diff --git a/go.mod b/go.mod
index 0a93718e4..4350bfc61 100644
--- a/go.mod
+++ b/go.mod
@@ -42,7 +42,7 @@ require (
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v1.0.0-rc.2 // indirect
-	github.com/containerd/plugin v1.0.0 // indirect
+	github.com/containerd/plugin v1.1.0 // indirect
 	github.com/containerd/ttrpc v1.2.7 // indirect
 	github.com/containerd/typeurl/v2 v2.2.3 // indirect
 	github.com/coreos/go-oidc/v3 v3.17.0 // indirect
diff --git a/go.sum b/go.sum
index e307fe795..e463e87a8 100644
--- a/go.sum
+++ b/go.sum
@@ -123,8 +123,8 @@ github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/platforms v1.0.0-rc.2 h1:0SPgaNZPVWGEi4grZdV8VRYQn78y+nm6acgLGv/QzE4=
 github.com/containerd/platforms v1.0.0-rc.2/go.mod h1:J71L7B+aiM5SdIEqmd9wp6THLVRzJGXfNuWCZCllLA4=
-github.com/containerd/plugin v1.0.0 h1:c8Kf1TNl6+e2TtMHZt+39yAPDbouRH9WAToRjex483Y=
-github.com/containerd/plugin v1.0.0/go.mod h1:hQfJe5nmWfImiqT1q8Si3jLv3ynMUIBB47bQ+KexvO8=
+github.com/containerd/plugin v1.1.0 h1:O+7lczNJVMy8rz0YNx3xGB8tTf5qY4i5abF041Ew19U=
+github.com/containerd/plugin v1.1.0/go.mod h1:qBTum+A8lJ6lO44A19Eo7y1OlcLj4OWFH1DA/vnHmcc=
 github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRqQ=
 github.com/containerd/ttrpc v1.2.7/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
 github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
diff --git a/vendor/github.com/containerd/plugin/.golangci.yml b/vendor/github.com/containerd/plugin/.golangci.yml
index d574fe11d..d02cfb8f1 100644
--- a/vendor/github.com/containerd/plugin/.golangci.yml
+++ b/vendor/github.com/containerd/plugin/.golangci.yml
@@ -1,32 +1,49 @@
+version: "2"
 linters:
   enable:
     - copyloopvar
-    - gofmt
-    - goimports
+    - dupword
     - gosec
-    - ineffassign
     - misspell
     - nolintlint
     - revive
-    - staticcheck
-    - tenv # Detects using os.Setenv instead of t.Setenv since Go 1.17
     - unconvert
-    - unused
-    - govet
-    - dupword # Checks for duplicate words in the source code
   disable:
     - errcheck
-
-run:
-  timeout: 5m
-
-issues:
-  exclude-dirs:
-    - api
-    - cluster
-    - design
-    - docs
-    - docs/man
-    - releases
-    - reports
-    - test # e2e scripts
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - api
+      - cluster
+      - design
+      - docs
+      - docs/man
+      - releases
+      - reports
+      - test
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - api
+      - cluster
+      - design
+      - docs
+      - docs/man
+      - releases
+      - reports
+      - test
+      - third_party$
+      - builtin$
+      - examples$
diff --git a/vendor/github.com/containerd/plugin/plugin.go b/vendor/github.com/containerd/plugin/plugin.go
index f7899e184..e31b221c5 100644
--- a/vendor/github.com/containerd/plugin/plugin.go
+++ b/vendor/github.com/containerd/plugin/plugin.go
@@ -39,6 +39,8 @@ var (
 	ErrPluginNotFound = errors.New("plugin: not found")
 	// ErrPluginMultipleInstances is used when a plugin is expected a single instance but has multiple
 	ErrPluginMultipleInstances = errors.New("plugin: multiple instances")
+	// ErrPluginCircularDependency is used when the graph detect a circular plugin dependency
+	ErrPluginCircularDependency = errors.New("plugin: dependency loop detected")
 
 	// ErrInvalidRequires will be thrown if the requirements for a plugin are
 	// defined in an invalid manner.
@@ -110,36 +112,43 @@ type Registry []*Registration
 // Graph computes the ordered list of registrations based on their dependencies,
 // filtering out any plugins which match the provided filter.
 func (registry Registry) Graph(filter DisableFilter) []Registration {
-	disabled := map[*Registration]bool{}
-	for _, r := range registry {
-		if filter(r) {
-			disabled[r] = true
+	handled := make(map[*Registration]struct{}, len(registry))
+	if filter != nil {
+		for _, r := range registry {
+			if filter(r) {
+				handled[r] = struct{}{}
+			}
 		}
 	}
 
-	ordered := make([]Registration, 0, len(registry)-len(disabled))
-	added := map[*Registration]bool{}
+	ordered := make([]Registration, 0, len(registry)-len(handled))
+	stack := make([]*Registration, 0, cap(ordered))
 	for _, r := range registry {
-		if disabled[r] {
+		if _, ok := handled[r]; ok {
 			continue
 		}
-		children(r, registry, added, disabled, &ordered)
-		if !added[r] {
-			ordered = append(ordered, *r)
-			added[r] = true
-		}
+		children(append(stack, r), registry, handled, &ordered)
+		handled[r] = struct{}{}
+		ordered = append(ordered, *r)
 	}
 	return ordered
 }
 
-func children(reg *Registration, registry []*Registration, added, disabled map[*Registration]bool, ordered *[]Registration) {
+func children(stack []*Registration, registry []*Registration, handled map[*Registration]struct{}, ordered *[]Registration) {
+	reg := stack[len(stack)-1]
 	for _, t := range reg.Requires {
 		for _, r := range registry {
-			if !disabled[r] && r.URI() != reg.URI() && (t == "*" || r.Type == t) {
-				children(r, registry, added, disabled, ordered)
-				if !added[r] {
+			if (t == "*" || r.Type == t) && r != reg {
+				if _, ok := handled[r]; !ok {
+					// Ensure not in current stack
+					for _, p := range stack[:len(stack)-1] {
+						if p == r {
+							panic(fmt.Errorf("circular plugin dependency at %s: %w", r.URI(), ErrPluginCircularDependency))
+						}
+					}
+					children(append(stack, r), registry, handled, ordered)
+					handled[r] = struct{}{}
 					*ordered = append(*ordered, *r)
-					added[r] = true
 				}
 			}
 		}
@@ -160,7 +169,7 @@ func (registry Registry) Register(r *Registration) Registry {
 	}
 
 	for _, requires := range r.Requires {
-		if requires == "*" && len(r.Requires) != 1 {
+		if (requires == "*" && len(r.Requires) != 1) || requires == r.Type {
 			panic(ErrInvalidRequires)
 		}
 	}
@@ -170,7 +179,7 @@ func (registry Registry) Register(r *Registration) Registry {
 
 func checkUnique(registry Registry, r *Registration) error {
 	for _, registered := range registry {
-		if r.URI() == registered.URI() {
+		if r.Type == registered.Type && r.ID == registered.ID {
 			return fmt.Errorf("%s: %w", r.URI(), ErrIDRegistered)
 		}
 	}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0c3a77d7a..9e47ac326 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -183,8 +183,8 @@ github.com/containerd/log
 # github.com/containerd/platforms v1.0.0-rc.2
 ## explicit; go 1.20
 github.com/containerd/platforms
-# github.com/containerd/plugin v1.0.0
-## explicit; go 1.20
+# github.com/containerd/plugin v1.1.0
+## explicit; go 1.22
 github.com/containerd/plugin
 # github.com/containerd/ttrpc v1.2.7
 ## explicit; go 1.19