diff --git a/.github/workflows/test-canary.yml b/.github/workflows/test-canary.yml
new file mode 100644
index 00000000000..89c8e673751
--- /dev/null
+++ b/.github/workflows/test-canary.yml
@@ -0,0 +1,107 @@
+# This pipeline purpose is solely meant to run a subset of our test suites against upcoming or unreleased dependencies versions
+name: test-canary
+
+on:
+  push:
+    branches:
+      - main
+      - 'release/**'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+
+env:
+  # If left blank, will default to latest stable
+  GO_VERSION: "1.23-rc1"
+  GO_VERSION_SETUP_GO: "1.23.0-rc.1"
+  UBUNTU_VERSION: "24.04"
+
+  # Straight git branches
+  CONTAINERD_VERSION: "main"
+  # Windows install script can only set released versions
+  CONTAINERD_VERSION_WINDOWS: "2.0.0-rc.3"
+  IMGCRYPT_VERSION: "main"
+  BYPASS4NETNS_VERSION: "main"
+  KUBO_VERSION: "main"
+  GOTESTSUM_VERSION: "main"
+  # Set this to "next" for upcoming version (defined by `RegistryImageNext`)
+  DISTRIBUTION_VERSION: "next"
+  # FIXME. Currently pinned, see: https://github.com/containerd/nerdctl/pull/3153
+  RUNC_VERSION: "v1.1.13"
+
+  # Released versions - one can update these manually to override the Dockerfile pinned versions
+  BUILDKIT_VERSION: "v0.15.0-rc1"
+
+  # CNI_PLUGINS_VERSION: "v1.5.1"
+  # STARGZ_SNAPSHOTTER_VERSION: "v0.15.1"
+  # ROOTLESSKIT_VERSION: "v2.1.0"
+  # SLIRP4NETNS_VERSION: "v1.3.1"
+  # FUSE_OVERLAYFS_VERSION: "v1.13"
+  # CONTAINERD_FUSE_OVERLAYFS_VERSION: "v1.0.8"
+  # TINI_VERSION: "v0.19.0"
+  # BUILDG_VERSION: "v0.4.1"
+  # CONTAINERIZED_SYSTEMD_VERSION: "v0.1.1"
+  # NYDUS_VERSION: "v2.2.5"
+  # SOCI_SNAPSHOTTER_VERSION: "0.6.1"
+
+
+jobs:
+  test-canary-linux:
+    runs-on: "ubuntu-24.04"
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@v4.1.7
+        with:
+          fetch-depth: 1
+      - name: "Prepare integration test environment"
+        run: DOCKER_BUILDKIT=1 docker build -t test-integration --target test-integration --build-arg UBUNTU_VERSION=$UBUNTU_VERSION --build-arg CONTAINERD_VERSION=$CONTAINERD_VERSION .
+      - name: "Remove snap loopback devices (conflicts with our loopback devices in TestRunDevice)"
+        run: |
+          sudo systemctl disable --now snapd.service snapd.socket
+          sudo apt-get purge -y snapd
+          sudo losetup -Dv
+          sudo losetup -lv
+      - name: "Register QEMU (tonistiigi/binfmt)"
+        run: docker run --privileged --rm tonistiigi/binfmt --install all
+      - name: "Run unit tests"
+        run: go test -v ./pkg/...
+      - name: "Run integration tests"
+        continue-on-error: true
+        run: docker run -t --rm --privileged test-integration
+
+  test-canary-windows:
+    runs-on: windows-latest
+    timeout-minutes: 30
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v4.1.7
+        with:
+          fetch-depth: 1
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION_SETUP_GO }}
+          cache: true
+          check-latest: true
+      - run: go install ./cmd/nerdctl
+      # This here is solely to get the cni install script, which has not been modified in 3+ years.
+      # There is little to no reason to update this to latest containerd
+      - uses: actions/checkout@v4.1.7
+        with:
+          repository: containerd/containerd
+          ref: "v1.7.19"
+          path: containerd
+          fetch-depth: 1
+      - name: "Set up CNI"
+        working-directory: containerd
+        run: GOPATH=$(go env GOPATH) script/setup/install-cni-windows
+      # Windows setup script can only use released versions
+      - name: "Set up containerd"
+        env:
+          ctrdVersion: ${{ env.CONTAINERD_VERSION_WINDOWS }}
+        run: powershell hack/configure-windows-ci.ps1
+      - name: "Run unit tests"
+        run: go test -v ./pkg/...
+      - name: "Run integration tests"
+        run: go test -v ./cmd/...
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index d5930e8d695..ecbb075425c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -61,7 +61,7 @@ jobs:
           - ubuntu: 22.04
             containerd: v1.7.19
           - ubuntu: 24.04
-            containerd: main  # v2.0.0-rc.X
+            containerd: v2.0.0-rc.3
     env:
       UBUNTU_VERSION: "${{ matrix.ubuntu }}"
       CONTAINERD_VERSION: "${{ matrix.containerd }}"
@@ -153,7 +153,7 @@ jobs:
             rootlesskit: v2.1.0
             target: test-integration-rootless
           - ubuntu: 24.04
-            containerd: main  # v2.0.0-rc.X
+            containerd: v2.0.0-rc.3
             rootlesskit: v2.1.0
             target: test-integration-rootless
           - ubuntu: 24.04
diff --git a/Dockerfile b/Dockerfile
index fa41e63de70..c10d1ab2929 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -54,7 +54,7 @@ ARG SOCI_SNAPSHOTTER_VERSION=0.6.1
 FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.4.0 AS xx
 
