diff --git a/roles/kubespray_defaults/defaults/main/download.yml b/roles/kubespray_defaults/defaults/main/download.yml
index 4c2161d02..2adb7ad30 100644
--- a/roles/kubespray_defaults/defaults/main/download.yml
+++ b/roles/kubespray_defaults/defaults/main/download.yml
@@ -167,7 +167,7 @@ helm_download_url: "{{ get_helm_url }}/helm-v{{ helm_version }}-linux-{{ image_a
 runc_download_url: "{{ github_url }}/opencontainers/runc/releases/download/v{{ runc_version }}/runc.{{ image_arch }}"
 crun_download_url: "{{ github_url }}/containers/crun/releases/download/{{ crun_version }}/crun-{{ crun_version }}-linux-{{ image_arch }}"
 youki_download_url: "{{ github_url }}/youki-dev/youki/releases/download/v{{ youki_version }}/youki-{{ youki_version }}-{{ ansible_facts['architecture'] }}-gnu.tar.gz"
-kata_containers_download_url: "{{ github_url }}/kata-containers/kata-containers/releases/download/{{ kata_containers_version }}/kata-static-{{ kata_containers_version }}-{{ image_arch }}.tar.xz"
+kata_containers_download_url: "{{ github_url }}/kata-containers/kata-containers/releases/download/{{ kata_containers_version }}/kata-static-{{ kata_containers_version }}-{{ image_arch }}.tar.zst"
 # gVisor only supports amd64 and uses x86_64 to in the download link
 gvisor_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_facts['architecture'] }}/runsc"
 gvisor_containerd_shim_runsc_download_url: "{{ storage_googleapis_url }}/gvisor/releases/release/{{ gvisor_version }}/{{ ansible_facts['architecture'] }}/containerd-shim-runsc-v1"
@@ -515,7 +515,7 @@ downloads:
   kata_containers:
     enabled: "{{ kata_containers_enabled }}"
     file: true
-    dest: "{{ local_release_dir }}/kata-static-{{ kata_containers_version }}-{{ image_arch }}.tar.xz"
+    dest: "{{ local_release_dir }}/kata-static-{{ kata_containers_version }}-{{ image_arch }}.tar.zst"
     checksum: "{{ kata_containers_binary_checksum }}"
     url: "{{ kata_containers_download_url }}"
     unarchive: false
diff --git a/roles/kubespray_defaults/vars/main/checksums.yml b/roles/kubespray_defaults/vars/main/checksums.yml
index dd430ae84..42bf39766 100644
--- a/roles/kubespray_defaults/vars/main/checksums.yml
+++ b/roles/kubespray_defaults/vars/main/checksums.yml
@@ -892,13 +892,17 @@ youki_checksums:
     0.4.0: sha256:0d897debaee98a937188317304a9caafb0da5bf798717aefedf113c108f73263
 kata_containers_binary_checksums:
   amd64:
-    3.7.0: sha256:bebf218cafdc082476c7dabbcc5439aee6a41d6dda24dd3cfffbe0a6ae94e23d
-    3.6.0: sha256:d418859e123d04edd71e79c8f532213e5281ec7170b97cdfe3cf85487187d60f
-    3.5.0: sha256:cd0e6a70828db3f9e27390f08c863edda36824c201c35eaa0a4c7498b7e4c9e3
+    3.32.0: sha256:1449ecea50bd91fa73a94648db195d18950fe869ba4b1f12d05f55f1fa7c1b01
+    3.31.0: sha256:68c2786a0b97023f62f3eca02dc868b78a794e5469d4ddd6cc9e0bd4a7212b0b
+    3.30.0: sha256:e65aa5e5bd9f4d59bcd12a8c44a00966406e7329511dd3f756026b6eedc8ad26
+    3.29.0: sha256:19d0241405bc2b8fdc74240f381ab021880d1d8c7adf1fd7859f8f6370e735f3
+    3.28.0: sha256:99cefb46d70bc27b7bcffd7595be9010c6bed43e1cdfcf8078554c19e7c9b19d
   arm64:
-    3.7.0: sha256:23e0d5c4e38c6944729a11c631f947abc5aab19427a44d8691bfb9ad1c38b831
-    3.6.0: sha256:38277c8d1b9f3c4ea1089338f9251238551b88a5259e8e8ed45fe392ec1ed4bd
-    3.5.0: sha256:fa4cf67d010244c4f8d0e6d450d04e28d1bbce5ad1a3cbc0154adff628d56c0c
+    3.32.0: sha256:8736c054d9223974735394f822000823baef509e1c33405ec798240fa9b6e4b5
+    3.31.0: sha256:42a7e67a2c2bf3e97a615c99a293b2bc01ea9c84111fc2bf4abeedb7adc9c2ac
+    3.30.0: sha256:3f9df0cc898716caa3dd29315d1d5a1e9a6ad2b355ed6a4698eca81a8fbcdc41
+    3.29.0: sha256:f1309973134d48015a3b283d26f53d66c42bb590c53813c8ed2254212a24d1ad
+    3.28.0: sha256:f63d54507d1f18635d94475077e4c2330de4d8e05cedf25f7c38f063b0e66a91
 gvisor_runsc_binary_checksums:
   arm64:
     '20260608.0': sha512:9c7c74453b3a08c6663d72680355edb56a86e9b1ef6637b0ab5942b576d47eaf2ab6b448a0f8e9408757c6ffed116ff95d2885e6ed8cc0bd3b27036af5b27450
diff --git a/roles/system_packages/vars/main.yml b/roles/system_packages/vars/main.yml
index a0cda8fd2..e829fc98d 100644
--- a/roles/system_packages/vars/main.yml
+++ b/roles/system_packages/vars/main.yml
@@ -112,3 +112,5 @@ pkgs:
   tar: []
   unzip: []
   xfsprogs: []
+  zstd:
+    - "{{ kata_containers_enabled }}"