diff --git a/go.mod b/go.mod
index 63f25035c..646feb93f 100644
--- a/go.mod
+++ b/go.mod
@@ -7,7 +7,7 @@ require (
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24
 	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0
 	github.com/Microsoft/go-winio v0.6.1
-	github.com/Microsoft/hcsshim v0.12.0-rc.3
+	github.com/Microsoft/hcsshim v0.12.0
 	github.com/containerd/btrfs/v2 v2.0.0
 	github.com/containerd/cgroups/v3 v3.0.3
 	github.com/containerd/console v1.0.4
diff --git a/go.sum b/go.sum
index b8e6c5a01..06f58b4d3 100644
--- a/go.sum
+++ b/go.sum
@@ -46,8 +46,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
 github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
-github.com/Microsoft/hcsshim v0.12.0-rc.3 h1:5GNGrobGs/sN/0nFO21W9k4lFn+iXXZAE8fCZbmdRak=
-github.com/Microsoft/hcsshim v0.12.0-rc.3/go.mod h1:WuNfcaYNaw+KpCEsZCIM6HCEmu0c5HfXpi+dDSmveP0=
+github.com/Microsoft/hcsshim v0.12.0 h1:rbICA+XZFwrBef2Odk++0LjFvClNCJGRK+fsrP254Ts=
+github.com/Microsoft/hcsshim v0.12.0/go.mod h1:RZV12pcHCXQ42XnlQ3pz6FZfmrC1C+R4gaOHhRNML1g=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
diff --git a/script/setup/runhcs-version b/script/setup/runhcs-version
index e91572599..87a1cf595 100644
--- a/script/setup/runhcs-version
+++ b/script/setup/runhcs-version
@@ -1 +1 @@
-v0.12.0-rc.3
+v0.12.0
diff --git a/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.pb.go b/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.pb.go
index d99141161..48a1f8d9c 100644
--- a/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.pb.go
+++ b/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        v4.23.2
 // source: github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/runhcs.proto
 
diff --git a/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/stats/stats.pb.go b/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/stats/stats.pb.go
index ccb0fabb3..34de2f152 100644
--- a/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/stats/stats.pb.go
+++ b/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/stats/stats.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        v4.23.2
 // source: github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/stats/stats.proto
 
diff --git a/vendor/github.com/Microsoft/hcsshim/internal/wclayer/cim/process.go b/vendor/github.com/Microsoft/hcsshim/internal/wclayer/cim/process.go
index efce1251f..9ed0428b7 100644
--- a/vendor/github.com/Microsoft/hcsshim/internal/wclayer/cim/process.go
+++ b/vendor/github.com/Microsoft/hcsshim/internal/wclayer/cim/process.go
@@ -22,65 +22,6 @@ import (
 
