diff --git a/.gitignore b/.gitignore
index cf34e1f..ad07063 100644
--- a/.gitignore
+++ b/.gitignore
@@ -67,3 +67,9 @@
 /kata-containers-3.18.0-vendor.tar.gz
 /kata-containers-3.19.1.tar.gz
 /kata-containers-3.19.1-vendor.tar.gz
+/kata-containers-3.20.0.tar.gz
+/kata-containers-3.20.0-vendor.tar.gz
+/kata-containers-3.21.0.tar.gz
+/kata-containers-3.21.0-vendor.tar.gz
+/kata-containers-3.22.0.tar.gz
+/kata-containers-3.22.0-vendor.tar.gz
diff --git a/kata-containers.spec b/kata-containers.spec
index cdb4a9a..641d018 100644
--- a/kata-containers.spec
+++ b/kata-containers.spec
@@ -28,7 +28,7 @@
 %endif
 
 # https://github.com/kata-containers/kata-containers
-Version: 3.19.1
+Version: 3.22.0
 %global tag         %{version}%{?rcstr}
 
 %global domain      github.com
@@ -56,7 +56,7 @@ workload isolation and security advantages of VMs. https://katacontainers.io/.}
 # Unlike for RHEL, we cannot strip it down because we build all components
 # (RHEL builds only build kata-agent)
 Name:       %{repo}
-Release:    1%{?rcrel}%{?dist}.1
+Release:    1%{?rcrel}%{?dist}
 Summary:    Kata Containers version 3.x repository
 License:    Apache-2.0
 Url:        https://%{download}
@@ -390,6 +390,15 @@ fi
 
 
 %changelog
+* Tue Nov 04 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.22.0-1
+- kata-containers 3.22.0
+
+* Thu Sep 25 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.21.0-1
+- kata-containers 3.21.0
+
+* Wed Sep 10 2025 Christophe de Dinechin <dinechin@redhat.com> - 3.20.0-1
+- kata-containers 3.20.0
+
 * Fri Aug 15 2025 Maxwell G <maxwell@gtmx.me> - 3.19.1-1.1
 - Rebuild for golang-1.25.0
 
diff --git a/sources b/sources
index a58f5cf..c82bc85 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (kata-containers-3.19.1.tar.gz) = 4a8c70fead695693fc9b9978944e3131fea8e85cb01814de72920088dba8c9707da3c7df592444e32a170a18e13dc1a7a6806069f4821d7f30b0db8b221016a7
-SHA512 (kata-containers-3.19.1-vendor.tar.gz) = f4650f056999cce79bb58b37bba8e38c18fee8e98610e185d5cccf844045f38ec62503368497c84d209e788c4e47c72afaf3392f619b6f3a1f5e3779bf6139f6
+SHA512 (kata-containers-3.22.0.tar.gz) = 142bc70b6455f545d534371a845980ed00985d7225b5f672f3fef046a6f0a31871bd69ee2c931ab94c10089086123fe5987ec6615d7a7308027531269c4dae48
+SHA512 (kata-containers-3.22.0-vendor.tar.gz) = 10b28d746d5176acce4abcb902213edcfb43b0b390a5d20f114b7dc4e11bc8de26098f180bdf75bcff3e6d03f2b3a31908f4386d7ca24119f9e001cd99c52060
diff --git a/test-kata-rpm-containerd.sh b/test-kata-rpm-containerd.sh
new file mode 100755
index 0000000..f34c27a
--- /dev/null
+++ b/test-kata-rpm-containerd.sh
@@ -0,0 +1,93 @@
+#!/bin/bash
+set -euo pipefail
+
+# Usage: ./test_kata_rpm_containerd.sh /path/to/kata-containers-*.rpm
+
+RPM_PATH=${1:-}
+
+if [[ -z "$RPM_PATH" ]]; then
+  echo "Usage: $0 /path/to/kata-containers-*.rpm"
+  exit 1
+fi
+
+# 1. Remove existing kata-containers packages and install the RPM
+echo "[1/7] Removing existing kata-containers packages..."
+sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove"
+
+echo "[2/7] Installing Kata Containers RPM: $RPM_PATH"
+sudo rpm -i "$RPM_PATH"
+
+echo "[3/7] Checking installed binaries and versions..."
+# kata-agent is not expected on the host; it runs inside the Kata VM image.
+if command -v kata-runtime >/dev/null 2>&1; then
+  kata-runtime --version
+else
+  echo "kata-runtime not found in PATH!"; exit 1
+fi
+if command -v kata-ctl >/dev/null 2>&1; then
+  kata-ctl version
+else
+  echo "kata-ctl not found in PATH!"; exit 1
+fi
+
+echo "[4/7] Checking QEMU version..."
+if command -v qemu-system-x86_64 >/dev/null 2>&1; then
+  qemu-system-x86_64 --version
+else
+  echo "qemu-system-x86_64 not found in PATH!"; exit 1
+fi
+
+echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..."
+sudo modprobe vhost_net
+
+# 6. Run kata-runtime check (system compatibility)
+echo "[6/7] Running kata-runtime check (system compatibility)..."
+if ! kata-runtime check; then
+  echo "[ERROR] System is not capable of running Kata Containers."
+  exit 1
+fi
+
+# 7. Run a simple Kata container using containerd (if available)
+echo "[7/7] Attempting to run a test container with Kata runtime (containerd)..."
+if command -v ctr >/dev/null 2>&1; then
+  # Clean up any existing test containers
+  echo "[Test] Cleaning up any existing test containers..."
+  sudo ctr task kill kata-test-bg 2>/dev/null || true
+  sudo ctr task rm kata-test-bg 2>/dev/null || true
+  sudo ctr container rm kata-test-bg 2>/dev/null || true
+
+  sudo ctr images pull docker.io/library/alpine:latest
+  # Start a container in the background (do not use --rm so we can exec into it)
+  sudo ctr run -d --runtime io.containerd.kata.v2 docker.io/library/alpine:latest kata-test-bg sleep 300
+  # Wait a moment for the container to be up
+  sleep 2
+  echo "[Test] Exec into the running container and run 'uname -a'..."
+  sudo ctr task exec --exec-id kata-uname kata-test-bg uname -a
+  echo "[Test] Show /etc/os-release inside the container..."
+  sudo ctr task exec --exec-id kata-osrel kata-test-bg cat /etc/os-release
+
+  echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..."
+  HOST_CMDLINE=$(cat /proc/cmdline)
+  GUEST_CMDLINE=$(sudo ctr task exec --exec-id kata-cmdline kata-test-bg cat /proc/cmdline)
+  echo "[Test] Host cmdline: ${HOST_CMDLINE}"
+  echo "[Test] Container cmdline: ${GUEST_CMDLINE}"
+  if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+    echo "[ERROR] VM verification: Container cmdline is the same as host - this indicates the container is NOT running in a Kata VM!"
+    exit 1
+  else
+    echo "[SUCCESS] Kata VM isolation is working correctly!"
+  fi
+  # Clean up: kill the task and delete the container
+  echo "[Cleanup] Deleting test container..."
+  sudo ctr task kill kata-test-bg || true
+  sudo ctr task rm kata-test-bg || true
+  sudo ctr container rm kata-test-bg || true
+  # Also run the original test (run+rm)
+  sudo ctr run --runtime io.containerd.kata.v2 --rm docker.io/library/alpine:latest kata-test uname -a || {
+    echo "Failed to run container with Kata runtime."; exit 1;
+  }
+else
+  echo "containerd (ctr) not found, skipping container test."
+fi
+
+echo "All tests completed. If no errors above, the RPM is likely working with containerd."
diff --git a/test-kata-rpm-crio.sh b/test-kata-rpm-crio.sh
new file mode 100755
index 0000000..fc5365b
--- /dev/null
+++ b/test-kata-rpm-crio.sh
@@ -0,0 +1,208 @@
+#!/bin/bash
+set -euo pipefail
+
+# Usage: ./test_kata_rpm_crio.sh /path/to/kata-containers-3.20*.rpm
+
+RPM_PATH=${1:-}
+
+if [[ -z "$RPM_PATH" ]]; then
+  echo "Usage: $0 /path/to/kata-containers-*.rpm"
+  exit 1
+fi
+
+# 1. Remove existing kata-containers packages and install the RPM
+echo "[1/7] Removing existing kata-containers packages..."
