diff --git a/tools/valgrind-wireshark.sh b/tools/valgrind-wireshark.sh
index 84f823e5a6..b83adc686d 100755
--- a/tools/valgrind-wireshark.sh
+++ b/tools/valgrind-wireshark.sh
@@ -102,4 +102,4 @@ else
     LIBTOOL=""
 fi
 
-$LIBTOOL valgrind $TOOL $VERBOSE $LEAK_CHECK $REACHABLE $TRACK_ORIGINS $COMMAND $COMMAND_ARGS $PCAP $COMMAND_ARGS2 > /dev/null
+$LIBTOOL valgrind --suppressions=`dirname $0`/vg-suppressions $TOOL $VERBOSE $LEAK_CHECK $REACHABLE $TRACK_ORIGINS $COMMAND $COMMAND_ARGS $PCAP $COMMAND_ARGS2 > /dev/null
diff --git a/tools/vg-suppressions b/tools/vg-suppressions
new file mode 100644
index 0000000000..c0bea41c02
--- /dev/null
+++ b/tools/vg-suppressions
@@ -0,0 +1,16 @@
+# This file lists suppressions to hide valgrind errors in libraries we don't
+# control. Be careful adding to it, since overly-broad suppressions may hide
+# real errors in Wireshark!
+#
+# This is primarily targeted towards the set of libraries on the fuzz-bot (which
+# runs a valgrind step) but other entries are welcome as long as they are
+# sufficiently commented.
+
+# Zlib 1.2.3.4 on the buildbot hits an uninitialized jump on the first call to
+# inflateReset2. According to the Zlib changelog this was fixed in 1.2.3.7.
+{
+    libz/inflateReset2/jump
+    Memcheck:Cond
+    fun:inflateReset2
+    fun:inflateInit2_
+}