diff --git a/roles/container-engine/containerd/defaults/main.yml b/roles/container-engine/containerd/defaults/main.yml
index 908f56b3018f45479949a4f5b415ce2da8c3dd9c..82276b9bfca6f7719c5de10ed31005102471d739 100644
--- a/roles/container-engine/containerd/defaults/main.yml
+++ b/roles/container-engine/containerd/defaults/main.yml
@@ -64,3 +64,6 @@ containerd_fedora_repo_base_url: "https://download.docker.com/linux/fedora/{{ an
 containerd_fedora_repo_gpgkey: "https://download.docker.com/linux/fedora/gpg"
 containerd_fedora_repo_repokey: "9DC858229FC7DD38854AE2D88D81803C0EBFCD88"
 containerd_fedora_repo_component: "stable"
+
+# Extra config to be put in {{ containerd_cfg_dir }}/config.toml literally
+containerd_extra_args: ''
diff --git a/roles/container-engine/containerd/tasks/main.yml b/roles/container-engine/containerd/tasks/main.yml
index cd97f88d9ff730d130f398fbbe44742b80787c47..6aacec08d2bba2d0f0a65738b6a88940914787e3 100644
--- a/roles/container-engine/containerd/tasks/main.yml
+++ b/roles/container-engine/containerd/tasks/main.yml
@@ -79,7 +79,7 @@
     src: config.toml.j2
     dest: "{{ containerd_cfg_dir }}/config.toml"
     owner: "root"
-    mode: 0644
+    mode: 0640
   notify: restart containerd
 
 # This is required to ensure any apt upgrade will not break kubernetes
diff --git a/roles/container-engine/containerd/templates/config.toml.j2 b/roles/container-engine/containerd/templates/config.toml.j2
index ed38969362e20ae6a31814692f116d53e350e366..c830e7a46c9be60dcb1bb25e27d971d822a6ad5a 100644
--- a/roles/container-engine/containerd/templates/config.toml.j2
+++ b/roles/container-engine/containerd/templates/config.toml.j2
@@ -39,3 +39,7 @@ version = 2
         [plugins."io.containerd.grpc.v1.cri".registry.mirrors."{{ registry }}"]
           endpoint = ["{{ ([ addr ] | flatten ) | join('","') }}"]
 {% endfor %}
+
+{% if containerd_extra_args is defined %}
+{{ containerd_extra_args }}
+{% endif %}