Yup, Cdg is a real thing, particularly on old transistors under most conditions, and newer transistors at low Vds.
What are you protecting against? Are you expecting a very rapidly changing load voltage?
Which, actually, you should -- mechanical contacts are amazingly fast, in the sub-nanosecond range, so the dV/dt from hot-plugging a source to a load can be quite exciting indeed!
You'll want some inductance between the terminals and the transistor, and some extra capacitance at the transistor to help filter it. Probably an R+C as well, to dampen everything and help ensure it doesn't oscillate. Basic filtering stuff -- only use what bandwidth you need.
That will probably leave enough change at the transistor that you'll still want some protection, and yes, a zener from ground to gate will do a fine job.
Tim