diff --git a/contrib/ansible/cri-containerd.yaml b/contrib/ansible/cri-containerd.yaml
index 696f5d683..3e12f60d4 100644
--- a/contrib/ansible/cri-containerd.yaml
+++ b/contrib/ansible/cri-containerd.yaml
@@ -61,6 +61,6 @@
     # TODO This needs to be removed once we have consistent concurrent pull results
     - name: "Pre-pull pause container image"
       shell: |
-        /usr/local/bin/ctr pull registry.k8s.io/pause:3.7
+        /usr/local/bin/ctr pull registry.k8s.io/pause:3.9
         /usr/local/bin/crictl --runtime-endpoint unix:///run/containerd/containerd.sock \
-        pull registry.k8s.io/pause:3.7
+        pull registry.k8s.io/pause:3.9
diff --git a/docs/cri/config.md b/docs/cri/config.md
index f7f17df63..1b4603b6b 100644
--- a/docs/cri/config.md
+++ b/docs/cri/config.md
@@ -137,7 +137,7 @@ version = 2
   selinux_category_range = 1024
 
   # sandbox_image is the image used by sandbox container.
-  sandbox_image = "registry.k8s.io/pause:3.7"
+  sandbox_image = "registry.k8s.io/pause:3.9"
 
   # stats_collect_period is the period (in seconds) of snapshots stats collection.
   stats_collect_period = 10
diff --git a/docs/cri/crictl.md b/docs/cri/crictl.md
index 5e61372bf..3881309c9 100644
--- a/docs/cri/crictl.md
+++ b/docs/cri/crictl.md
@@ -59,29 +59,29 @@ command. With the load command you inject a container image into the container
 runtime from a file. First you need to create a container image tarball. For
 example to create an image tarball for a pause container using Docker:
 ```console
-$ docker pull registry.k8s.io/pause:3.7
-  3.7: Pulling from pause
+$ docker pull registry.k8s.io/pause:3.9
+  3.9: Pulling from pause
   7582c2cc65ef: Pull complete
-  Digest: sha256:bb6ed397957e9ca7c65ada0db5c5d1c707c9c8afc80a94acbe69f3ae76988f0c
-  Status: Downloaded newer image for registry.k8s.io/pause:3.7
-  registry.k8s.io/pause:3.7
-$ docker save registry.k8s.io/pause:3.7 -o pause.tar
+  Digest: sha256:7031c1b283388d2c2e09b57badb803c05ebed362dc88d84b480cc47f72a21097
+  Status: Downloaded newer image for registry.k8s.io/pause:3.9
+  registry.k8s.io/pause:3.9
+$ docker save registry.k8s.io/pause:3.9 -o pause.tar
 ```
 Then use `ctr` to load the container image into the container runtime:
 ```console
 # The cri plugin uses the "k8s.io" containerd namespace.
 $ sudo ctr -n=k8s.io images import pause.tar
-  Loaded image: registry.k8s.io/pause:3.7
+  Loaded image: registry.k8s.io/pause:3.9
 ```
 List images and inspect the pause image:
 ```console
 $ sudo crictl images
 IMAGE                       TAG                 IMAGE ID            SIZE
 docker.io/library/busybox   latest              f6e427c148a76       728kB
-registry.k8s.io/pause            3.7                 221177c6082a8       311kB
-$ sudo crictl inspecti 221177c6082a8
+registry.k8s.io/pause            3.9                 e6f181688397       311kB
+$ sudo crictl inspecti e6f181688397
   ... displays information about the pause image.
-$ sudo crictl inspecti registry.k8s.io/pause:3.7
+$ sudo crictl inspecti registry.k8s.io/pause:3.9
   ... displays information about the pause image.
 ```
 
@@ -290,7 +290,7 @@ $ crictl info
     "streamIdleTimeout": "4h0m0s",
     "enableSelinux": false,
     "selinuxCategoryRange": 1024,
-    "sandboxImage": "registry.k8s.io/pause:3.8",
+    "sandboxImage": "registry.k8s.io/pause:3.9",
     "statsCollectPeriod": 10,
     "systemdCgroup": false,
     "enableTLSStreaming": false,
diff --git a/integration/images/image_list.go b/integration/images/image_list.go
index d7cce9524..000ce73ef 100644
--- a/integration/images/image_list.go
+++ b/integration/images/image_list.go
@@ -50,7 +50,7 @@ func initImages(imageListFile string) {
 	imageList = ImageList{
 		Alpine:           "ghcr.io/containerd/alpine:3.14.0",
 		BusyBox:          "ghcr.io/containerd/busybox:1.36",
-		Pause:            "registry.k8s.io/pause:3.8",
+		Pause:            "registry.k8s.io/pause:3.9",
 		ResourceConsumer: "registry.k8s.io/e2e-test-images/resource-consumer:1.10",
 		VolumeCopyUp:     "ghcr.io/containerd/volume-copy-up:2.1",
 		VolumeOwnership:  "ghcr.io/containerd/volume-ownership:2.1",
diff --git a/integration/images/image_list.sample.toml b/integration/images/image_list.sample.toml
index a19961bf1..5fe248189 100644
--- a/integration/images/image_list.sample.toml
+++ b/integration/images/image_list.sample.toml
@@ -1,6 +1,6 @@
 alpine = "docker.io/library/alpine:latest"
 busybox = "docker.io/library/busybox:latest"
-pause = "registry.k8s.io/pause:3.7"
+pause = "registry.k8s.io/pause:3.9"
 VolumeCopyUp = "ghcr.io/containerd/volume-copy-up:2.1"
 VolumeOwnership = "ghcr.io/containerd/volume-ownership:2.1"
 ArgsEscaped = "cplatpublic.azurecr.io/args-escaped-test-image-ns:1.0"
diff --git a/pkg/cri/config/config_unix.go b/pkg/cri/config/config_unix.go
index 990b30d06..09b04eba2 100644
--- a/pkg/cri/config/config_unix.go
+++ b/pkg/cri/config/config_unix.go
@@ -85,7 +85,7 @@ func DefaultConfig() PluginConfig {
 			TLSKeyFile:  "",
 			TLSCertFile: "",
 		},
-		SandboxImage:                     "registry.k8s.io/pause:3.8",
+		SandboxImage:                     "registry.k8s.io/pause:3.9",
 		StatsCollectPeriod:               10,
 		MaxContainerLogLineSize:          16 * 1024,
 		MaxConcurrentDownloads:           3,
diff --git a/pkg/cri/config/config_windows.go b/pkg/cri/config/config_windows.go
index 5cda9babe..a9f954a37 100644
--- a/pkg/cri/config/config_windows.go
+++ b/pkg/cri/config/config_windows.go
@@ -74,7 +74,7 @@ func DefaultConfig() PluginConfig {
 			TLSKeyFile:  "",
 			TLSCertFile: "",
 		},
-		SandboxImage:              "registry.k8s.io/pause:3.8",
+		SandboxImage:              "registry.k8s.io/pause:3.9",
 		StatsCollectPeriod:        10,
 		MaxContainerLogLineSize:   16 * 1024,
 		MaxConcurrentDownloads:    3,