diff --git a/common/libnetwork/network/interface.go b/common/libnetwork/network/interface.go
index a717775ad1..332c2e5b83 100644
--- a/common/libnetwork/network/interface.go
+++ b/common/libnetwork/network/interface.go
@@ -181,7 +181,7 @@ func getCniInterface(conf *config.Config) (types.ContainerNetwork, error) {
 	}
 	return cni.NewCNINetworkInterface(&cni.InitConfig{
 		CNIConfigDir:       confDir,
-		CNIPluginDirs:      conf.Network.CNIPluginDirs,
+		CNIPluginDirs:      conf.Network.CNIPluginDirs.Get(),
 		RunDir:             conf.Engine.TmpDir,
 		DefaultNetwork:     conf.Network.DefaultNetwork,
 		DefaultSubnet:      conf.Network.DefaultSubnet,
diff --git a/common/pkg/config/config.go b/common/pkg/config/config.go
index b42238d30c..dd473783ab 100644
--- a/common/pkg/config/config.go
+++ b/common/pkg/config/config.go
@@ -562,7 +562,7 @@ type NetworkConfig struct {
 	NetworkBackend string `toml:"network_backend,omitempty"`
 
 	// CNIPluginDirs is where CNI plugin binaries are stored.
-	CNIPluginDirs []string `toml:"cni_plugin_dirs,omitempty"`
+	CNIPluginDirs attributedstring.Slice `toml:"cni_plugin_dirs,omitempty"`
 
 	// NetavarkPluginDirs is a list of directories which contain netavark plugins.
 	NetavarkPluginDirs []string `toml:"netavark_plugin_dirs,omitempty"`
diff --git a/common/pkg/config/config_local_test.go b/common/pkg/config/config_local_test.go
index a74a6e2fd5..d643100db0 100644
--- a/common/pkg/config/config_local_test.go
+++ b/common/pkg/config/config_local_test.go
@@ -29,7 +29,7 @@ var _ = Describe("Config Local", func() {
 		file.Close()
 		defer os.Remove(tmpfile)
 		defConf.Network.NetworkConfigDir = tmpfile
-		defConf.Network.CNIPluginDirs = []string{}
+		defConf.Network.CNIPluginDirs.Values = []string{}
 
 		// When
 		err = defConf.Network.Validate()
@@ -51,7 +51,7 @@ var _ = Describe("Config Local", func() {
 
 		// Given
 		defConf.Network.NetworkConfigDir = validDirPath
-		defConf.Network.CNIPluginDirs = []string{invalidPath}
+		defConf.Network.CNIPluginDirs.Values = []string{invalidPath}
 
 		// When
 		err = defConf.Network.Validate()
@@ -72,7 +72,7 @@ var _ = Describe("Config Local", func() {
 		defer os.RemoveAll(validDirPath)
 		// Given
 		defConf.Network.NetworkConfigDir = validDirPath
-		defConf.Network.CNIPluginDirs = []string{validDirPath}
+		defConf.Network.CNIPluginDirs.Values = []string{validDirPath}
 
 		net, _ := types.ParseCIDR("10.0.0.0/24")
 		defConf.Network.DefaultSubnetPools = []SubnetPool{
diff --git a/common/pkg/config/config_test.go b/common/pkg/config/config_test.go
index 4fb0c416ef..b0dd81071b 100644
--- a/common/pkg/config/config_test.go
+++ b/common/pkg/config/config_test.go
@@ -289,7 +289,7 @@ image_copy_tmp_dir="storage"`
 			gomega.Expect(defaultConfig.Containers.Env.Values).To(gomega.BeEquivalentTo(envs))
 			gomega.Expect(defaultConfig.Containers.Mounts.Values).To(gomega.BeEquivalentTo(mounts))
 			gomega.Expect(defaultConfig.Containers.PidsLimit).To(gomega.BeEquivalentTo(2048))
-			gomega.Expect(defaultConfig.Network.CNIPluginDirs).To(gomega.Equal(pluginDirs))
+			gomega.Expect(defaultConfig.Network.CNIPluginDirs.Get()).To(gomega.Equal(pluginDirs))
 			gomega.Expect(defaultConfig.Network.NetavarkPluginDirs).To(gomega.Equal([]string{"/usr/netavark"}))
 			gomega.Expect(defaultConfig.Engine.NumLocks).To(gomega.BeEquivalentTo(2048))
 			gomega.Expect(defaultConfig.Engine.OCIRuntimes).To(gomega.Equal(OCIRuntimeMap))
@@ -430,7 +430,7 @@ image_copy_tmp_dir="storage"`
 			gomega.Expect(config.Containers.PidsLimit).To(gomega.BeEquivalentTo(2048))
 			gomega.Expect(config.Containers.Env.Values).To(gomega.BeEquivalentTo(envs))
 			gomega.Expect(config.Containers.UserNS).To(gomega.BeEquivalentTo(""))
-			gomega.Expect(config.Network.CNIPluginDirs).To(gomega.Equal(DefaultCNIPluginDirs))
+			gomega.Expect(config.Network.CNIPluginDirs.Get()).To(gomega.Equal(DefaultCNIPluginDirs))
 			gomega.Expect(config.Network.NetavarkPluginDirs).To(gomega.Equal(DefaultNetavarkPluginDirs))
 			gomega.Expect(config.Engine.NumLocks).To(gomega.BeEquivalentTo(2048))
 			gomega.Expect(config.Engine.OCIRuntimes["runc"]).To(gomega.Equal(OCIRuntimeMap["runc"]))
diff --git a/common/pkg/config/default.go b/common/pkg/config/default.go
index b0dae79130..e95f806cfe 100644
--- a/common/pkg/config/default.go
+++ b/common/pkg/config/default.go
@@ -233,7 +233,7 @@ func defaultConfig() (*Config, error) {
 			DefaultSubnetPools:        DefaultSubnetPools,
 			DefaultRootlessNetworkCmd: "slirp4netns",
 			DNSBindPort:               0,
-			CNIPluginDirs:             DefaultCNIPluginDirs,
+			CNIPluginDirs:             attributedstring.Slice{Values: DefaultCNIPluginDirs},
 			NetavarkPluginDirs:        DefaultNetavarkPluginDirs,
 		},
 		Engine:  *defaultEngineConfig,