+sudo rpm -e --allmatches kata-containers 2>/dev/null || echo "No existing kata-containers packages to remove"
+
+echo "[2/7] Installing Kata Containers RPM: $RPM_PATH"
+sudo rpm -i "$RPM_PATH"
+
+echo "[3/7] Checking installed binaries and versions..."
+# kata-agent is not expected on the host; it runs inside the Kata VM image.
+if command -v kata-runtime >/dev/null 2>&1; then
+  kata-runtime --version
+else
+  echo "kata-runtime not found in PATH!"; exit 1
+fi
+if command -v kata-ctl >/dev/null 2>&1; then
+  kata-ctl version
+else
+  echo "kata-ctl not found in PATH!"; exit 1
+fi
+
+echo "[4/7] Checking QEMU version..."
+if command -v qemu-system-x86_64 >/dev/null 2>&1; then
+  qemu-system-x86_64 --version
+else
+  echo "qemu-system-x86_64 not found in PATH!"; exit 1
+fi
+
+echo "[5/7] Loading vhost_net kernel module (required for Kata networking)..."
+sudo modprobe vhost_net
+
+# 6. Run kata-runtime check (system compatibility)
+echo "[6/7] Running kata-runtime check (system compatibility)..."
+if ! kata-runtime check; then
+  echo "[ERROR] System is not capable of running Kata Containers."
+  exit 1
+fi
+
+# 7. Run a simple Kata container using CRI-O (if available)
+echo "[7/7] Attempting to run a test container with Kata runtime (CRI-O)..."
+if command -v crictl >/dev/null 2>&1; then
+  # Check if CRI-O is running, if not try to start it
+  if ! systemctl is-active --quiet crio; then
+    echo "[Test] CRI-O is not running, attempting to start it..."
+    sudo systemctl start crio || {
+      echo "[WARNING] Failed to start CRI-O..."
+      exit 1
+    }
+  fi
+
+  # Configure crictl to use CRI-O instead of containerd
+  echo "[Test] Configuring crictl to use CRI-O..."
+  sudo crictl config --set runtime-endpoint=unix:///var/run/crio/crio.sock
+  sudo crictl config --set image-endpoint=unix:///var/run/crio/crio.sock
+  # Pull the image
+  echo "[Test] Pulling alpine image..."
+  sudo crictl pull docker.io/library/alpine:latest
+
+  # Create temporary pod and container config files
+  echo "[Test] Creating pod and container configurations..."
+
+  # Create pod config (minimal Kata documentation config)
+  cat > /tmp/pod-config.json << 'EOF'
+{
+    "metadata": {
+        "name": "busybox-pod",
+        "uid": "busybox-pod",
+        "namespace": "test.kata"
+    },
+    "hostname": "busybox_host",
+    "log_directory": "",
+    "dns_config": {
+    },
+    "port_mappings": [],
+    "resources": {
+    },
+    "labels": {
+    },
+    "annotations": {
+    },
+    "linux": {
+    }
+}
+EOF
+
+  # Create container config
+  cat > /tmp/container-config.json << 'EOF'
+{
+  "metadata": {
+    "name": "busybox-container"
+  },
+  "image": {
+    "image": "docker.io/library/alpine:latest"
+  },
+  "command": ["sleep", "300"],
+  "linux": {}
+}
+EOF
+
+  # Create pod sandbox
+  echo "[Test] Creating pod sandbox with kata runtime..."
