diff --git a/client_windows_test.go b/client_windows_test.go
index ea94c8014..1cd50e5ea 100644
--- a/client_windows_test.go
+++ b/client_windows_test.go
@@ -50,10 +50,12 @@ func init() {
 		testImage = "mcr.microsoft.com/windows/nanoserver:1809"
 	case osversion.V19H1:
 		testImage = "mcr.microsoft.com/windows/nanoserver:1903"
-	case 18363: // this isn't in osversion yet, but the image should be available
+	case osversion.V19H2:
 		testImage = "mcr.microsoft.com/windows/nanoserver:1909"
-	case 19041: // this isn't in osversion yet, but the image should be available
+	case osversion.V20H1:
 		testImage = "mcr.microsoft.com/windows/nanoserver:2004"
+	case osversion.V20H2:
+		testImage = "mcr.microsoft.com/windows/nanoserver:20H2"
 	default:
 		fmt.Println("No test image defined for Windows build version:", b)
 		panic("No windows test image found for this Windows build")
diff --git a/pkg/cri/config/config_windows.go b/pkg/cri/config/config_windows.go
index 44efd281f..40766bed3 100644
--- a/pkg/cri/config/config_windows.go
+++ b/pkg/cri/config/config_windows.go
@@ -54,7 +54,7 @@ func DefaultConfig() PluginConfig {
 			TLSKeyFile:  "",
 			TLSCertFile: "",
 		},
-		SandboxImage:            "mcr.microsoft.com/oss/kubernetes/pause:1.4.0",
+		SandboxImage:            "mcr.microsoft.com/oss/kubernetes/pause:1.4.1",
 		StatsCollectPeriod:      10,
 		MaxContainerLogLineSize: 16 * 1024,
 		Registry: Registry{