diff --git a/bats/tests/helpers/defaults.bash b/bats/tests/helpers/defaults.bash
index 2e460624f76..cb4415c85a1 100644
--- a/bats/tests/helpers/defaults.bash
+++ b/bats/tests/helpers/defaults.bash
@@ -210,7 +210,7 @@ using_dev_mode() {
 # "all" will fetch the list of all k3s releases from GitHub
 # "latest" will fetch the list of latest versions from the release channel
 
-: "${RD_K3S_MIN:=1.0.0}"
+: "${RD_K3S_MIN:=1.21.0}"
 : "${RD_K3S_MAX:=1.99.0}"
 : "${RD_K3S_VERSIONS:=$RD_KUBERNETES_PREV_VERSION}"
 
diff --git a/bats/tests/helpers/kubernetes.bash b/bats/tests/helpers/kubernetes.bash
index 3b4526c83f6..d118e8d7f04 100644
--- a/bats/tests/helpers/kubernetes.bash
+++ b/bats/tests/helpers/kubernetes.bash
@@ -35,6 +35,25 @@ wait_for_kubelet() {
     done
 }
 
+# unwrap_kube_list removes the "List" wrapper from the JSON in $output if .kind is "List".
+# Returns an error if the number of .items in the List isn't exactly 1.
+unwrap_kube_list() {
+    local json=$output
+
+    run jq_output '.kind'
+    assert_success || return
+    if [[ $output == "List" ]]; then
+        run jq --raw-output '.items | length' <<<"$json"
+        assert_success || return
+        assert_output "1" || return
+
+        run jq --raw-output '.items[0]' <<<"$json"
+        assert_success || return
+        json=$output
+    fi
+    echo "$json"
+}
+
 assert_kube_deployment_available() {
     local jsonpath="jsonpath={.status.conditions[?(@.type=='Available')].status}"
     run --separate-stderr kubectl get deployment "$@" --output "$jsonpath"
@@ -47,6 +66,20 @@ wait_for_kube_deployment_available() {
     try assert_kube_deployment_available "$@"
 }
 
+assert_pod_containers_are_running() {
+    run kubectl get pod "$@" --output json
+    assert_success || return
+
+    # Make sure the query returned just a single pod
+    run unwrap_kube_list
+    assert_success || return
+
+    # Confirm that **all** containers of the pod are in "running" state
+    run jq_output '[.status.containerStatuses[].state | keys] | add | unique | .[]'
+    assert_success || return
+    assert_output "running"
+}
+
 traefik_ip() {
     local jsonpath='jsonpath={.status.loadBalancer.ingress[0].ip}'
     run --separate-stderr kubectl get service traefik --namespace kube-system --output "$jsonpath"
diff --git a/bats/tests/helpers/kubernetes.bats b/bats/tests/helpers/kubernetes.bats
new file mode 100644
index 00000000000..3806825dbd4
--- /dev/null
+++ b/bats/tests/helpers/kubernetes.bats
@@ -0,0 +1,51 @@
+load '../helpers/load'
+
+: "${RD_INFO:=false}"
+
+@test 'unwrap_kube_list: no list' {
+    run echo '{"kind": "Pod"}'
+    assert_success
+
+    run unwrap_kube_list
+    assert_success
+
+    run jq_output .kind
+    assert_success
+    assert_output Pod
+}
+
+@test 'unwrap_kube_list: no items' {
+    run echo '{"kind": "List"}'
+    assert_success
+
+    run unwrap_kube_list
+    assert_failure
+}
+
+@test 'unwrap_kube_list: one item' {
+    run echo '{"kind": "List", "items": [{"kind": "Pod"}]}'
+    assert_success
+
+    run unwrap_kube_list
+    assert_success
+
+    run jq_output .kind
+    assert_success
+    assert_output Pod
+}
+
+@test 'unwrap_kube_list: two items' {
+    run echo '{"kind": "List", "items": [{"kind": "Pod"},{"kind": "Pod"}]}'
+    assert_success
+
+    run unwrap_kube_list
+    assert_failure
+}
+
+@test 'unwrap_kube_list: not JSON' {
+    run echo 'Some random error message'
+    assert_success
+
+    run unwrap_kube_list
+    assert_failure
+}
diff --git a/bats/tests/k8s/foreach-k3s-version.bats b/bats/tests/k8s/foreach-k3s-version.bats
index fa9451d6bf6..c73d9ad16c5 100644
--- a/bats/tests/k8s/foreach-k3s-version.bats
+++ b/bats/tests/k8s/foreach-k3s-version.bats
@@ -1,6 +1,13 @@
 load '../helpers/load'
 
+wait_for_dns() {
+    try assert_pod_containers_are_running \
+        --namespace kube-system \
+        --selector k8s-app=kube-dns
+}
+
 foreach_k3s_version \
     factory_reset \
     start_kubernetes \
-    wait_for_kubelet
+    wait_for_kubelet \
+    wait_for_dns
diff --git a/pkg/rancher-desktop/backend/backendHelper.ts b/pkg/rancher-desktop/backend/backendHelper.ts
index f79701edcfe..291c687eb47 100644
--- a/pkg/rancher-desktop/backend/backendHelper.ts
+++ b/pkg/rancher-desktop/backend/backendHelper.ts
@@ -143,12 +143,22 @@ export default class BackendHelper {
     return patterns;
   }
 
-  /**
-   * k3s versions 1.24.1 to 1.24.3 don't support the --docker option and need to talk to
-   * a cri_dockerd endpoint when using the moby engine.
-   */
   static requiresCRIDockerd(engineName: string, kubeVersion: string | semver.SemVer): boolean {
-    return engineName === ContainerEngine.MOBY && semver.gte(kubeVersion, '1.24.1') && semver.lte(kubeVersion, '1.24.3');
+    if (engineName !== ContainerEngine.MOBY) {
+      return false;
+    }
+    const ranges = [
+      // versions 1.24.1 to 1.24.3 don't support the --docker option
+      '1.24.1 - 1.24.3',
+      // cri-dockerd bundled with k3s is not compatible with docker 25.x (using API 1.44)
+      // see https://github.com/k3s-io/k3s/issues/9279
+      '1.26.8 - 1.26.13',
+      '1.27.5 - 1.27.10',
+      '1.28.0 - 1.28.6',
+      '1.29.0 - 1.29.1',
+    ];
+
+    return semver.satisfies(kubeVersion, ranges.join('||'));
   }
 
   static checkForLockedVersion(newVersion: semver.SemVer, cfg: BackendSettings, sv: SettingsValidator): void {