diff --git a/hco/configs/cdi.toml b/hco/configs/cdi.toml
new file mode 100644
index 0000000..5a9835f
--- /dev/null
+++ b/hco/configs/cdi.toml
@@ -0,0 +1,3 @@
+[plugins]
+  [plugins."io.containerd.grpc.v1.cri"]
+    device_ownership_from_security_context = true
diff --git a/hco/fragments/VMInstanceCeph.yaml b/hco/fragments/VMInstanceCeph.yaml
index 199d10d..1ba516d 100644
--- a/hco/fragments/VMInstanceCeph.yaml
+++ b/hco/fragments/VMInstanceCeph.yaml
@@ -121,6 +121,10 @@
             owner: "root:root"
             permissions: "0644"
             content: { get_param: hardware_metadata}
+          - path: /etc/k0s/containerd.d/cdi.toml
+            owner: "root:root"
+            permissions: "0644"
+            content: {get_file: ../configs/cdi.toml}
 
   install_config_agent:
     type: "OS::Heat::MultipartMime"