diff --git a/pkg/server/container_create.go b/pkg/server/container_create.go
index 06af0ce8a..cbed9e236 100644
--- a/pkg/server/container_create.go
+++ b/pkg/server/container_create.go
@@ -313,7 +313,10 @@ func (c *criService) runtimeSpec(id string, baseSpecFile string, opts ...oci.Spe
 			return nil, errors.Wrap(err, "failed to clone OCI spec")
 		}
 
-		if err := oci.ApplyOpts(ctx, nil, container, &spec, opts...); err != nil {
+		// Fix up cgroups path
+		applyOpts := append([]oci.SpecOpts{oci.WithNamespacedCgroup()}, opts...)
+
+		if err := oci.ApplyOpts(ctx, nil, container, &spec, applyOpts...); err != nil {
 			return nil, errors.Wrap(err, "failed to apply OCI options")
 		}
 
diff --git a/pkg/server/container_create_test.go b/pkg/server/container_create_test.go
index 341715459..b1c6cc8b3 100644
--- a/pkg/server/container_create_test.go
+++ b/pkg/server/container_create_test.go
@@ -29,6 +29,7 @@ import (
 	runtime "k8s.io/cri-api/pkg/apis/runtime/v1alpha2"
 
 	"github.com/containerd/cri/pkg/config"
+	"github.com/containerd/cri/pkg/constants"
 	"github.com/containerd/cri/pkg/containerd/opts"
 )
 
@@ -401,4 +402,6 @@ func TestBaseRuntimeSpec(t *testing.T) {
 	// Make sure original base spec not changed
 	assert.NotEqual(t, out, c.baseOCISpecs["/etc/containerd/cri-base.json"])
 	assert.Equal(t, c.baseOCISpecs["/etc/containerd/cri-base.json"].Hostname, "old")
+
+	assert.Equal(t, filepath.Join("/", constants.K8sContainerdNamespace, "id1"), out.Linux.CgroupsPath)
 }