not a non-empty string\n",
@@ -808,6 +851,27 @@ ExitCode GenerateSingleExecutableBlob(
   if (!config.assets.empty() && BuildAssets(config.assets, &assets) != 0) {
     return ExitCode::kGenericUserError;
   }
+  if (static_cast<bool>(config.flags & SeaFlags::kVfsArchive)) {
+    std::string archive;
+    int r = ReadFileSync(&archive, config.vfs_archive_path.c_str());
+    if (r != 0) {
+      const char* err = uv_strerror(r);
+      FPrintF(stderr,
+              "Cannot read vfsArchive %s: %s\n",
+              config.vfs_archive_path,
+              err);
+      return ExitCode::kGenericUserError;
+    }
+    // Only a signature sanity check; the archive is parsed by the ZIP
+    // support in JS when the executable starts.
+    if (archive.size() < 4 || archive[0] != 'P' || archive[1] != 'K') {
+      FPrintF(stderr,
+              "vfsArchive %s is not a ZIP archive\n",
+              config.vfs_archive_path);
+      return ExitCode::kGenericUserError;
+    }
+    assets.emplace(std::string(kVfsArchiveAssetName), std::move(archive));
+  }
   std::unordered_map<std::string_view, std::string_view> assets_view;
   for (auto const& [key, content] : assets) {
     assets_view.emplace(key, content);
@@ -983,6 +1047,7 @@ void Initialize(Local<Object> target,
 
   SetMethod(context, target, "isSea", IsSea);
   SetMethod(context, target, "isVfsEnabled", IsVfsEnabled);
+  SetMethod(context, target, "isVfsArchiveEnabled", IsVfsArchiveEnabled);
   SetMethod(context,
             target,
             "isExperimentalSeaWarningNeeded",
@@ -994,6 +1059,7 @@ void Initialize(Local<Object> target,
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(IsSea);
   registry->Register(IsVfsEnabled);
+  registry->Register(IsVfsArchiveEnabled);
   registry->Register(IsExperimentalSeaWarningNeeded);
   registry->Register(GetAsset);
   registry->Register(GetAssetKeys);
 
@@ -31,6 +31,7 @@ enum class SeaFlags : uint32_t {
   kIncludeAssets = 1 << 3,
   kIncludeExecArgv = 1 << 4,
   kEnableVfs = 1 << 5,
+  kVfsArchive = 1 << 6,
 };
 
 enum class SeaExecArgvExtension : uint8_t {
@@ -48,6 +49,7 @@ struct SeaConfig {
   ModuleFormat main_format = ModuleFormat::kCommonJS;
   std::unordered_map<std::string, std::string> assets;
   std::vector<std::string> exec_argv;
+  std::string vfs_archive_path;
 };
 
 struct SeaResource {
 
@@ -0,0 +1 @@
+{"name":"test-app","version":"1.0.0"}
@@ -0,0 +1 @@
+Hello from SEA VFS!
@@ -0,0 +1,4 @@
+module.exports = {
+  add: (a, b) => a + b,
+  multiply: (a, b) => a * b,
+};
@@ -0,0 +1,6 @@
+{
+  "main": "sea.js",
+  "output": "sea-prep.blob",
+  "useVfs": true,
+  "vfsArchive": "assets.zip"
+}
@@ -0,0 +1,61 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const assert = require('assert');
+
+// With "useVfsZip", the bundled assets are stored as a single ZIP archive
+// and mounted through the ZipProvider. Everything is reachable through
+// __dirname-relative paths and relative requires, like the plain SEA VFS.
+
+// The main script runs from inside the VFS, not from the executable.
+assert.notStrictEqual(__filename, process.execPath);
+assert.strictEqual(path.basename(__filename), 'sea.js');
+assert.strictEqual(require.main, module);
+console.log('main script runs from', __filename);
+
+// The main script itself is readable through fs.
+assert.strictEqual(fs.existsSync(__filename), true);
+
+// Read the config file through standard fs (decompressed from the archive).
+const config = JSON.parse(
+  fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8'));
+assert.strictEqual(config.name, 'test-app');
+assert.strictEqual(config.version, '1.0.0');
+
+// Read a nested text file.
+const greeting = fs.readFileSync(
+  path.join(__dirname, 'data', 'greeting.txt'), 'utf8');
+assert.strictEqual(greeting, 'Hello from SEA VFS!');
+
+// existsSync and statSync work, including for implicit directories.
+assert.strictEqual(fs.existsSync(path.join(__dirname, 'nonexistent.txt')), false);
+assert.strictEqual(fs.statSync(path.join(__dirname, 'config.json')).isFile(), true);
+assert.strictEqual(fs.statSync(path.join(__dirname, 'data')).isDirectory(), true);
+
+// readdirSync lists archive entries and the injected main script.
+const entries = fs.readdirSync(__dirname);
+assert.ok(entries.includes('config.json'));
+assert.ok(entries.includes('data'));
+assert.ok(entries.includes('sea.js'));
+
+// Relative require of a module stored (deflated) in the archive.
+const math = require('./modules/math.js');
+assert.strictEqual(math.add(2, 3), 5);
+
+// Bare specifier lookup inside the mount.
+const pkg = require('test-pkg');
+assert.strictEqual(pkg.greet('SEA'), 'Hello, SEA!');
+
+// node:sea assets are replaced by the archive in zip mode; the VFS is the
+// way to read individual assets.
+const sea = require('node:sea');
+assert.strictEqual(sea.isSea(), true);
+
+// Repeated reads return independent buffers.
+const a = fs.readFileSync(path.join(__dirname, 'data', 'greeting.txt'));
+const b = fs.readFileSync(path.join(__dirname, 'data', 'greeting.txt'));
+assert.notStrictEqual(a, b);
+a[0] = 0;
+assert.strictEqual(b.toString('utf8'), 'Hello from SEA VFS!');
+
+console.log('All SEA VFS zip tests passed!');