diff --git a/go.mod b/go.mod
index a4d65ff95..d9b7e77ca 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/cbergoon/merkletree v0.5.0
 	github.com/cilium/ebpf v0.22.0
 	github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2
-	github.com/containernetworking/cni v1.3.0
+	github.com/containernetworking/cni v1.3.1
 	github.com/containernetworking/plugins v1.9.1
 	github.com/coreos/go-oidc/v3 v3.20.0
 	github.com/envoyproxy/go-control-plane v0.14.0
diff --git a/go.sum b/go.sum
index 37ad3db3d..63f8865d5 100644
--- a/go.sum
+++ b/go.sum
@@ -122,6 +122,8 @@ github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpS
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/containernetworking/cni v1.3.0 h1:v6EpN8RznAZj9765HhXQrtXgX+ECGebEYEmnuFjskwo=
 github.com/containernetworking/cni v1.3.0/go.mod h1:Bs8glZjjFfGPHMw6hQu82RUgEPNGEaBb9KS5KtNMnJ4=
+github.com/containernetworking/cni v1.3.1 h1:gnHlU/YC1bJcS+CSh+pYQKeuu4O4gsMGW1NMaLhkzW4=
+github.com/containernetworking/cni v1.3.1/go.mod h1:OtVXL0yXMfQb+p93OC/vRuhjpxsO1gAV0smjt28UQUQ=
 github.com/containernetworking/plugins v1.9.1 h1:8oU6WsIsU3bpnNZuvHp74a6cE1MJwbj2P7s4/yTUNlA=
 github.com/containernetworking/plugins v1.9.1/go.mod h1:fj7kS55qg3o/RgS+WGsF3+ZxwIImMPusQZKzBpcSr4c=
 github.com/coreos/go-iptables v0.8.0 h1:MPc2P89IhuVpLI7ETL/2tx3XZ61VeICZjYqDEgNsPRc=
diff --git a/vendor/github.com/containernetworking/cni/pkg/invoke/raw_exec.go b/vendor/github.com/containernetworking/cni/pkg/invoke/raw_exec.go
index 5ab5cc885..8a39ff309 100644
--- a/vendor/github.com/containernetworking/cni/pkg/invoke/raw_exec.go
+++ b/vendor/github.com/containernetworking/cni/pkg/invoke/raw_exec.go
@@ -25,6 +25,9 @@ import (
 	"time"
 
 	"github.com/containernetworking/cni/pkg/types"
+	"go.opentelemetry.io/otel/baggage"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/trace"
 )
 
 type RawExec struct {
@@ -35,7 +38,7 @@ func (e *RawExec) ExecPlugin(ctx context.Context, pluginPath string, stdinData [
 	stdout := &bytes.Buffer{}
 	stderr := &bytes.Buffer{}
 	c := exec.CommandContext(ctx, pluginPath)
-	c.Env = environ
+	c.Env = injectTraceContext(ctx, environ)
 	c.Stdin = bytes.NewBuffer(stdinData)
 	c.Stdout = stdout
 	c.Stderr = stderr
@@ -69,13 +72,42 @@ func (e *RawExec) ExecPlugin(ctx context.Context, pluginPath string, stdinData [
 	return stdout.Bytes(), nil
 }
 
