diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml
index dc5bbd358c5..c54e9deb570 100644
--- a/.github/workflows/workflow-test.yml
+++ b/.github/workflows/workflow-test.yml
@@ -140,9 +140,9 @@ jobs:
       canary: ${{ matrix.canary && true || false }}
       go-version: 1.24
       windows-cni-version: v0.3.1
-      containerd-version: 2.0.5
+      containerd-version: 2.1.0
       # Note: these as for amd64
-      containerd-sha: 88ab31f3e78e4d2fa12dcb933032122d11d441c83b79a89c6c8076f871e50df8
-      containerd-service-sha: 12a76c13cad132222d2b3d2025e56212d205d37eca77508dbbfcdf6ababbf70a
+      containerd-sha: 0e5359e957b66b679be807563a543c7416e305e3aafcf56bad90ef87a917014d
+      containerd-service-sha: 1941362cbaa89dd591b99c32b050d82c583d3cd2e5fa63085d7017457ec5fca8
       linux-cni-version: v1.7.1
       linux-cni-sha: 1a28a0506bfe5bcdc981caf1a49eeab7e72da8321f1119b7be85f22621013098
diff --git a/Dockerfile b/Dockerfile
index dbccb01d82b..25de5e11b6b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -17,7 +17,7 @@
 
 # Basic deps
 # @BINARY: the binary checksums are verified via Dockerfile.d/SHA256SUMS.d/<COMPONENT>-<VERSION>
-ARG CONTAINERD_VERSION=v2.0.5@fb4c30d4ede3531652d86197bf3fc9515e5276d9
+ARG CONTAINERD_VERSION=v2.1.0@061792f0ecf3684fb30a3a0eb006799b8c6638a7
 ARG RUNC_VERSION=v1.3.0@4ca628d1d4c974f92d24daccb901aa078aad748e
 ARG CNI_PLUGINS_VERSION=v1.7.1@BINARY