diff --git a/Makefile b/Makefile
index cc4ed89ac..958faee68 100644
--- a/Makefile
+++ b/Makefile
@@ -282,6 +282,7 @@ install-cri-deps: $(BINARIES)
 	DESTDIR=$(CRIDIR) script/setup/install-runc
 	DESTDIR=$(CRIDIR) script/setup/install-cni
 	DESTDIR=$(CRIDIR) script/setup/install-critools
+	DESTDIR=$(CRIDIR) script/setup/install-imgcrypt
 
 	@install -d $(CRIDIR)/bin
 	@install $(BINARIES) $(CRIDIR)/bin
diff --git a/script/setup/imgcrypt-version b/script/setup/imgcrypt-version
new file mode 100644
index 000000000..795460fce
--- /dev/null
+++ b/script/setup/imgcrypt-version
@@ -0,0 +1 @@
+v1.1.0
diff --git a/script/setup/install-imgcrypt b/script/setup/install-imgcrypt
new file mode 100755
index 000000000..9c6735ac4
--- /dev/null
+++ b/script/setup/install-imgcrypt
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+#
+# Builds and installs imgcrypt including ctd-decoder and ctr-enc
+# to /usr/local/bin.
+#
+set -eu -o pipefail
+
+script_dir="$(cd -- "$(dirname -- "$0")" > /dev/null 2>&1; pwd -P)"
+
+: "${IMGCRYPT_COMMIT:=$(cat "${script_dir}/imgcrypt-version")}"
+
+TMPROOT=$(mktemp -d)
+git clone https://github.com/containerd/imgcrypt.git "${TMPROOT}"/imgcrypt
+pushd "${TMPROOT}"/imgcrypt
+git checkout "${IMGCRYPT_COMMIT}"
+make
+make install -e DESTDIR="${DESTDIR}/usr/local"
+
+popd
+rm -fR "${TMPROOT}"