diff --git a/pkg/agent/containerd/config.go b/pkg/agent/containerd/config.go
index 9b01ac06f88e..6eb752de49fa 100644
--- a/pkg/agent/containerd/config.go
+++ b/pkg/agent/containerd/config.go
@@ -53,7 +53,7 @@ func writeContainerdHosts(cfg *config.Node, containerdConfig templates.Container
 
 	// Write out new templates
 	for host, config := range hosts {
-		hostDir := filepath.Join(cfg.Containerd.Registry, host)
+		hostDir := filepath.Join(cfg.Containerd.Registry, hostDirectory(host))
 		hostsFile := filepath.Join(hostDir, "hosts.toml")
 		hostsTemplate, err := templates.ParseHostsTemplateFromConfig(templates.HostsTomlTemplate, config)
 		if err != nil {
diff --git a/pkg/agent/containerd/config_linux.go b/pkg/agent/containerd/config_linux.go
index a18328b3ecee..f6145219a5b1 100644
--- a/pkg/agent/containerd/config_linux.go
+++ b/pkg/agent/containerd/config_linux.go
@@ -27,6 +27,12 @@ const (
 	runtimesPath = "/usr/local/nvidia/toolkit:/opt/kwasm/bin"
 )
 
+// hostDirectory returns the name of the host dir for a given registry.
+// This is a no-op on linux, as all possible host:port strings are valid paths.
+func hostDirectory(host string) string {
+	return host
+}
+
 func getContainerdArgs(cfg *config.Node) []string {
 	args := []string{
 		"containerd",
diff --git a/pkg/agent/containerd/config_test.go b/pkg/agent/containerd/config_test.go
index 98a948a22435..5c5066a68b0f 100644
--- a/pkg/agent/containerd/config_test.go
+++ b/pkg/agent/containerd/config_test.go
@@ -1500,7 +1500,7 @@ func Test_UnitGetHostConfigs(t *testing.T) {
 			for host, config := range got {
 				hostsTemplate, err := templates.ParseHostsTemplateFromConfig(templates.HostsTomlTemplate, config)
 				assert.NoError(t, err, "ParseHostTemplateFromConfig for %s", host)
-				t.Logf("%s/hosts.d/%s/hosts.toml\n%s", tempDir, host, hostsTemplate)
+				t.Logf("%s/hosts.d/%s/hosts.toml\n%s", tempDir, hostDirectory(host), hostsTemplate)
 			}
 
 			// Confirm that the main containerd config.toml renders properly
diff --git a/pkg/agent/containerd/config_windows.go b/pkg/agent/containerd/config_windows.go
index 7383470cf78e..f322f5542ef0 100644
--- a/pkg/agent/containerd/config_windows.go
+++ b/pkg/agent/containerd/config_windows.go
@@ -4,6 +4,8 @@
 package containerd
 
 import (
+	"net"
+
 	"github.com/containerd/containerd"
 	"github.com/k3s-io/k3s/pkg/agent/templates"
 	"github.com/k3s-io/k3s/pkg/daemons/config"
@@ -13,6 +15,16 @@ import (
 	"k8s.io/cri-client/pkg/util"
 )
 
+// hostDirectory returns the name of the host dir for a given registry.
+// Colons are not allowed in windows paths, so convert `:port` to `_port_`.
+// Ref: https://github.com/containerd/containerd/blob/v1.7.25/remotes/docker/config/hosts.go#L291-L298
+func hostDirectory(host string) string {
+	if host, port, err := net.SplitHostPort(host); err == nil && port != "" {
+		return host + "_" + port + "_"
+	}
+	return host
+}
+
 func getContainerdArgs(cfg *config.Node) []string {
 	args := []string{
 		"containerd",