@@ -99,50 +99,48 @@ export async function writeTarFixture(
   entries: readonly TarFixtureEntry[],
 ): Promise<void> {
   const pack = tar.pack();
-  const zeroModeNames = new Set<string>();
-  for (const entry of entries) {
-    if (entry.header.mode === 0) zeroModeNames.add(entry.header.name);
+  const zeroModeEntries = new Set<number>();
+  entries.forEach((entry, index) => {
+    if (entry.header.mode === 0) zeroModeEntries.add(index);
     const header: tar.Headers & { pax?: Record<string, string> } = entry.pax
       ? { ...entry.header, pax: entry.pax }
       : { ...entry.header };
     pack.entry(header, Buffer.from(entry.data ?? ''));
-  }
+  });
   pack.finalize();
   const chunks: Buffer[] = [];
   for await (const chunk of pack) chunks.push(Buffer.from(chunk));
   const archive = Buffer.concat(chunks);
-  restoreZeroTarModes(archive, zeroModeNames);
+  restoreZeroTarModes(archive, zeroModeEntries);
   await fs.writeFile(archivePath, archive);
 }
 
 const TAR_BLOCK = 512;
+const PAX_TYPEFLAGS = new Set(['x', 'g']);
 
 /**
  * tar-stream's pack replaces a zero mode with its default, so a declared zero is written back into
- * the emitted ustar header, checksum included.
+ * the emitted ustar header, checksum included. Entries are matched by emitted order; the PAX
+ * extended header tar-stream emits before an entry is not counted.
  */
-function restoreZeroTarModes(archive: Buffer, names: ReadonlySet<string>): void {
-  if (names.size === 0) return;
+function restoreZeroTarModes(archive: Buffer, zeroModeEntries: ReadonlySet<number>): void {
+  if (zeroModeEntries.size === 0) return;
+  let entryIndex = 0;
   for (let offset = 0; offset + TAR_BLOCK <= archive.length;) {
     const block = archive.subarray(offset, offset + TAR_BLOCK);
-    const name = readTarField(block, 0, 100);
-    if (!name) return;
-    if (names.has(name.replace(/\/$/, ''))) {
-      block.write('000000 ', 100, 'ascii');
-      block.write(`${tarChecksum(block).toString(8).padStart(6, '0')} `, 148, 'ascii');
+    if (block.every((byte) => byte === 0)) return;
+    if (!PAX_TYPEFLAGS.has(String.fromCharCode(block[156]!))) {
+      if (zeroModeEntries.has(entryIndex)) {
+        block.write('000000 ', 100, 'ascii');
+        block.write(`${tarChecksum(block).toString(8).padStart(6, '0')} `, 148, 'ascii');
+      }
+      entryIndex += 1;
     }
-    const size = Number.parseInt(readTarField(block, 124, 12), 8) || 0;
+    const size = Number.parseInt(block.toString('ascii', 124, 136).split('\0')[0]!, 8) || 0;
     offset += TAR_BLOCK + Math.ceil(size / TAR_BLOCK) * TAR_BLOCK;
   }
 }
 
-function readTarField(block: Buffer, start: number, length: number): string {
-  return block
-    .toString('ascii', start, start + length)
-    .split('\0')[0]!
-    .trim();
-}
-
 function tarChecksum(block: Buffer): number {
   let sum = 8 * 0x20;
   for (let index = 0; index < TAR_BLOCK; index += 1) {
 
@@ -236,7 +236,11 @@ test.each<ArchiveFixture>([
     type: 'tar',
     entries: [
       { header: { name: 'App.app/private', type: 'directory', mode: 0 } },
-      { header: { name: 'App.app/private/secret', mode: 0 }, data: 'x' },
+      {
+        header: { name: 'App.app/private/secret', mode: 0 },
+        pax: { path: 'App.app/private/secret' },
+        data: 'x',
+      },
     ],
   },
 ])('an explicit $type mode of zero extracts with owner access only', async (fixture) => {