diff --git a/Dockerfile b/Dockerfile
index 4512babcd09..0f69003ac81 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -45,9 +45,9 @@ ARG BUILDG_VERSION=v0.4.1@BINARY
 ARG GO_VERSION=1.24
 ARG UBUNTU_VERSION=24.04
 ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.1
-ARG GOTESTSUM_VERSION=v1.12.0
+ARG GOTESTSUM_VERSION=v1.12.1
 ARG NYDUS_VERSION=v2.3.0
-ARG SOCI_SNAPSHOTTER_VERSION=0.8.0
+ARG SOCI_SNAPSHOTTER_VERSION=0.9.0
 ARG KUBO_VERSION=v0.33.2
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1@sha256:923441d7c25f1e2eb5789f82d987693c47b8ed987c4ab3b075d6ed2b5d6779a3 AS xx
diff --git a/go.mod b/go.mod
index ec2b281ed03..b8e3d32df45 100644
--- a/go.mod
+++ b/go.mod
@@ -25,7 +25,7 @@ require (
 	github.com/containerd/stargz-snapshotter/estargz v0.16.3
 	github.com/containerd/stargz-snapshotter/ipfs v0.16.3
 	github.com/containerd/typeurl/v2 v2.2.3
-	github.com/containernetworking/cni v1.2.3
+	github.com/containernetworking/cni v1.3.0
 	github.com/containernetworking/plugins v1.6.2
 	github.com/coreos/go-iptables v0.8.0
 	github.com/coreos/go-systemd/v22 v22.5.0
diff --git a/go.sum b/go.sum
index cda53f54463..633a8b3ec0c 100644
--- a/go.sum
+++ b/go.sum
@@ -65,8 +65,8 @@ github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRq
 github.com/containerd/ttrpc v1.2.7/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
 github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
 github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
-github.com/containernetworking/cni v1.2.3 h1:hhOcjNVUQTnzdRJ6alC5XF+wd9mfGIUaj8FuJbEslXM=
-github.com/containernetworking/cni v1.2.3/go.mod h1:DuLgF+aPd3DzcTQTtp/Nvl1Kim23oFKdm2okJzBQA5M=
+github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEmnuFjskwo=
+github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4=
 github.com/containernetworking/plugins v1.6.2 h1:pqP8Mq923TLyef5g97XfJ/xpDeVek4yF8A4mzy9Tc4U=
 github.com/containernetworking/plugins v1.6.2/go.mod h1:SP5UG3jDO9LtmfbBJdP+nl3A1atOtbj2MBOYsnaxy64=
 github.com/containers/ocicrypt v1.2.1 h1:0qIOTT9DoYwcKmxSt8QJt+VzMY18onl9jUXsxpVhSmM=
diff --git a/hack/configure-windows-ci.ps1 b/hack/configure-windows-ci.ps1
index 1c97a487182..c3505c269b4 100644
--- a/hack/configure-windows-ci.ps1
+++ b/hack/configure-windows-ci.ps1
@@ -18,7 +18,7 @@ echo "configuration complete! Printing configuration..."
 echo "Service:"
 get-service containerd
 echo "cni configuration"
-cat "$Env:ProgramFiles\containerd\cni\conf\0-containerd-nat.conf"
+cat "$Env:ProgramFiles\containerd\cni\conf\0-containerd-nat.conflist"
 ls "$Env:ProgramFiles\containerd\cni\bin"
 echo "containerd install"
 ls "$Env:ProgramFiles\containerd\"
diff --git a/hack/provisioning/windows/cni.sh b/hack/provisioning/windows/cni.sh
index 42e7549a724..8f6aae4323f 100755
--- a/hack/provisioning/windows/cni.sh
+++ b/hack/provisioning/windows/cni.sh
@@ -81,23 +81,27 @@ subnet="$(calculate_subnet "$GATEWAY" "$PREFIX_LEN")"
 # https://github.com/microsoft/windows-container-networking/pull/45),
 # so it must match a network type in:
 # https://docs.microsoft.com/en-us/windows-server/networking/technologies/hcn/hcn-json-document-schemas
-bash -c 'cat >"'"${CNI_CONFIG_DIR}"'"/0-containerd-nat.conf <<EOF
+bash -c 'cat >"'"${CNI_CONFIG_DIR}"'"/0-containerd-nat.conflist <<EOF
 {
-    "cniVersion": "1.0.0",
-    "name": "nat",
-    "type": "nat",
-    "master": "Ethernet",
-    "ipam": {
+  "cniVersion": "1.0.0",
+  "name": "nat",
+  "plugins": [
+    {
+      "type": "nat",
+      "master": "Ethernet",
+      "ipam": {
         "subnet": "'"$subnet"'",
         "routes": [
-            {
-                "GW": "'"$GATEWAY"'"
-            }
+          {
+            "GW": "'"$GATEWAY"'"
+          }
         ]
-    },
-    "capabilities": {
+      },
+      "capabilities": {
         "portMappings": true,
         "dns": true
+      }
     }
+  ]
 }
 EOF'
\ No newline at end of file
diff --git a/pkg/netutil/netutil.go b/pkg/netutil/netutil.go
index d4db0a0b1b9..f6e62fb2147 100644
--- a/pkg/netutil/netutil.go
+++ b/pkg/netutil/netutil.go
@@ -28,7 +28,6 @@ import (
 	"path/filepath"
 	"sort"
 	"strconv"
-	"strings"
 
 	"github.com/containernetworking/cni/libcni"
 
@@ -533,21 +532,9 @@ func cniLoad(fileNames []string) (configList []*NetworkConfig, err error) {
 		}
 
 		var netConfigList *libcni.NetworkConfigList
-		if strings.HasSuffix(fileName, ".conflist") {
-			netConfigList, err = libcni.ConfListFromBytes(bytes)
-			if err != nil {
-				return nil, wrapCNIError(fileName, err)
-			}
-		} else {
-			var netConfig *libcni.NetworkConfig
-			netConfig, err = libcni.ConfFromBytes(bytes)
-			if err != nil {
-				return nil, wrapCNIError(fileName, err)
-			}
-			netConfigList, err = libcni.ConfListFromConf(netConfig)
-			if err != nil {
-				return nil, wrapCNIError(fileName, err)
-			}
+		netConfigList, err = libcni.NetworkConfFromBytes(bytes)
+		if err != nil {
+			return nil, wrapCNIError(fileName, err)
 		}
 		id, nerdctlLabels := nerdctlIDLabels(netConfigList.Bytes)
 		configList = append(configList, &NetworkConfig{