+  POD_ID=$(sudo crictl runp --runtime kata /tmp/pod-config.json 2>/dev/null || echo "")
+  if [[ -z "$POD_ID" ]]; then
+    echo "[Test] Failed to create pod sandbox with Kata runtime"
+    journalctl -g kata
+    echo "[Test] Failed to create pod sandbox with Kata runtime, exiting"
+    exit 1
+  fi
+
+  if [[ -n "$POD_ID" ]]; then
+    echo "[Test] Pod created with ID: $POD_ID, waiting for it to be ready..."
+    # Wait for pod to be ready (up to 30 seconds)
+    for i in {1..30}; do
+      if sudo crictl inspectp $POD_ID >/dev/null 2>&1; then
+        echo "[Test] Pod is ready!"
+        break
+      fi
+      echo "[Test] Waiting for pod to be ready... ($i/30)"
+      sleep 1
+    done
+
+    # Create container
+    echo "[Test] Creating container..."
+    CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+    if [[ -z "$CONTAINER_ID" ]]; then
+      echo "[Test] Creating container with default runtime..."
+      CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+    fi
+
+    if [[ -n "$CONTAINER_ID" ]]; then
+      echo "[Test] Container created with ID: $CONTAINER_ID"
+
+      # Start container
+      echo "[Test] Starting container..."
+      if ! sudo crictl start $CONTAINER_ID 2>/dev/null; then
+        # Clean up and retry
+        echo "[Test] Container start failed, cleaning up and retrying..."
+        sudo crictl stop $CONTAINER_ID 2>/dev/null || true
+        sudo crictl rm $CONTAINER_ID 2>/dev/null || true
+        CONTAINER_ID=$(sudo crictl create $POD_ID /tmp/container-config.json /tmp/pod-config.json 2>/dev/null || echo "")
+        if [[ -z "$CONTAINER_ID" ]] || ! sudo crictl start $CONTAINER_ID; then
+          echo "[ERROR] Failed to start container after cleanup"
+          exit 1
+        fi
+      fi
+
+      # Wait a moment for the container to be up
+      sleep 2
+
+      # Execute commands in the container
+      echo "[Test] Exec into the running container and run 'uname -a'..."
+      sudo crictl exec $CONTAINER_ID uname -a || echo "uname command failed"
+
+      echo "[Test] Show /etc/os-release inside the container..."
+      sudo crictl exec $CONTAINER_ID cat /etc/os-release || echo "cat /etc/os-release failed"
+
+      echo "[Test] Verify we're running in a Kata VM by checking /proc/cmdline..."
+      HOST_CMDLINE=$(cat /proc/cmdline)
+      GUEST_CMDLINE=$(sudo crictl exec $CONTAINER_ID cat /proc/cmdline || echo "cat /proc/cmdline command failed")
+      echo "[Test] Host cmdline: ${HOST_CMDLINE}"
+      echo "[Test] Container cmdline: ${GUEST_CMDLINE}"
+      if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+          echo "[ERROR] The container is NOT running in a Kata VM!"
+      else
+          echo "[SUCCESS] Kata VM isolation is working correctly!"
+      fi
+
+      # Clean up
+      echo "[Cleanup] Stopping and removing container..."
+      sudo crictl stop $CONTAINER_ID || true
+      sudo crictl rm $CONTAINER_ID || true
+
+      if [[ "${HOST_CMDLINE}" == "${GUEST_CMDLINE}" ]]; then
+          echo "[ERROR] Container was running but not with Kata runtime"
+          exit 1
+      fi
+    else
+      echo "[ERROR] Failed to create container"
+    fi
+
+    # Clean up pod
+    echo "[Cleanup] Removing pod sandbox..."
+    sudo crictl stopp $POD_ID || true
+    sudo crictl rmp $POD_ID || true
+  else
+    echo "[ERROR] Failed to create pod sandbox"
+  fi
+
+  # Clean up temp files
+  rm -f /tmp/pod-config.json /tmp/container-config.json
+
+  echo "[Test] CRI-O container test completed."
+else
+  echo "CRI-O (crictl) not found, skipping container test."
