diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 64422b081b..0c73f51d39 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -422,6 +422,10 @@ jobs:
           # Not supported by the Rust shim yet: checkpoints, trace propagation,
           # State during an exec(TestIssue10589), and the idmapped mounts user namespaces need.
           - runtime: io.containerd.runc.v2-rs
+            # CRI only types the options of the runc runtime, so it gets the
+            # Rust shim as that runtime's binary, the way a drop-in shim is configured.
+            cri_runtime: io.containerd.runc.v2
+            cri_runtime_path: /usr/local/bin/containerd-shim-runc-v2-rs
             extra_testflags: "-no-criu -test.skip='(TestIssue10589|TestShimTraceContextPropagation)'"
             cri_skip: "(TestPodUserNS|TestUsernsVolumeCopyUp|TestImageVolumeWithUserNamespace|TestIssue10598)"
 
@@ -430,6 +434,8 @@ jobs:
       # Build the shim with tracing enabled, so that the integration suite
       # covers trace context propagation to runc and the OCI hooks.
       BUILDTAGS: shim_tracing
+      RUST_SHIM_VERSION: "0.2.0"
+      RUST_TOOLCHAIN: "1.91"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -494,13 +500,27 @@ jobs:
         run: |
           sudo modprobe dm_verity
 
+      - name: Cache the Rust runc shim
+        if: matrix.runtime == 'io.containerd.runc.v2-rs'
+        id: rust-shim
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ runner.temp }}/rust-shim/bin
+          key: rust-shim-${{ matrix.os }}-${{ env.RUST_SHIM_VERSION }}-rust-${{ env.RUST_TOOLCHAIN }}
+
+      - name: Install the Rust toolchain
+        if: matrix.runtime == 'io.containerd.runc.v2-rs' && steps.rust-shim.outputs.cache-hit != 'true'
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+        with:
+          toolchain: ${{ env.RUST_TOOLCHAIN }}
+
       - name: Install the Rust runc shim
         if: matrix.runtime == 'io.containerd.runc.v2-rs'
         run: |
-          git clone --depth=1 https://github.com/containerd/rust-extensions.git "$RUNNER_TEMP/rust-extensions"
-          cd "$RUNNER_TEMP/rust-extensions"
-          cargo build --release --bin containerd-shim-runc-v2-rs
-          sudo install -D target/release/containerd-shim-runc-v2-rs /usr/local/bin/
+          if [ "${{ steps.rust-shim.outputs.cache-hit }}" != "true" ]; then
+            cargo install containerd-runc-shim --version "$RUST_SHIM_VERSION" --locked --root "$RUNNER_TEMP/rust-shim"
+          fi
+          sudo install -D "$RUNNER_TEMP/rust-shim/bin/containerd-shim-runc-v2-rs" /usr/local/bin/
 
       - name: Install containerd
         env:
@@ -564,7 +584,8 @@ jobs:
 
       - name: CRI Integration Test
         env:
-          TEST_RUNTIME: ${{ matrix.runtime }}
+          TEST_RUNTIME: ${{ matrix.cri_runtime || matrix.runtime }}
+          CONTAINERD_RUNTIME_PATH: ${{ matrix.cri_runtime_path }}
           CGROUP_DRIVER: ${{ matrix.cgroup_driver }}
           RUNC_FLAVOR: ${{ matrix.runc }}
           SKIP: ${{ matrix.cri_skip }}
@@ -579,7 +600,8 @@ jobs:
 
       - name: cri-tools critest
         env:
-          TEST_RUNTIME: ${{ matrix.runtime }}
+          TEST_RUNTIME: ${{ matrix.cri_runtime || matrix.runtime }}
+          TEST_RUNTIME_PATH: ${{ matrix.cri_runtime_path }}
           CGROUP_DRIVER: ${{ matrix.cgroup_driver }}
         run: |
           env
diff --git a/script/critest.sh b/script/critest.sh
index c810750f82..dc944a2ae9 100755
--- a/script/critest.sh
+++ b/script/critest.sh
@@ -56,6 +56,7 @@ if [[ -z "${CONTAINERD_CONFIG_FILE:-}" ]]; then
 version = 2
 [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
 runtime_type = "${TEST_RUNTIME}"
+runtime_path = "${TEST_RUNTIME_PATH:-}"
 [plugins."io.containerd.snapshotter.v1.overlayfs"]
 # slow_chown is needed to avoid an error with kernel < 5.19:
 # > "snapshotter \"overlayfs\" doesn't support idmap mounts on this host,
diff --git a/script/test/utils.sh b/script/test/utils.sh
index dbfafcf635..527192ef3f 100755
--- a/script/test/utils.sh
+++ b/script/test/utils.sh
@@ -36,6 +36,8 @@ fi
 CONTAINERD_CONFIG_FILE=${CONTAINERD_CONFIG_FILE:-""}
 # The runtime to use (ignored when CONTAINERD_CONFIG_FILE is set)
 CONTAINERD_RUNTIME=${CONTAINERD_RUNTIME:-""}
+# The shim binary to run it with, instead of the one its type is looked up as
+CONTAINERD_RUNTIME_PATH=${CONTAINERD_RUNTIME_PATH:-""}
 if [ -z "${CONTAINERD_CONFIG_FILE}" ]; then
   config_file="${CONTAINERD_CONFIG_DIR}/containerd-config-cri.toml"
   truncate --size 0 "${config_file}"
@@ -77,6 +79,7 @@ EOF
     cat >>${config_file} <<EOF
 [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
 runtime_type = "${CONTAINERD_RUNTIME}"
+runtime_path = "${CONTAINERD_RUNTIME_PATH}"
 EOF
   fi
   if [ $IS_WINDOWS -eq 0 ]; then