I find it hard to remember the exact command for creating a password-protected zip file because the source/destination paths are reversed. Zsh makes it super easy to create helper functions, so in case anyone else wants to use a more memorable syntax like encrypt secrets.txt here is a simple function:

function encrypt {
  zip -e "${1%.*}".zip $1

If you are using a setup like mine you can simply add this in ~/.zsh/config/post/encrypt and encrypt away.