diff --git a/staging/src/k8s.io/cri-client/pkg/connection_target.go b/staging/src/k8s.io/cri-client/pkg/connection_target.go
index 297d889fb8b..207b83c6a9f 100644
--- a/staging/src/k8s.io/cri-client/pkg/connection_target.go
+++ b/staging/src/k8s.io/cri-client/pkg/connection_target.go
@@ -19,6 +19,12 @@ package cri
 import "strings"
 
 func clientTargetForAddress(addr string) string {
+	// Defensive: normalize callers that pass a unix endpoint instead of the
+	// parsed socket path.
+	if strings.HasPrefix(addr, "unix:///") {
+		addr = strings.TrimPrefix(addr, "unix://")
+	}
+
 	// grpc defaults to the DNS resolver for bare targets. Use the passthrough
 	// resolver for socket-style addresses so the custom dialer gets the raw path.
 	if strings.HasPrefix(addr, "/") {
diff --git a/staging/src/k8s.io/cri-client/pkg/connection_target_test.go b/staging/src/k8s.io/cri-client/pkg/connection_target_test.go
index 219878b2e8e..7c02cafd2ee 100644
--- a/staging/src/k8s.io/cri-client/pkg/connection_target_test.go
+++ b/staging/src/k8s.io/cri-client/pkg/connection_target_test.go
@@ -29,6 +29,11 @@ func TestClientTargetForAddress(t *testing.T) {
 			addr: "/run/containerd/containerd.sock",
 			want: "passthrough:////run/containerd/containerd.sock",
 		},
+		{
+			name: "unix socket endpoint",
+			addr: "unix:///run/containerd/containerd.sock",
+			want: "passthrough:////run/containerd/containerd.sock",
+		},
 		{
 			name: "windows pipe path",
 			addr: "//./pipe/containerd-containerd",