+// injectTraceContext will add OpenTelemetry trace context to the environment variables based on
+// https://github.com/open-telemetry/opentelemetry-specification/blob/main/oteps/0258-env-context-baggage-carriers.md
+func injectTraceContext(ctx context.Context, environ []string) []string {
+	sc := trace.SpanContextFromContext(ctx)
+	if !sc.IsValid() {
+		return environ
+	}
+
+	ctx = trace.ContextWithRemoteSpanContext(ctx, sc)
+	mc := propagation.MapCarrier{}
+	(propagation.TraceContext{}).Inject(ctx, mc)
+
+	// Currently, both traceparent and tracestate are not exported variables,
+	// https://github.com/open-telemetry/opentelemetry-go/blob/bcf8234d0c9c48b626cad85367a3681f3fc0c0fd/propagation/trace_context.go#L18-L19
+	// so we have to use the string literals here.
+	if traceparent := mc.Get("traceparent"); traceparent != "" {
+		environ = append(environ, "TRACEPARENT"+"="+traceparent)
+	}
+
+	if tracestate := mc.Get("tracestate"); tracestate != "" {
+		environ = append(environ, "TRACESTATE"+"="+tracestate)
+	}
+
+	if envBaggage := baggage.FromContext(ctx).String(); envBaggage != "" {
+		environ = append(environ, "BAGGAGE"+"="+envBaggage)
+	}
+	return environ
+}
+
 func (e *RawExec) pluginErr(err error, stdout, stderr []byte) error {
 	emsg := types.Error{}
 	if len(stdout) == 0 {
 		if len(stderr) == 0 {
 			emsg.Msg = fmt.Sprintf("netplugin failed with no error message: %v", err)
 		} else {
-			emsg.Msg = fmt.Sprintf("netplugin failed: %q", string(stderr))
+			emsg.Msg = fmt.Sprintf("netplugin failed: %q: %v", string(stderr), err)
 		}
 	} else if perr := json.Unmarshal(stdout, &emsg); perr != nil {
 		emsg.Msg = fmt.Sprintf("netplugin failed but error parsing its diagnostic message %q: %v", string(stdout), perr)
diff --git a/vendor/github.com/containernetworking/cni/pkg/types/types.go b/vendor/github.com/containernetworking/cni/pkg/types/types.go
index f4b3ce353..4480059b6 100644
--- a/vendor/github.com/containernetworking/cni/pkg/types/types.go
+++ b/vendor/github.com/containernetworking/cni/pkg/types/types.go
@@ -229,7 +229,7 @@ func (r *Route) Copy() *Route {
 }
 
 // Well known error codes
-// see https://github.com/containernetworking/cni/blob/main/SPEC.md#well-known-error-codes
+// see https://github.com/containernetworking/cni/blob/main/SPEC.md#error
 const (
 	ErrUnknown                     uint = iota // 0
 	ErrIncompatibleCNIVersion                  // 1
@@ -241,6 +241,8 @@ const (
 	ErrInvalidNetworkConfig                    // 7
 	ErrInvalidNetNS                            // 8
 	ErrTryAgainLater               uint = 11
+	ErrPluginNotAvailable          uint = 50
+	ErrLimitedConnectivity         uint = 51
 	ErrInternal                    uint = 999
 )
 
diff --git a/vendor/github.com/containernetworking/cni/pkg/version/version.go b/vendor/github.com/containernetworking/cni/pkg/version/version.go
index cfb6a12fa..4994e30de 100644
--- a/vendor/github.com/containernetworking/cni/pkg/version/version.go
+++ b/vendor/github.com/containernetworking/cni/pkg/version/version.go
@@ -39,13 +39,13 @@ var (
 	All    = PluginSupports("0.1.0", "0.2.0", "0.3.0", "0.3.1", "0.4.0", "1.0.0", "1.1.0")
 )
 
-// VersionsFrom returns a list of versions starting from min, inclusive
-func VersionsStartingFrom(min string) PluginInfo {
+// VersionsFrom returns a list of versions starting from minVer, inclusive
+func VersionsStartingFrom(minVer string) PluginInfo {
 	out := []string{}
 	// cheat, just assume ordered
 	ok := false
 	for _, v := range All.SupportedVersions() {
-		if !ok && v == min {
+		if !ok && v == minVer {
 			ok = true
 		}
 		if ok {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0811f2652..ac096d01f 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -262,7 +262,7 @@ github.com/containerd/log
 # github.com/containerd/platforms v0.2.1
 ## explicit; go 1.20
 github.com/containerd/platforms
-# github.com/containernetworking/cni v1.3.0
+# github.com/containernetworking/cni v1.3.1
 ## explicit; go 1.21
 github.com/containernetworking/cni/pkg/invoke
 github.com/containernetworking/cni/pkg/ns