diff --git a/extras/rootless/containerd-rootless-setuptool.sh b/extras/rootless/containerd-rootless-setuptool.sh
index d4caaa941eb..a0537e929c6 100755
--- a/extras/rootless/containerd-rootless-setuptool.sh
+++ b/extras/rootless/containerd-rootless-setuptool.sh
@@ -112,7 +112,7 @@ cmd_entrypoint_check() {
 	fi
 
 	INFO "Checking cgroup v2"
-	controllers="/sys/fs/cgroup/user.slice/user-${id}.slice/user@${id}.service/cgroup.controllers"
+	controllers="/sys/fs/cgroup$(systemctl --user show --value --property=ControlGroup)/cgroup.controllers"
 	if [ ! -f "${controllers}" ]; then
 		WARNING "Enabling cgroup v2 is highly recommended, see https://rootlesscontaine.rs/getting-started/common/cgroup2/ "
 	else
diff --git a/pkg/infoutil/infoutil_linux.go b/pkg/infoutil/infoutil_linux.go
index a6839c19ae2..da0af0390f6 100644
--- a/pkg/infoutil/infoutil_linux.go
+++ b/pkg/infoutil/infoutil_linux.go
@@ -17,6 +17,7 @@
 package infoutil
 
 import (
+	"context"
 	"fmt"
 	"runtime"
 	"strings"
@@ -141,9 +142,12 @@ func fulfillPlatformInfo(info *dockercompat.Info, selinuxEnabled bool) {
 func mobySysInfo(info *dockercompat.Info) *sysinfo.SysInfo {
 	var mobySysInfoOpts []sysinfo.Opt
 	if info.CgroupDriver == "systemd" && info.CgroupVersion == "2" && rootlessutil.IsRootless() {
-		g := fmt.Sprintf("/user.slice/user-%d.slice", rootlessutil.ParentEUID())
-		mobySysInfoOpts = append(mobySysInfoOpts, sysinfo.WithCgroup2GroupPath(g))
+		groupPath, err := systemdUserManagerControlGroup(context.TODO())
+		if err != nil {
+			info.Warnings = append(info.Warnings, fmt.Sprintf("WARNING: Failed to detect rootless systemd cgroup: %v", err))
+			groupPath = fmt.Sprintf("/user.slice/user-%d.slice", rootlessutil.ParentEUID())
+		}
+		mobySysInfoOpts = append(mobySysInfoOpts, sysinfo.WithCgroup2GroupPath(groupPath))
 	}
-	mobySysInfo := sysinfo.New(mobySysInfoOpts...)
-	return mobySysInfo
+	return sysinfo.New(mobySysInfoOpts...)
 }
diff --git a/pkg/infoutil/rootless_cgroup_linux.go b/pkg/infoutil/rootless_cgroup_linux.go
new file mode 100644
index 00000000000..4b2523aa99e
--- /dev/null
+++ b/pkg/infoutil/rootless_cgroup_linux.go
@@ -0,0 +1,46 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package infoutil
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+
+	"github.com/coreos/go-systemd/v22/dbus"
+)
+
+// systemdUserManagerControlGroup returns the cgroup containing the systemd user
+// manager. Runc asks this manager to create rootless container scopes, so its
+// ControlGroup is authoritative even when nerdctl runs in another cgroup.
+func systemdUserManagerControlGroup(ctx context.Context) (string, error) {
+	conn, err := dbus.NewUserConnectionContext(ctx)
+	if err != nil {
+		return "", fmt.Errorf("connecting to systemd user manager: %w", err)
+	}
+	defer conn.Close()
+
+	property, err := conn.GetManagerProperty("ControlGroup")
+	if err != nil {
+		return "", fmt.Errorf("getting systemd user manager ControlGroup: %w", err)
+	}
+	groupPath, err := strconv.Unquote(property)
+	if err != nil {
+		return "", fmt.Errorf("decoding systemd user manager ControlGroup property %q: %w", property, err)
+	}
+	return groupPath, nil
+}