diff --git a/pkg/agent/phases/nodestart/assets/containerd.toml b/pkg/agent/phases/nodestart/assets/containerd.toml
index 4fde3521f..c728daf02 100644
--- a/pkg/agent/phases/nodestart/assets/containerd.toml
+++ b/pkg/agent/phases/nodestart/assets/containerd.toml
@@ -4,6 +4,7 @@ oom_score = 0
 version = 2
 
 [plugins."io.containerd.grpc.v1.cri"]
+device_ownership_from_security_context = true
 sandbox_image = "{{.SandboxImage}}"
 
 [plugins."io.containerd.grpc.v1.cri".containerd]
diff --git a/pkg/agent/phases/nodestart/cri_test.go b/pkg/agent/phases/nodestart/cri_test.go
index 01bf6478c..0f40a2aa9 100644
--- a/pkg/agent/phases/nodestart/cri_test.go
+++ b/pkg/agent/phases/nodestart/cri_test.go
@@ -7,6 +7,7 @@ import (
 	"context"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -35,6 +36,36 @@ func TestConfigureContainerdWritesGantryHostsConfig(t *testing.T) {
 	require.Equal(t, os.FileMode(0o644), info.Mode().Perm())
 }
 
+func TestConfigureContainerdEnablesDeviceOwnershipFromSecurityContext(t *testing.T) {
+	t.Parallel()
+
+	machineDir := t.TempDir()
+	goalState := &goalstates.NodeStart{
+		MachineDir: machineDir,
+		Containerd: goalstates.ResolveContainerd(""),
+	}
+
+	require.NoError(t, ConfigureContainerd(goalState).Do(context.Background()))
+
+	path := filepath.Join(machineDir, goalstates.ContainerdConfigPath)
+	data, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	config := string(data)
+
+	const sectionHeader = `[plugins."io.containerd.grpc.v1.cri"]`
+
+	sectionStart := strings.Index(config, sectionHeader)
+	require.NotEqual(t, -1, sectionStart)
+
+	section := config[sectionStart+len(sectionHeader):]
+	if sectionEnd := strings.Index(section, "\n["); sectionEnd >= 0 {
+		section = section[:sectionEnd]
+	}
+
+	require.Contains(t, section, "device_ownership_from_security_context = true")
+}
+
 func TestConfigureContainerdUpdatesManagedGantryHostsConfig(t *testing.T) {
 	t.Parallel()