diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0a3cc21fe07..3d1e2d58d7c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -85,7 +85,7 @@ jobs:
           - ubuntu: 22.04
             containerd: v1.7.18
           - ubuntu: 22.04
-            containerd: main
+            containerd: main # v2.0.0-rc.X
     env:
       UBUNTU_VERSION: "${{ matrix.ubuntu }}"
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
@@ -181,7 +181,7 @@ jobs:
             rootlesskit: v1.1.1
             target: test-integration-rootless
           - ubuntu: 22.04
-            containerd: main
+            containerd: main # v2.0.0-rc.X
             rootlesskit: v2.1.0
             target: test-integration-rootless
           - ubuntu: 20.04
@@ -197,7 +197,7 @@ jobs:
             rootlesskit: v1.1.1
             target: test-integration-rootless-port-slirp4netns
           - ubuntu: 22.04
-            containerd: main
+            containerd: main # v2.0.0-rc.X
             rootlesskit: v2.1.0
             target: test-integration-rootless-port-slirp4netns
     env:
@@ -237,7 +237,7 @@ jobs:
           cache: true
           check-latest: true
       - name: "Cross"
-        run: GO_VERSION="$(echo ${{ matrix.go-version }} | sed -e s/.x//)" make artifacts
+        run: GO_VERSION="$(echo ${{ matrix.go-version }} | sed -e s/.x//)" make binaries
 
   test-integration-docker-compatibility:
     runs-on: ubuntu-22.04
diff --git a/Dockerfile b/Dockerfile
index d0a9a16536c..81da164d935 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,12 +18,12 @@
 # TODO: verify commit hash
 
 # Basic deps
-ARG CONTAINERD_VERSION=v1.7.18
+ARG CONTAINERD_VERSION=v2.0.0-rc.3
 ARG RUNC_VERSION=v1.1.13
-ARG CNI_PLUGINS_VERSION=v1.5.0
+ARG CNI_PLUGINS_VERSION=v1.5.1
 
 # Extra deps: Build
-ARG BUILDKIT_VERSION=v0.13.2
+ARG BUILDKIT_VERSION=v0.14.1
 # Extra deps: Lazy-pulling
 ARG STARGZ_SNAPSHOTTER_VERSION=v0.15.1
 # Extra deps: Encryption
@@ -37,7 +37,7 @@ ARG BYPASS4NETNS_VERSION=v0.4.1
 ARG FUSE_OVERLAYFS_VERSION=v1.13
 ARG CONTAINERD_FUSE_OVERLAYFS_VERSION=v1.0.8
 # Extra deps: IPFS
-ARG KUBO_VERSION=v0.27.0
+ARG KUBO_VERSION=v0.29.0
 # Extra deps: Init
 ARG TINI_VERSION=v0.19.0
 # Extra deps: Debug
@@ -47,9 +47,9 @@ ARG BUILDG_VERSION=v0.4.1
 ARG GO_VERSION=1.22
 ARG UBUNTU_VERSION=22.04
 ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.1
-ARG GOTESTSUM_VERSION=v1.11.0
-ARG NYDUS_VERSION=v2.2.4
-ARG SOCI_SNAPSHOTTER_VERSION=0.4.0
+ARG GOTESTSUM_VERSION=v1.12.0
+ARG NYDUS_VERSION=v2.2.5
+ARG SOCI_SNAPSHOTTER_VERSION=0.6.1
 
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.4.0 AS xx
 
@@ -65,18 +65,6 @@ ARG TARGETARCH
 RUN xx-apt-get update && \
   xx-apt-get install -y binutils gcc libc6-dev libbtrfs-dev libseccomp-dev
 
