diff --git a/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1alpha2/api.proto b/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1alpha2/api.proto
index c2df37b8045..4564de5e3c3 100644
--- a/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1alpha2/api.proto
+++ b/staging/src/k8s.io/cri-api/pkg/apis/runtime/v1alpha2/api.proto
@@ -637,6 +637,9 @@ message WindowsContainerSecurityContext {
     // exist in the container image and be resolved there by the runtime;
     // otherwise, the runtime MUST return error.
     string run_as_username = 1;
+
+    // The contents of the GMSA credential spec to use to run this container.
+    string credential_spec = 2;
 }
 
 // WindowsContainerConfig contains platform-specific configuration for