diff --git a/0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch b/0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
index 13ab77e..8cd7de7 100644
--- a/0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
+++ b/0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
@@ -1,4 +1,4 @@
-From 0a038dd20742bcc5e244d92af75399b0c3cdc030 Mon Sep 17 00:00:00 2001
+From 876958fd21984b77e0a70d6ac5763e757ca976ef Mon Sep 17 00:00:00 2001
 From: Aleksa Sarai <cyphar@cyphar.com>
 Date: Wed, 22 May 2024 12:58:32 -0700
 Subject: [PATCH] BUILD: SLE12: revert "btrfs: depend on kernel UAPI instead of
@@ -143,20 +143,20 @@ Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
  delete mode 100644 vendor/golang.org/x/sys/cpu/syscall_aix_ppc64_gc.go
 
 diff --git a/go.mod b/go.mod
-index 8028c97c1b0c..865356aced28 100644
+index a12092d07279..d9468814b976 100644
 --- a/go.mod
 +++ b/go.mod
 @@ -9,7 +9,7 @@ require (
  	github.com/Microsoft/go-winio v0.6.2
- 	github.com/Microsoft/hcsshim v0.11.5
+ 	github.com/Microsoft/hcsshim v0.11.7
  	github.com/containerd/aufs v1.0.0
 -	github.com/containerd/btrfs/v2 v2.0.0
 +	github.com/containerd/btrfs v1.0.0
  	github.com/containerd/cgroups/v3 v3.0.2
  	github.com/containerd/console v1.0.3
- 	github.com/containerd/continuity v0.4.2
+ 	github.com/containerd/containerd/api v1.7.19
 diff --git a/go.sum b/go.sum
-index 4695f33f521e..7a8a8d9f0121 100644
+index 044d37b41889..d488196d9c00 100644
 --- a/go.sum
 +++ b/go.sum
 @@ -133,8 +133,8 @@ github.com/containerd/aufs v0.0.0-20201003224125-76a6863f2989/go.mod h1:AkGGQs9N
@@ -171,7 +171,7 @@ index 4695f33f521e..7a8a8d9f0121 100644
  github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f/go.mod h1:OApqhQ4XNSNC13gXIwDjhOQxjWa/NxkwZXJ1EvqT0ko=
  github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59/go.mod h1:pA0z1pT8KYB3TCXK/ocprsh7MAkoW8bZVzPdih9snmM=
 diff --git a/snapshots/btrfs/btrfs.go b/snapshots/btrfs/btrfs.go
-index a6a41e68e3cd..5cef986b5e7b 100644
+index 841c33aee785..764abf643d52 100644
 --- a/snapshots/btrfs/btrfs.go
 +++ b/snapshots/btrfs/btrfs.go
 @@ -25,7 +25,7 @@ import (
@@ -182,7 +182,7 @@ index a6a41e68e3cd..5cef986b5e7b 100644
 +	"github.com/containerd/btrfs"
  	"github.com/containerd/continuity/fs"
  
- 	"github.com/containerd/containerd/log"
+ 	"github.com/containerd/containerd/mount"
 diff --git a/vendor/github.com/containerd/btrfs/v2/.gitignore b/vendor/github.com/containerd/btrfs/.gitignore
 similarity index 100%
 rename from vendor/github.com/containerd/btrfs/v2/.gitignore
@@ -3086,7 +3086,7 @@ index e8b6cdbe9a7c..000000000000
 -	return
 -}
 diff --git a/vendor/modules.txt b/vendor/modules.txt
-index 9d97f2a203b2..937ca9b44ded 100644
+index 959f6dafa3f5..0cdfde1f1d5c 100644
 --- a/vendor/modules.txt
 +++ b/vendor/modules.txt
 @@ -85,9 +85,9 @@ github.com/cilium/ebpf/link
@@ -3102,7 +3102,7 @@ index 9d97f2a203b2..937ca9b44ded 100644
  # github.com/containerd/cgroups v1.1.0
  ## explicit; go 1.17
  github.com/containerd/cgroups/stats/v1
-@@ -532,7 +532,6 @@ golang.org/x/sync/errgroup
+@@ -570,7 +570,6 @@ golang.org/x/sync/errgroup
  golang.org/x/sync/semaphore
  # golang.org/x/sys v0.18.0
  ## explicit; go 1.18
@@ -3111,5 +3111,5 @@ index 9d97f2a203b2..937ca9b44ded 100644
  golang.org/x/sys/unix
  golang.org/x/sys/windows
 -- 
-2.45.1
+2.46.0
 
diff --git a/_service b/_service
index b207126..22bac0a 100644
--- a/_service
+++ b/_service
@@ -3,8 +3,8 @@
     <param name="url">https://github.com/containerd/containerd.git</param>
     <param name="scm">git</param>
     <param name="filename">containerd</param>
-    <param name="versionformat">1.7.17_%h</param>
-    <param name="revision">v1.7.17</param>
+    <param name="versionformat">1.7.21_%h</param>
+    <param name="revision">v1.7.21</param>
     <param name="exclude">.git</param>
   </service>
   <service name="recompress" mode="manual">
diff --git a/containerd-1.7.17_3a4de459a689.tar.xz b/containerd-1.7.17_3a4de459a689.tar.xz
deleted file mode 100644
index 645202b..0000000
--- a/containerd-1.7.17_3a4de459a689.tar.xz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:5aaf84248bedb272f99c4da77c0acb5d39d44a61e94f4cb1c95880c68a73c396
-size 5933672
diff --git a/containerd-1.7.21_472731909fa3.tar.xz b/containerd-1.7.21_472731909fa3.tar.xz
new file mode 100644
index 0000000..1abec27
--- /dev/null
+++ b/containerd-1.7.21_472731909fa3.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d486a7df4278b715fbd85fc4f7449fd055c2fa855106ff6ec0a409e3b3aed739
+size 6080056
diff --git a/containerd.changes b/containerd.changes
index 6dd799f..ddd998a 100644
--- a/containerd.changes
+++ b/containerd.changes
@@ -1,3 +1,13 @@
+-------------------------------------------------------------------
+Thu Sep  5 14:03:03 UTC 2024 - Aleksa Sarai <asarai@suse.com>
+
+- Update to containerd v1.7.21. Upstream release notes:
+  <https://github.com/containerd/containerd/releases/tag/v1.7.21>
+  Fixes CVE-2023-47108. bsc#1217070
+  Fixes CVE-2023-45142. bsc#1228553
+- Rebase patches:
+  * 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
+
 -------------------------------------------------------------------
 Mon Jun 24 10:12:35 UTC 2024 - Dan Čermák <dcermak@suse.com>
 
diff --git a/containerd.spec b/containerd.spec
index cdf204f..34faf03 100644
--- a/containerd.spec
+++ b/containerd.spec
@@ -23,14 +23,14 @@
 %endif
 
 # MANUAL: Update the git_version.
-%define git_version 3a4de459a68952ffb703bbe7f2290861a75b6b67
-%define git_short   3a4de459a689
+%define git_version 472731909fa34bd7bc9c087e4c27943f9835f111
+%define git_short   472731909fa3
 
 %global provider_prefix github.com/containerd/containerd
 %global import_path %{provider_prefix}
 
 Name:           containerd
-Version:        1.7.17
+Version:        1.7.21
 Release:        0
 Summary:        Standalone OCI Container Daemon
 License:        Apache-2.0