diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 41e54fb1ae8b..58b97c74cdbe 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -51,6 +51,7 @@ updates:
 
       # runc/containerd
       - dependency-name: github.com/containerd/containerd
+      - dependency-name: github.com/opencontainers/runc
 
       # sonobuoy
       - dependency-name: github.com/vmware-tanzu/sonobuoy
diff --git a/pkg/constant/constant_test.go b/pkg/constant/constant_test.go
index f2b42e7858c0..ee952eab498e 100644
--- a/pkg/constant/constant_test.go
+++ b/pkg/constant/constant_test.go
@@ -22,6 +22,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"runtime"
 	"slices"
 	"strings"
 	"testing"
@@ -128,6 +129,29 @@ func TestContainerdModuleVersions(t *testing.T) {
 	)
 }
 
+func TestRuncModuleVersions(t *testing.T) {
+	runcVersion := getVersion(t, "runc")
+
+	numMatched := checkPackageModules(t,
+		func(modulePath string) bool {
+			return modulePath == "github.com/opencontainers/runc"
+		},
+		func(t *testing.T, pkgPath string, module *packages.Module) bool {
+			return !assert.Equal(t, "v"+runcVersion, module.Version,
+				"Module version for package %s doesn't match: %+#v",
+				pkgPath, module,
+			)
+		},
+	)
+
+	if runtime.GOOS == "windows" {
+		// The runc dependency is only a thing on Linux.
+		assert.Zero(t, numMatched, "Expected no packages to to pass the filter on Windows.")
+	} else {
+		assert.NotZero(t, numMatched, "Not a single package passed the filter.")
+	}
+}
+
 func getVersion(t *testing.T, component string) string {
 	cmd := exec.Command("sh", "./vars.sh", component+"_version")
 	cmd.Dir = filepath.Join("..", "..")