Simple fix: use a depletion MOSFET. This has negative Vgs(th), so that normally the source is pulled above the gate by a few volts, when wired as a source follower (as here). When the zener is not conducting, the gate is pulled up to drain, and the transistor saturates with low dropout*. As input rises, the zener begins to conduct, and output voltage is limited.
A zener from gate to source may be prudent, to cover for cases where the input is suddenly pulled down, faster than the gate node would otherwise fall, and thus cause Vgs overvoltage.
*As always, to be clear: I mean voltage saturation here. I would like "current saturation" or "FET saturation" to simply be forgotten, they aren't consistent with any other use of the term; but until such time, I will continue adding this note.
Depletion MOSFETs aren't available in a huge variety of ratings, but if your load is small (say, 10mA?), a DPAK size device will easily handle this. Namely, I did an application for a small control unit in automotive setting, some years ago; with a DN2625K4-G and a 43V zener, and a maximum current draw of something like 10 or 20mA at 40V, it handled not only the worst load dump specified, but indeed continuous operation at input of 100V or more.
For higher current loads, transistor size and SOA quickly become a concern, not to mention the cost and limited selection of depletion types. A turn-off scheme quickly becomes desirable, whether by discrete circuitry (a few transistors, a comparator, etc.?), or integrated means (e.g. LT4363 "surge stopper").
If the circuit must remain operational through the load dump pulse, you could do worse than adding a whole switching pre-regulator (but, make sure it is capable of 100% duty cycle for low dropout in normal operation). Options won't be cheap in this case, but a switching pre-regulator is one of the more appealing ones.
