diff --git a/cmd/cri/options/options.go b/cmd/cri/options/options.go
index d0e7a5d45..27db85ddb 100644
--- a/cmd/cri/options/options.go
+++ b/cmd/cri/options/options.go
@@ -91,7 +91,7 @@ func (f *DockerCRIFlags) AddFlags(mainfs *pflag.FlagSet) {
 
 const (
 	defaultPodSandboxImageName    = "registry.k8s.io/pause"
-	defaultPodSandboxImageVersion = "3.6"
+	defaultPodSandboxImageVersion = "3.9"
 )
 
 var (
diff --git a/core/convert.go b/core/convert.go
index 1682959dc..08d185ccb 100644
--- a/core/convert.go
+++ b/core/convert.go
@@ -37,7 +37,7 @@ import (
 // This file contains helper functions to convert docker API types to runtime
 // API types, or vice versa.
 
-func imageToRuntimeAPIImage(image *dockertypes.ImageSummary) (*runtimeapi.Image, error) {
+func imageToRuntimeAPIImage(image *dockertypes.ImageSummary, pinned bool) (*runtimeapi.Image, error) {
 	if image == nil {
 		return nil, fmt.Errorf("unable to convert a nil pointer to a runtime API image")
 	}
@@ -47,10 +47,11 @@ func imageToRuntimeAPIImage(image *dockertypes.ImageSummary) (*runtimeapi.Image,
 		RepoTags:    image.RepoTags,
 		RepoDigests: image.RepoDigests,
 		Size_:       uint64(image.Size),
+		Pinned:      pinned,
 	}, nil
 }
 
-func imageInspectToRuntimeAPIImage(image *dockertypes.ImageInspect) (*runtimeapi.Image, error) {
+func imageInspectToRuntimeAPIImage(image *dockertypes.ImageInspect, pinned bool) (*runtimeapi.Image, error) {
 	if image == nil || image.Config == nil {
 		return nil, fmt.Errorf("unable to convert a nil pointer to a runtime API image")
 	}
@@ -60,6 +61,7 @@ func imageInspectToRuntimeAPIImage(image *dockertypes.ImageInspect) (*runtimeapi
 		RepoTags:    image.RepoTags,
 		RepoDigests: image.RepoDigests,
 		Size_:       uint64(image.Size),
+		Pinned:      pinned,
 	}
 
 	uid, username := getUserFromImageUser(image.Config.User)
diff --git a/core/image.go b/core/image.go
index d92733f60..16580a8cd 100644
--- a/core/image.go
+++ b/core/image.go
@@ -35,6 +35,26 @@ import (
 
 // This file implements methods in ImageManagerService.
 
+func (ds *dockerService) sandboxImage() string {
+	image := defaultSandboxImage
+	podSandboxImage := ds.podSandboxImage
+	if len(podSandboxImage) != 0 {
+		image = podSandboxImage
+	}
+	return image
+}
+
+func isPinned(image string, tags []string) bool {
+	pinned := false
+	for _, tag := range tags {
+		if tag == image {
+			pinned = true
+			break
+		}
+	}
+	return pinned
+}
+
 // ListImages lists existing images.
 func (ds *dockerService) ListImages(
 	_ context.Context,
@@ -53,10 +73,12 @@ func (ds *dockerService) ListImages(
 	if err != nil {
 		return nil, err
 	}
+	image := ds.sandboxImage()
 
 	result := make([]*runtimeapi.Image, 0, len(images))
 	for _, i := range images {
-		apiImage, err := imageToRuntimeAPIImage(&i)
+		pinned := isPinned(image, i.RepoTags)
+		apiImage, err := imageToRuntimeAPIImage(&i, pinned)
 		if err != nil {
 			logrus.Infof("Failed to convert docker API image %v to runtime API image: %v", i, err)
 			continue
@@ -87,7 +109,8 @@ func (ds *dockerService) ImageStatus(
 		}
 	}
 
-	imageStatus, err := imageInspectToRuntimeAPIImage(imageInspect)
+	pinned := isPinned(ds.sandboxImage(), imageInspect.RepoTags)
+	imageStatus, err := imageInspectToRuntimeAPIImage(imageInspect, pinned)
 	if err != nil {
 		return nil, err
 	}
diff --git a/core/sandbox_helpers.go b/core/sandbox_helpers.go
index 0097927af..cc61ec81b 100644
--- a/core/sandbox_helpers.go
+++ b/core/sandbox_helpers.go
@@ -34,7 +34,7 @@ import (
 )
 
 const (
-	defaultSandboxImage = "registry.k8s.io/pause:3.6"
+	defaultSandboxImage = "registry.k8s.io/pause:3.9"
 
 	// Various default sandbox resources requests/limits.
 	defaultSandboxCPUshares int64 = 2