 const defaultVHDXBlockSizeInMB = 1
 
-func createContainerBaseLayerVHDs(ctx context.Context, layerPath string) (err error) {
-	baseVhdPath := filepath.Join(layerPath, wclayer.ContainerBaseVhd)
-	diffVhdPath := filepath.Join(layerPath, wclayer.ContainerScratchVhd)
-	defaultVhdSize := uint64(20)
-
-	if _, err := os.Stat(baseVhdPath); err == nil {
-		if err := os.RemoveAll(baseVhdPath); err != nil {
-			return fmt.Errorf("failed to remove base vhdx path:  %w", err)
-		}
-	}
-	if _, err := os.Stat(diffVhdPath); err == nil {
-		if err := os.RemoveAll(diffVhdPath); err != nil {
-			return fmt.Errorf("failed to remove differencing vhdx: %w", err)
-		}
-	}
-
-	createParams := &vhd.CreateVirtualDiskParameters{
-		Version: 2,
-		Version2: vhd.CreateVersion2{
-			MaximumSize:      defaultVhdSize * memory.GiB,
-			BlockSizeInBytes: defaultVHDXBlockSizeInMB * memory.MiB,
-		},
-	}
-	handle, err := vhd.CreateVirtualDisk(baseVhdPath, vhd.VirtualDiskAccessNone, vhd.CreateVirtualDiskFlagNone, createParams)
-	if err != nil {
-		return fmt.Errorf("failed to create vhdx: %w", err)
-	}
-
-	defer func() {
-		if err != nil {
-			os.RemoveAll(baseVhdPath)
-			os.RemoveAll(diffVhdPath)
-		}
-	}()
-
-	err = computestorage.FormatWritableLayerVhd(ctx, windows.Handle(handle))
-	// we always wanna close the handle whether format succeeds for not.
-	closeErr := syscall.CloseHandle(handle)
-	if err != nil {
-		return err
-	} else if closeErr != nil {
-		return fmt.Errorf("failed to close vhdx handle: %w", closeErr)
-	}
-
-	// Create the differencing disk that will be what's copied for the final rw layer
-	// for a container.
-	if err = vhd.CreateDiffVhd(diffVhdPath, baseVhdPath, defaultVHDXBlockSizeInMB); err != nil {
-		return fmt.Errorf("failed to create differencing disk: %w", err)
-	}
-
-	if err = security.GrantVmGroupAccess(baseVhdPath); err != nil {
-		return fmt.Errorf("failed to grant vm group access to %s: %w", baseVhdPath, err)
-	}
-	if err = security.GrantVmGroupAccess(diffVhdPath); err != nil {
-		return fmt.Errorf("failed to grant vm group access to %s: %w", diffVhdPath, err)
-	}
-	return nil
-}
-
 // processUtilityVMLayer is similar to createContainerBaseLayerVHDs but along with the scratch creation it
 // also does some BCD modifications to allow the UVM to boot from the CIM. It expects that the UVM BCD file is
 // present at layerPath/`wclayer.BcdFilePath` and a UVM SYSTEM hive is present at
@@ -228,10 +169,6 @@ func processLayoutFile(layerPath string) ([]pendingCimOp, error) {
 // inside the cim, some registry file links must be updated. This function takes care of all those
 // steps. This function opens the cim file for writing and updates it.
 func (cw *CimLayerWriter) processBaseLayer(ctx context.Context, processUtilityVM bool) (err error) {
-	if err = createContainerBaseLayerVHDs(ctx, cw.path); err != nil {
-		return fmt.Errorf("failed to create container base VHDs: %w", err)
-	}
-
 	if processUtilityVM {
 		if err = processUtilityVMLayer(ctx, cw.path); err != nil {
 			return fmt.Errorf("process utilityVM layer: %w", err)
diff --git a/vendor/github.com/Microsoft/hcsshim/internal/winapi/utils.go b/vendor/github.com/Microsoft/hcsshim/internal/winapi/utils.go
index 93d633d49..70c43fc1c 100644
--- a/vendor/github.com/Microsoft/hcsshim/internal/winapi/utils.go
+++ b/vendor/github.com/Microsoft/hcsshim/internal/winapi/utils.go
@@ -4,7 +4,6 @@ package winapi
 
 import (
 	"errors"
-	"reflect"
 	"syscall"
 	"unsafe"
 
@@ -14,11 +13,7 @@ import (
 // Uint16BufferToSlice wraps a uint16 pointer-and-length into a slice
 // for easier interop with Go APIs
 func Uint16BufferToSlice(buffer *uint16, bufferLength int) (result []uint16) {
-	hdr := (*reflect.SliceHeader)(unsafe.Pointer(&result))
-	hdr.Data = uintptr(unsafe.Pointer(buffer))
-	hdr.Cap = bufferLength
-	hdr.Len = bufferLength
-
+	result = unsafe.Slice(buffer, bufferLength)
 	return
 }
 
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 56fd17e30..26924c5db 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -23,8 +23,8 @@ github.com/Microsoft/go-winio/pkg/fs
 github.com/Microsoft/go-winio/pkg/guid
 github.com/Microsoft/go-winio/pkg/security
 github.com/Microsoft/go-winio/vhd
-# github.com/Microsoft/hcsshim v0.12.0-rc.3
-## explicit; go 1.18
+# github.com/Microsoft/hcsshim v0.12.0
+## explicit; go 1.21
 github.com/Microsoft/hcsshim
 github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options
 github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/stats