+fi
+
+echo "All tests completed. If no errors above, the RPM is likely working with CRI-O."
diff --git a/test-kata-rpm.sh b/test-kata-rpm.sh
deleted file mode 100755
index 76c6ac3..0000000
--- a/test-kata-rpm.sh
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-# Usage: ./test_kata_rpm.sh /path/to/kata-containers-3.15*.rpm
-
-RPM_PATH=${1:-}
-
-if [[ -z "$RPM_PATH" ]]; then
-  echo "Usage: $0 /path/to/kata-containers-3.15*.rpm"
-  exit 1
-fi
-
-# 1. Install the RPM
-echo "[1/6] Installing Kata Containers RPM: $RPM_PATH"
-sudo dnf install -y "$RPM_PATH"
-
-echo "[2/6] Checking installed binaries and versions..."
-# kata-agent is not expected on the host; it runs inside the Kata VM image.
-if command -v kata-runtime >/dev/null 2>&1; then
-  kata-runtime --version
-else
-  echo "kata-runtime not found in PATH!"; exit 1
-fi
-if command -v kata-ctl >/dev/null 2>&1; then
-  kata-ctl version
-else
-  echo "kata-ctl not found in PATH!"; exit 1
-fi
-
-echo "[3/6] Checking QEMU version..."
-if command -v qemu-system-x86_64 >/dev/null 2>&1; then
-  qemu-system-x86_64 --version
-else
-  echo "qemu-system-x86_64 not found in PATH!"; exit 1
-fi
-
-echo "[4/6] Loading vhost_net kernel module (required for Kata networking)..."
-sudo modprobe vhost_net
-
-# 5. Run kata-runtime check (system compatibility)
-echo "[5/6] Running kata-runtime check (system compatibility)..."
-if ! kata-runtime check; then
-  echo "[ERROR] System is not capable of running Kata Containers."
-  exit 1
-fi
-
-# 6. Run a simple Kata container using containerd (if available)
-echo "[6/6] Attempting to run a test container with Kata runtime (containerd)..."
-if command -v ctr >/dev/null 2>&1; then
-  sudo ctr images pull docker.io/library/alpine:latest
-  # Start a container in the background (do not use --rm so we can exec into it)
-  sudo ctr run -d --runtime io.containerd.kata.v2 docker.io/library/alpine:latest kata-test-bg sleep 300
-  # Wait a moment for the container to be up
-  sleep 2
-  echo "[Test] Exec into the running container and run 'ls -lR /'..."
-  sudo ctr task exec -t --exec-id kata-ls kata-test-bg ls -lR /
-  echo "[Test] Show /etc/os-release inside the container..."
-  sudo ctr task exec -t --exec-id kata-osrel kata-test-bg cat /etc/os-release
-  # Clean up: kill the task and delete the container
-  echo "[Cleanup] Deleting test container..."
-  sudo ctr task kill kata-test-bg || true
-  sudo ctr task rm kata-test-bg || true
-  sudo ctr container rm kata-test-bg || true
-  # Also run the original test (run+rm)
-  sudo ctr run --runtime io.containerd.kata.v2 --rm docker.io/library/alpine:latest kata-test uname -a || {
-    echo "Failed to run container with Kata runtime."; exit 1;
-  }
-else
-  echo "containerd (ctr) not found, skipping container test."
-fi
-
-# Check logs for errors
-echo "[Post-test] Checking Kata logs for errors..."
-if journalctl --version >/dev/null 2>&1; then
-  sudo journalctl -xe | grep kata || echo "No kata logs found."
-else
-  echo "journalctl not found, skipping log check."
-fi
-
-echo "All tests completed. If no errors above, the RPM is likely working." 
\ No newline at end of file
diff --git a/vendor-tarball.sh b/vendor-tarball.sh
index fb6a23c..6676c88 100755
--- a/vendor-tarball.sh
+++ b/vendor-tarball.sh
@@ -2,7 +2,7 @@
 set -xeuo pipefail
 
 # Kata version
-KATA_VERSION=3.14.0
+KATA_VERSION=3.20.0
 RUST_SOURCES_TO_FIX="src/agent src/tools/kata-ctl"
 
 # Original vendor tarball downloaded from upstream