diff --git a/internal/cri/bandwidth/linux.go b/internal/cri/bandwidth/linux.go
index 3818777db..1011b8c71 100644
--- a/internal/cri/bandwidth/linux.go
+++ b/internal/cri/bandwidth/linux.go
@@ -40,19 +40,19 @@ import (
 	"encoding/hex"
 	"fmt"
 	"net"
-	"regexp"
 	"strings"
 
 	"k8s.io/apimachinery/pkg/api/resource"
 	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/klog/v2"
 	"k8s.io/utils/exec"
 
-	"k8s.io/klog/v2"
+	"github.com/containerd/containerd/v2/internal/lazyregexp"
 )
 
 var (
-	classShowMatcher      = regexp.MustCompile(`class htb (1:\d+)`)
-	classAndHandleMatcher = regexp.MustCompile(`filter parent 1:.*fh (\d+::\d+).*flowid (\d+:\d+)`)
+	classShowMatcher      = lazyregexp.New(`class htb (1:\d+)`)
+	classAndHandleMatcher = lazyregexp.New(`filter parent 1:.*fh (\d+::\d+).*flowid (\d+:\d+)`)
 )
 
 // tcShaper provides an implementation of the Shaper interface on Linux using the 'tc' tool.
diff --git a/pkg/identifiers/validate.go b/pkg/identifiers/validate.go
index 0acbf3fc4..c1c7a336a 100644
--- a/pkg/identifiers/validate.go
+++ b/pkg/identifiers/validate.go
@@ -26,8 +26,8 @@ package identifiers
 
 import (
 	"fmt"
-	"regexp"
 
+	"github.com/containerd/containerd/v2/internal/lazyregexp"
 	"github.com/containerd/errdefs"
 )
 
@@ -39,7 +39,7 @@ const (
 
 var (
 	// identifierRe defines the pattern for valid identifiers.
-	identifierRe = regexp.MustCompile(reAnchor(alphanum + reGroup(separators+reGroup(alphanum)) + "*"))
+	identifierRe = lazyregexp.New(reAnchor(alphanum + reGroup(separators+reGroup(alphanum)) + "*"))
 )
 
 // Validate returns nil if the string s is a valid identifier.
diff --git a/pkg/progress/writer.go b/pkg/progress/writer.go
index a80500490..58141e5a0 100644
--- a/pkg/progress/writer.go
+++ b/pkg/progress/writer.go
@@ -21,14 +21,14 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"regexp"
 	"strings"
 
 	"github.com/containerd/console"
+	"github.com/containerd/containerd/v2/internal/lazyregexp"
 )
 
 var (
-	regexCleanLine = regexp.MustCompile("\x1b\\[[0-9]+m[\x1b]?")
+	regexCleanLine = lazyregexp.New("\x1b\\[[0-9]+m[\x1b]?")
 )
 
 // Writer buffers writes until flush, at which time the last screen is cleared
diff --git a/pkg/reference/reference.go b/pkg/reference/reference.go
index d983c4e13..55c7b6fb5 100644
--- a/pkg/reference/reference.go
+++ b/pkg/reference/reference.go
@@ -20,9 +20,9 @@ import (
 	"errors"
 	"net/url"
 	"path"
-	"regexp"
 	"strings"
 
+	"github.com/containerd/containerd/v2/internal/lazyregexp"
 	digest "github.com/opencontainers/go-digest"
 )
 
@@ -80,7 +80,7 @@ type Spec struct {
 	Object string
 }
 
-var splitRe = regexp.MustCompile(`[:@]`)
+var splitRe = lazyregexp.New(`[:@]`)
 
 // Parse parses the string into a structured ref.
 func Parse(s string) (Spec, error) {
diff --git a/pkg/sys/filesys_windows.go b/pkg/sys/filesys_windows.go
index 67fc4048c..e06fbdbb8 100644
--- a/pkg/sys/filesys_windows.go
+++ b/pkg/sys/filesys_windows.go
@@ -18,11 +18,12 @@ package sys
 
 import (
 	"os"
-	"regexp"
 	"syscall"
 	"unsafe"
 
 	"golang.org/x/sys/windows"
+
+	"github.com/containerd/containerd/v2/internal/lazyregexp"
 )
 
 // SddlAdministratorsLocalSystem is local administrators plus NT AUTHORITY\System.
@@ -31,7 +32,7 @@ const SddlAdministratorsLocalSystem = "D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)"
 // volumePath is a regular expression to check if a path is a Windows
 // volume path (e.g., "\\?\Volume{4c1b02c1-d990-11dc-99ae-806e6f6e6963}"
 // or "\\?\Volume{4c1b02c1-d990-11dc-99ae-806e6f6e6963}\").
-var volumePath = regexp.MustCompile(`^\\\\\?\\Volume{[a-z0-9-]+}\\?$`)
+var volumePath = lazyregexp.New(`^\\\\\?\\Volume{[a-z0-9-]+}\\?$`)
 
 // MkdirAllWithACL is a custom version of os.MkdirAll modified for use on Windows
 // so that it is both volume path aware, and to create a directory