diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/changes/2026-08-09-containerd-registry-config.md b/sdk_container/src/third_party/coreos-overlay/changelog/changes/2026-08-09-containerd-registry-config.md
new file mode 100644
index 00000000000..178d49f3f14
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/changelog/changes/2026-08-09-containerd-registry-config.md
@@ -0,0 +1 @@
+- Added containerd registry certificate directory support for `/etc/containerd/certs.d` in the containerd sysext. ([Flatcar#583](https://github.com/flatcar/Flatcar/issues/583))
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/sysext/containerd/usr/share/containerd/config-cgroupfs.toml b/sdk_container/src/third_party/coreos-overlay/coreos/sysext/containerd/usr/share/containerd/config-cgroupfs.toml
index 742fbf4355c..eab659c653f 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/sysext/containerd/usr/share/containerd/config-cgroupfs.toml
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/sysext/containerd/usr/share/containerd/config-cgroupfs.toml
@@ -27,6 +27,9 @@ runtime = "runc"
 # live restore is not supported
 no_shim = false
 
+[plugins."io.containerd.grpc.v1.cri".registry]
+config_path = "/etc/containerd/certs.d"
+
 [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
 # setting runc.options unsets parent settings
 runtime_type = "io.containerd.runc.v2"
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/sysext/containerd/usr/share/containerd/config.toml b/sdk_container/src/third_party/coreos-overlay/coreos/sysext/containerd/usr/share/containerd/config.toml
index babc77b0e06..ec386651820 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/sysext/containerd/usr/share/containerd/config.toml
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/sysext/containerd/usr/share/containerd/config.toml
@@ -31,6 +31,9 @@ no_shim = false
 # enable SELinux labeling
 enable_selinux = true
 
+[plugins."io.containerd.grpc.v1.cri".registry]
+config_path = "/etc/containerd/certs.d"
+
 [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
 # setting runc.options unsets parent settings
 runtime_type = "io.containerd.runc.v2"