diff --git a/plugins/cri/cri.go b/plugins/cri/cri.go
index 08be0f3bd..b87be27eb 100644
--- a/plugins/cri/cri.go
+++ b/plugins/cri/cri.go
@@ -58,29 +58,9 @@ func init() {
 			plugins.TransferPlugin,
 			plugins.WarningPlugin,
 		},
-		Config: &defaultConfig,
-		ConfigMigration: func(ctx context.Context, configVersion int, pluginConfigs map[string]interface{}) error {
-			if configVersion >= version.ConfigVersion {
-				return nil
-			}
-			const pluginName = string(plugins.GRPCPlugin) + ".cri"
-			original, ok := pluginConfigs[pluginName]
-			if !ok {
-				return nil
-			}
-			src := original.(map[string]interface{})
-
-			// Currently only a single key migrated
-			if val, ok := src["disable_tcp_service"]; ok {
-				pluginConfigs[pluginName] = map[string]interface{}{
-					"disable_tcp_service": val,
-				}
-			} else {
-				delete(pluginConfigs, pluginName)
-			}
-			return nil
-		},
-		InitFn: initCRIService,
+		Config:          &defaultConfig,
+		ConfigMigration: configMigration,
+		InitFn:          initCRIService,
 	})
 }
 
@@ -255,3 +235,31 @@ func getSandboxControllers(ic *plugin.InitContext) (map[string]sandbox.Controlle
 	}
 	return sc, nil
 }
+
+func configMigration(ctx context.Context, configVersion int, pluginConfigs map[string]interface{}) error {
+	if configVersion >= version.ConfigVersion {
+		return nil
+	}
+	const pluginName = string(plugins.GRPCPlugin) + ".cri"
+	src, ok := pluginConfigs[pluginName].(map[string]interface{})
+	if !ok {
+		return nil
+	}
+
+	dst := map[string]interface{}{}
+	for _, k := range []string{
+		"disable_tcp_service",
+		"stream_server_address",
+		"stream_server_port",
+		"stream_idle_timeout",
+		"enable_tls_streaming",
+		"x509_key_pair_streaming",
+	} {
+		if val, ok := src[k]; ok {
+			dst[k] = val
+		}
+	}
+
+	pluginConfigs[pluginName] = dst
+	return nil
+}
diff --git a/plugins/cri/cri_test.go b/plugins/cri/cri_test.go
new file mode 100644
index 000000000..60d787abd
--- /dev/null
+++ b/plugins/cri/cri_test.go
@@ -0,0 +1,68 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package cri
+
+import (
+	"context"
+	"testing"
+
+	"github.com/containerd/containerd/v2/plugins"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCRIGRPCServerConfigMigration(t *testing.T) {
+	pluginName := string(plugins.GRPCPlugin) + ".cri"
+
+	src := map[string]interface{}{
+		// these should be removed in the new cri grpc config
+		"registry": map[string]interface{}{
+			"config_path": "/etc/containerd/certs.d",
+		},
+		"containerd": map[string]interface{}{
+			"default_runtime_name": "runc",
+		},
+
+		// these should be kept in the new cri grpc config
+		"disable_tcp_service":   false,
+		"stream_server_address": "127.0.0.2",
+		"stream_server_port":    "10000",
+		"stream_idle_timeout":   "3h0m0s",
+		"enable_tls_streaming":  true,
+		"x509_key_pair_streaming": map[string]interface{}{
+			"cert_file": "/etc/containerd/certs.d/server.crt",
+			"key_file":  "/etc/containerd/certs.d/server.key",
+		},
+	}
+	pluginConfigs := map[string]interface{}{
+		pluginName: src,
+	}
+	configMigration(context.Background(), 2, pluginConfigs)
+
+	dst, ok := pluginConfigs[pluginName].(map[string]interface{})
+	assert.True(t, ok)
+	assert.NotNil(t, dst)
+
+	for _, k := range []string{"registry", "containerd"} {
+		_, ok := dst[k]
+		assert.False(t, ok)
+		delete(src, k)
+	}
+
+	for k, v := range src {
+		assert.Equal(t, v, dst[k])
+	}
+}