diff --git a/archive/tar_opts_windows.go b/archive/tar_opts_windows.go
index 0ba3cd082..567a3c352 100644
--- a/archive/tar_opts_windows.go
+++ b/archive/tar_opts_windows.go
@@ -20,13 +20,22 @@ import (
 	"context"
 	"io"
 
+	"github.com/Microsoft/go-winio"
 	"github.com/Microsoft/hcsshim/pkg/ociwclayer"
 )
 
 // applyWindowsLayer applies a tar stream of an OCI style diff tar of a Windows layer
 // See https://github.com/opencontainers/image-spec/blob/main/layer.md#applying-changesets
 func applyWindowsLayer(ctx context.Context, root string, r io.Reader, options ApplyOptions) (size int64, err error) {
-	return ociwclayer.ImportLayerFromTar(ctx, r, root, options.Parents)
+	// It seems that in certain situations, like having the containerd root and state on a file system hosted on a
+	// mounted VHDX, we need SeSecurityPrivilege when opening a file with winio.ACCESS_SYSTEM_SECURITY. This happens
+	// in the base layer writer in hcsshim when adding a new file.
+	err = winio.RunWithPrivileges([]string{winio.SeSecurityPrivilege}, func() error {
+		var innerErr error
+		size, innerErr = ociwclayer.ImportLayerFromTar(ctx, r, root, options.Parents)
+		return innerErr
+	})
+	return
 }
 
 // AsWindowsContainerLayer indicates that the tar stream to apply is that of
diff --git a/snapshots/windows/windows.go b/snapshots/windows/windows.go
index 8e79f10e7..b96041b1e 100644
--- a/snapshots/windows/windows.go
+++ b/snapshots/windows/windows.go
@@ -478,7 +478,13 @@ func (s *snapshotter) convertScratchToReadOnlyLayer(ctx context.Context, snapsho
 		writer.CloseWithError(err)
 	}()
 
-	if _, err := ociwclayer.ImportLayerFromTar(ctx, reader, path, parentLayerPaths); err != nil {
+	// It seems that in certain situations, like having the containerd root and state on a file system hosted on a
+	// mounted VHDX, we need SeSecurityPrivilege when opening a file with winio.ACCESS_SYSTEM_SECURITY. This happens
+	// in the base layer writer in hcsshim when adding a new file.
+	if err := winio.RunWithPrivileges([]string{winio.SeSecurityPrivilege}, func() error {
+		_, err := ociwclayer.ImportLayerFromTar(ctx, reader, path, parentLayerPaths)
+		return err
+	}); err != nil {
 		return fmt.Errorf("failed to reimport snapshot: %w", err)
 	}