diff --git a/docs/containerd.md b/docs/containerd.md
index 7504f575288032a495a231417f8970806a24bc75..32de17683695f31a46449a8512d37cadd0af0072 100644
--- a/docs/containerd.md
+++ b/docs/containerd.md
@@ -30,4 +30,13 @@ containerd_registries:
     - "https://registry-1.docker.io"
 ```
 
+`containerd_registries` is ignored for pulling images when `image_command_tool=nerdctl`
+(the default for `container_manager=containerd`). Use `crictl` instead, it supports
+`containerd_registries` but lacks proper multi-arch support (see
+[#8375](https://github.com/kubernetes-sigs/kubespray/issues/8375)):
+
+```yaml
+image_command_tool: crictl
+```
+
 [containerd]: https://containerd.io/
diff --git a/docs/vars.md b/docs/vars.md
index 638ffd11cfeebd80a13c772dd85d28d8d8acc1db..11e33f5556cec8da54da5a866d57dcb6521ab04f 100644
--- a/docs/vars.md
+++ b/docs/vars.md
@@ -52,7 +52,11 @@ Kubernetes needs some parameters in order to get deployed. These are the
 following default cluster parameters:
 
 * *cluster_name* - Name of cluster (default is cluster.local)
-* *container_manager* - Container Runtime to install in the nodes (default is docker)
+* *container_manager* - Container Runtime to install in the nodes (default is containerd)
+* *image_command_tool* - Tool used to pull images (default depends on `container_manager`
+  and is `nerdctl` for `containerd`, `crictl` for `crio`, `docker` for `docker`)
+* *image_command_tool_on_localhost* - Tool used to pull images on localhost
+  (default is equal to `image_command_tool`)
 * *dns_domain* - Name of cluster DNS domain (default is cluster.local)
 * *kube_network_plugin* - Plugin to use for container networking
 * *kube_service_addresses* - Subnet for cluster IPs (default is