-# runc still requires Go 1.21
-# https://github.com/opencontainers/runc/issues/4233
-FROM --platform=$BUILDPLATFORM golang:1.21-bullseye AS build-base-debian-go121
-COPY --from=xx / /
-ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update && \
-  apt-get install -y git pkg-config dpkg-dev
-ARG TARGETARCH
-# libseccomp: for runc
-RUN xx-apt-get update && \
-  xx-apt-get install -y binutils gcc libc6-dev libseccomp-dev
-
 FROM build-base-debian AS build-containerd
 ARG TARGETARCH
 ARG CONTAINERD_VERSION
@@ -88,9 +76,7 @@ RUN git checkout ${CONTAINERD_VERSION} && \
 RUN GO=xx-go make STATIC=1 && \
   cp -a bin/containerd bin/containerd-shim-runc-v2 bin/ctr /out/$TARGETARCH
 
-# runc still requires Go 1.21
-# https://github.com/opencontainers/runc/issues/4233
-FROM build-base-debian-go121 AS build-runc
+FROM build-base-debian AS build-runc
 ARG RUNC_VERSION
 ARG TARGETARCH
 RUN git clone https://github.com/opencontainers/runc.git /go/src/github.com/opencontainers/runc
diff --git a/Dockerfile.d/SHA256SUMS.d/buildkit-v0.13.2 b/Dockerfile.d/SHA256SUMS.d/buildkit-v0.13.2
deleted file mode 100644
index cd252075f04..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/buildkit-v0.13.2
+++ /dev/null
@@ -1,2 +0,0 @@
-9cd121931b015f05d7e4337f08272e36a83f69724c40141947eb11246ca0bb9d  buildkit-v0.13.2.linux-amd64.tar.gz
-bcc4cb4fec79847682fbb2ce8f612e5e854636ae6c262cee4b657d2b5c2fd46c  buildkit-v0.13.2.linux-arm64.tar.gz
diff --git a/Dockerfile.d/SHA256SUMS.d/buildkit-v0.14.1 b/Dockerfile.d/SHA256SUMS.d/buildkit-v0.14.1
new file mode 100644
index 00000000000..e059cbf6e7a
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/buildkit-v0.14.1
@@ -0,0 +1,2 @@
+836208f50ab8856a91aa5bba455b8451bbe261318cbc92e9c0ca3e786135756c  buildkit-v0.14.1.linux-amd64.tar.gz
+e1caad39f0bc5848a5687d7a0e8e344d20724133365596e5d881d8fbe5594b32  buildkit-v0.14.1.linux-arm64.tar.gz
diff --git a/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.5.0 b/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.5.0
deleted file mode 100644
index 729e73a90fb..00000000000
--- a/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.5.0
+++ /dev/null
@@ -1,2 +0,0 @@
-57a18478422cb321370e30a5ee6ce026321289cd9c94353ca697dddd7714f1a5  cni-plugins-linux-amd64-v1.5.0.tgz
-ab38507efe50c34bc2242a25c5783c19fdfe0376c65a2a91d48174d4f39f1fc2  cni-plugins-linux-arm64-v1.5.0.tgz
diff --git a/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.5.1 b/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.5.1
new file mode 100644
index 00000000000..6a91ab30028
--- /dev/null
+++ b/Dockerfile.d/SHA256SUMS.d/cni-plugins-v1.5.1
@@ -0,0 +1,2 @@
+77baa2f669980a82255ffa2f2717de823992480271ee778aa51a9c60ae89ff9b  cni-plugins-linux-amd64-v1.5.1.tgz
+c2a292714d0fad98a3491ae43df8ad58354b3c0bdf5d5a3e281777967c70fcff  cni-plugins-linux-arm64-v1.5.1.tgz
diff --git a/hack/generate-release-note.sh b/hack/generate-release-note.sh
index 877853566e5..87ce76b3f55 100755
--- a/hack/generate-release-note.sh
+++ b/hack/generate-release-note.sh
@@ -25,7 +25,7 @@ cat <<-EOX
 (To be documented)
 
 ## Compatible containerd versions
-This release of nerdctl is expected to be used with containerd v1.6 or v1.7.
+This release of nerdctl is expected to be used with containerd v1.6, v1.7, or v2.0.
 
 ## About the binaries
 - Minimal (\`${minimal_amd64tgz_basename}\`): nerdctl only