diff --git a/cmd/containerd/command/main_windows.go b/cmd/containerd/command/main_windows.go
index 8ed4a028a..3aa44c892 100644
--- a/cmd/containerd/command/main_windows.go
+++ b/cmd/containerd/command/main_windows.go
@@ -24,7 +24,9 @@ import (
 	"unsafe"
 
 	winio "github.com/Microsoft/go-winio"
+	"github.com/Microsoft/go-winio/pkg/etw"
 	"github.com/Microsoft/go-winio/pkg/etwlogrus"
+	"github.com/Microsoft/go-winio/pkg/guid"
 	"github.com/containerd/containerd/log"
 	"github.com/containerd/containerd/services/server"
 	"github.com/sirupsen/logrus"
@@ -91,11 +93,25 @@ func setupDumpStacks() {
 	}()
 }
 
-func init() {
-	// Provider ID: {2acb92c0-eb9b-571a-69cf-8f3410f383ad}
-	// Hook isn't closed explicitly, as it will exist until process exit.
-	// GUID is generated based on name - see Microsoft/go-winio/tools/etw-provider-gen.
-	if hook, err := etwlogrus.NewHook("ContainerD"); err == nil {
-		logrus.AddHook(hook)
+func etwCallback(sourceID *guid.GUID, state etw.ProviderState, level etw.Level, matchAnyKeyword uint64, matchAllKeyword uint64, filterData uintptr) {
+	if state == etw.ProviderStateCaptureState {
+		dumpStacks()
+	}
+}
+
+func init() {
+	// Provider ID: 2acb92c0-eb9b-571a-69cf-8f3410f383ad
+	// Provider and hook aren't closed explicitly, as they will exist until
+	// process exit. GUID is generated based on name - see
+	// Microsoft/go-winio/tools/etw-provider-gen.
+	provider, err := etw.NewProvider("ContainerD", etwCallback)
+	if err != nil {
+		logrus.Error(err)
+	} else {
+		if hook, err := etwlogrus.NewHookFromProvider(provider); err == nil {
+			logrus.AddHook(hook)
+		} else {
+			logrus.Error(err)
+		}
 	}
 }