 
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-bullseye AS build-base-debian
+FROM --platform=$BUILDPLATFORM golang:$GO_VERSION${GO_VERSION:+-}bullseye AS build-base-debian
 COPY --from=xx / /
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && \
@@ -110,7 +110,7 @@ RUN xx-go --wrap && \
   make build && \
   xx-verify --static cmd/ipfs/ipfs && cp -a cmd/ipfs/ipfs /out/${TARGETARCH}
 
-FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS build-base
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}${GO_VERSION:+-}alpine AS build-base
 RUN apk add --no-cache make git curl
 COPY . /go/src/github.com/containerd/nerdctl
 WORKDIR /go/src/github.com/containerd/nerdctl
diff --git a/pkg/composer/serviceparser/serviceparser_test.go b/pkg/composer/serviceparser/serviceparser_test.go
index b3aa2008f99..5639e4b0c11 100644
--- a/pkg/composer/serviceparser/serviceparser_test.go
+++ b/pkg/composer/serviceparser/serviceparser_test.go
@@ -333,16 +333,16 @@ services:
 
 func TestParseRelative(t *testing.T) {
 	t.Parallel()
-	const dockerComposeYAML = `
+	dockerComposeYAML := fmt.Sprintf(`
 services:
   foo:
     image: nginx:alpine
     volumes:
-    - "/file1:/file1"
-    - "./file2:/file2"
+    - "%sfile1:/file1"
+    - ".%sfile2:/file2"
     # break out the project dir, but this is fine
     - "../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../file3:/file3"
-`
+`, strconv.QuoteRune(os.PathSeparator), strconv.QuoteRune(os.PathSeparator))
 	comp := testutil.NewComposeDir(t, dockerComposeYAML)
 	defer comp.CleanUp()
 
diff --git a/pkg/inspecttypes/dockercompat/dockercompat_test.go b/pkg/inspecttypes/dockercompat/dockercompat_test.go
index 38dbb6835b3..21e868acd33 100644
--- a/pkg/inspecttypes/dockercompat/dockercompat_test.go
+++ b/pkg/inspecttypes/dockercompat/dockercompat_test.go
@@ -65,7 +65,7 @@ func TestContainerFromNative(t *testing.T) {
 			expected: &Container{
 				Created:        "0001-01-01T00:00:00Z",
 				Platform:       runtime.GOOS,
-				ResolvConfPath: tempStateDir + "/resolv.conf",
+				ResolvConfPath: filepath.Join(tempStateDir, "resolv.conf"),
 				State: &ContainerState{
 					Status:     "running",
 					Running:    true,
diff --git a/pkg/testutil/testregistry/testregistry_linux.go b/pkg/testutil/testregistry/testregistry_linux.go
index a5b60aaf834..dec04fbe63b 100644
--- a/pkg/testutil/testregistry/testregistry_linux.go
+++ b/pkg/testutil/testregistry/testregistry_linux.go
@@ -53,7 +53,11 @@ type TokenAuthServer struct {
 }
 
 func EnsureImages(base *testutil.Base) {
-	base.Cmd("pull", testutil.RegistryImage).AssertOK()
+	if os.Getenv("DISTRIBUTION_VERSION") == "next" {
+		base.Cmd("pull", testutil.RegistryImageNext).AssertOK()
+	} else {
+		base.Cmd("pull", testutil.RegistryImageStable).AssertOK()
+	}
 	base.Cmd("pull", testutil.DockerAuthImage).AssertOK()
 	base.Cmd("pull", testutil.KuboImage).AssertOK()
 }
@@ -340,7 +344,11 @@ func NewRegistry(base *testutil.Base, ca *testca.CA, port int, auth Auth, boundC
 	}
 
 	args = append(args, auth.Params(base)...)
-	args = append(args, testutil.RegistryImage)
+	registryImage := testutil.RegistryImageStable
+	if os.Getenv("DISTRIBUTION_VERSION") == "next" {
+		registryImage = testutil.RegistryImageNext
+	}
+	args = append(args, registryImage)
 
 	cleanup := func(err error) {
 		result := base.Cmd("rm", "-f", containerName).Run()
diff --git a/pkg/testutil/testutil_linux.go b/pkg/testutil/testutil_linux.go
index b3628f128e0..fda894d9394 100644
--- a/pkg/testutil/testutil_linux.go
+++ b/pkg/testutil/testutil_linux.go
@@ -34,7 +34,8 @@ var (
 	AlpineImage                 = mirrorOf("alpine:3.13")
 	NginxAlpineImage            = mirrorOf("nginx:1.19-alpine")
 	NginxAlpineIndexHTMLSnippet = "<title>Welcome to nginx!</title>"
-	RegistryImage               = mirrorOf("registry:2")
+	RegistryImageStable         = mirrorOf("registry:2")
+	RegistryImageNext           = "ghcr.io/distribution/distribution:3.0.0-beta.1"
 	WordpressImage              = mirrorOf("wordpress:5.7")
 	WordpressIndexHTMLSnippet   = "<title>WordPress &rsaquo; Installation</title>"
 	MariaDBImage                = mirrorOf("mariadb:10.5")