diff --git a/cmd/cri/options/options.go b/cmd/cri/options/options.go
index d0e7a5d45..27db85ddb 100644
--- a/cmd/cri/options/options.go
+++ b/cmd/cri/options/options.go
@@ -91,7 +91,7 @@ func (f *DockerCRIFlags) AddFlags(mainfs *pflag.FlagSet) {
 
 const (
 	defaultPodSandboxImageName    = "registry.k8s.io/pause"
-	defaultPodSandboxImageVersion = "3.6"
+	defaultPodSandboxImageVersion = "3.9"
 )
 
 var (
diff --git a/core/sandbox_helpers.go b/core/sandbox_helpers.go
index 0097927af..cc61ec81b 100644
--- a/core/sandbox_helpers.go
+++ b/core/sandbox_helpers.go
@@ -34,7 +34,7 @@ import (
 )
 
 const (
-	defaultSandboxImage = "registry.k8s.io/pause:3.6"
+	defaultSandboxImage = "registry.k8s.io/pause:3.9"
 
 	// Various default sandbox resources requests/limits.
 	defaultSandboxCPUshares int64 = 2