diff --git a/Vagrantfile b/Vagrantfile
index 81ff99b7a..e67025c57 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -272,7 +272,6 @@ EOF
         'GOTESTSUM_JUNITFILE': ENV['GOTESTSUM_JUNITFILE'],
         'GOTESTSUM_JSONFILE': ENV['GOTESTSUM_JSONFILE'],
         'GITHUB_WORKSPACE': '',
-        'DISABLE_CRI_SANDBOXES': ENV['DISABLE_CRI_SANDBOXES'],
     }
     sh.inline = <<~SHELL
         #!/usr/bin/env bash
diff --git a/containerd.service b/containerd.service
index f8b925e56..7edd64645 100644
--- a/containerd.service
+++ b/containerd.service
@@ -18,8 +18,6 @@ Documentation=https://containerd.io
 After=network.target local-fs.target
 
 [Service]
-#uncomment to fallback to legacy CRI plugin implementation with podsandbox support.
-#Environment="DISABLE_CRI_SANDBOXES=1"
 ExecStartPre=-/sbin/modprobe overlay
 ExecStart=/usr/local/bin/containerd
 
diff --git a/contrib/Dockerfile.test b/contrib/Dockerfile.test
index 4aeac8fda..2059e3219 100644
--- a/contrib/Dockerfile.test
+++ b/contrib/Dockerfile.test
@@ -94,7 +94,6 @@ RUN make BUILDTAGS="no_btrfs no_devmapper" bin/cri-integration.test
 RUN ./script/setup/install-failpoint-binaries
 # The test scripts need these env vars to be explicitly set
 ENV GITHUB_WORKSPACE=""
-ENV DISABLE_CRI_SANDBOXES=""
 ENV CONTAINERD_RUNTIME="io.containerd.runc.v2"
 CMD ["make", "cri-integration"]
 
diff --git a/integration/sandbox_run_rollback_test.go b/integration/sandbox_run_rollback_test.go
index e75acc37f..3e15e9bc0 100644
--- a/integration/sandbox_run_rollback_test.go
+++ b/integration/sandbox_run_rollback_test.go
@@ -31,15 +31,12 @@ import (
 	"testing"
 	"time"
 
-	runtimespec "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	criapiv1 "k8s.io/cri-api/pkg/apis/runtime/v1"
 
 	"github.com/containerd/containerd/pkg/cri/sbserver/podsandbox"
-	"github.com/containerd/containerd/pkg/cri/store/sandbox"
 	"github.com/containerd/containerd/pkg/failpoint"
-	"github.com/containerd/typeurl/v2"
 )
 
 const (
@@ -293,40 +290,12 @@ func TestRunPodSandboxAndTeardownCNISlow(t *testing.T) {
 	assert.Equal(t, sbConfig.Metadata.Uid, sb.Metadata.Uid)
 	assert.Equal(t, sbConfig.Metadata.Attempt, sb.Metadata.Attempt)
 
-	if os.Getenv("DISABLE_CRI_SANDBOXES") != "" {
-		// non-sbserver
-		t.Log("Get sandbox info (non-sbserver)")
-		_, info, err := SandboxInfo(sb.Id)
-		require.NoError(t, err)
-		require.False(t, info.NetNSClosed)
-		var netNS string
-		for _, n := range info.RuntimeSpec.Linux.Namespaces {
-			if n.Type == runtimespec.NetworkNamespace {
-				netNS = n.Path
-			}
-		}
-		assert.NotEmpty(t, netNS, "network namespace should be set")
+	t.Log("Get sandbox info (sbserver)")
+	_, info, err := sbserverSandboxInfo(sb.Id)
+	require.NoError(t, err)
+	require.False(t, info.NetNSClosed)
 
-		t.Log("Get sandbox container")
-		c, err := GetContainer(sb.Id)
-		require.NoError(t, err)
-		md, ok := c.Extensions["io.cri-containerd.sandbox.metadata"]
-		require.True(t, ok, "sandbox metadata should exist in extension")
-		i, err := typeurl.UnmarshalAny(md)
-		require.NoError(t, err)
-		require.IsType(t, &sandbox.Metadata{}, i)
-		metadata, ok := i.(*sandbox.Metadata)
-		require.True(t, ok)
-		assert.Equal(t, netNS, metadata.NetNSPath, "network namespace path should be the same in runtime spec and sandbox metadata")
-	} else {
-		// sbserver
-		t.Log("Get sandbox info (sbserver)")
-		_, info, err := sbserverSandboxInfo(sb.Id)
-		require.NoError(t, err)
-		require.False(t, info.NetNSClosed)
-
-		assert.NotEmpty(t, info.Metadata.NetNSPath, "network namespace should be set")
-	}
+	assert.NotEmpty(t, info.Metadata.NetNSPath, "network namespace should be set")
 }
 
 // sbserverSandboxInfo gets sandbox info.
diff --git a/script/test/cri-integration.sh b/script/test/cri-integration.sh
index fbc8019b2..40d9aa4f1 100755
--- a/script/test/cri-integration.sh
+++ b/script/test/cri-integration.sh
@@ -44,10 +44,6 @@ test_setup "${REPORT_DIR}"
 CMD=""
 if [ -n "${sudo}" ]; then
   CMD+="${sudo} "
-  # sudo strips environment variables, so add DISABLE_CRI_SANDBOXES back if present
-  if [ -n  "${DISABLE_CRI_SANDBOXES}" ]; then
-    CMD+="DISABLE_CRI_SANDBOXES='${DISABLE_CRI_SANDBOXES}' "
-  fi
 fi
 CMD+="${PWD}/bin/cri-integration.test"
 
diff --git a/script/test/utils.sh b/script/test/utils.sh
index a516e7031..619d434b9 100755
--- a/script/test/utils.sh
+++ b/script/test/utils.sh
@@ -222,10 +222,6 @@ run_containerd() {
   CMD=""
   if [ -n "${sudo}" ]; then
     CMD+="${sudo} "
-    # sudo strips environment variables, so add DISABLE_CRI_SANDBOXES back if present
-    if [ -n  "${DISABLE_CRI_SANDBOXES}" ]; then
-      CMD+="DISABLE_CRI_SANDBOXES='${DISABLE_CRI_SANDBOXES}' "
-    fi
   fi
   CMD+="${PWD}/bin/containerd"