diff --git a/.ci/install_cri_containerd.sh b/.ci/install_cri_containerd.sh
index ad5a11a80..2d586b3f0 100755
--- a/.ci/install_cri_containerd.sh
+++ b/.ci/install_cri_containerd.sh
@@ -17,6 +17,8 @@ script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # Flag to do tasks for CI
 CI=${CI:-""}
 
+SNAPSHOTTER=${SNAPSHOTTER:-""}
+
 # shellcheck source=./lib.sh
 source "${script_dir}/lib.sh"
 
@@ -81,17 +83,42 @@ install_from_static_tarball() {
 	sudo tar -xvf "${tarball_name}" -C /
 }
 
+install_vanilla_from_static_tarball() {
+	echo "Trying to install containerd from static tarball"
+	local tarball_url="https://github.com/containerd/containerd/releases/download"
+	local containerd_tarball_version="v1.7.0"
+	local containerd_version=${containerd_tarball_version#v}
+	local tarball_name="containerd-${containerd_version}-${CONTAINERD_OS}-${CONTAINERD_ARCH}.tar.gz"
+	local url="${tarball_url}/${containerd_tarball_version}/${tarball_name}"
+
+	echo "Download tarball from ${url}"
+	if ! curl -OL -f "${url}"; then
+		echo "Failed to download tarball from ${url}"
+		return 1
+	fi
+
+	tmp_dir=$(mktemp -d -t install-vanilla-containerd-tmp.XXXXXXXXXX)
+	sudo tar -xvf "${tarball_name}" -C $tmp_dir/
+	sudo install -D -m 755 "$tmp_dir/bin/containerd" "/usr/local/bin/containerd-vanilla"
+
+	systemctl status containerd
+}
+
 install_cri-tools() {
-crictl_repo=$(get_version "externals.critools.url")
-crictl_version=$(get_version "externals.critools.version")
-crictl_tag_prefix="v"
+	crictl_repo=$(get_version "externals.critools.url")
+	crictl_version=$(get_version "externals.critools.version")
+	crictl_tag_prefix="v"
 
-crictl_url="${crictl_repo}/releases/download/v${crictl_version}/crictl-${crictl_tag_prefix}${crictl_version}-linux-$(${script_dir}/kata-arch.sh -g).tar.gz"
-curl -Ls "$crictl_url" | sudo tar xfz - -C /usr/local/bin
+	crictl_url="${crictl_repo}/releases/download/v${crictl_version}/crictl-${crictl_tag_prefix}${crictl_version}-linux-$(${script_dir}/kata-arch.sh -g).tar.gz"
+	curl -Ls "$crictl_url" | sudo tar xfz - -C /usr/local/bin
 }
 
 install_from_static_tarball || install_from_source
 
+if [ "${SNAPSHOTTER}" == "nydus" ]; then
+	install_vanilla_from_static_tarball
+fi
+
 install_cri-tools
 
 sudo systemctl daemon-reload
diff --git a/.ci/lib.sh b/.ci/lib.sh
index 9505aba8f..fa3699928 100755
--- a/.ci/lib.sh
+++ b/.ci/lib.sh
@@ -398,6 +398,9 @@ cleanup_nydus_snapshotter_dependencies() {
 	if [ -f "/usr/local/bin/nydus-image" ]; then
 		rm -f "/usr/local/bin/nydus-image"
 	fi
+	if [ -f "/usr/local/bin/containerd-vanilla" ]; then
+		rm -f "/usr/local/bin/containerd-vanilla"
+	fi
 }
 
 gen_clean_arch() {
diff --git a/integration/kubernetes/confidential/image_pulling_with_snapshotter.bats b/integration/kubernetes/confidential/image_pulling_with_snapshotter.bats
index 7de3c6284..5d274d7cc 100644
--- a/integration/kubernetes/confidential/image_pulling_with_snapshotter.bats
+++ b/integration/kubernetes/confidential/image_pulling_with_snapshotter.bats
@@ -67,4 +67,6 @@ teardown() {
     teardown_common
     remove_test_image "$image_unsigned_protected" || true
     kill_nydus_snapshotter_process
+    unset_vanilla_containerd
+    restart_containerd
 }