Currently the user has to override the systemd unit, with the later version of the pause image.

https://kubernetes.io/docs/setup/production-environment/container-runtimes/

It would be nice to have the latest one already in the default, in case the user misses this step...

detected that the sandbox image "registry.k8s.io/pause:3.9" of the container runtime is inconsistent with that used by kubeadm.It is recommended to use "registry.k8s.io/pause:3.10" as the CRI sandbox image.

kubeadm config images list
sudo kubeadm config images pull --cri-socket unix:///var/run/cri-dockerd.sock

You can run just the preflight: (this will also pull the kubernetes images)

sudo kubeadm init phase preflight --cri-socket unix:///var/run/cri-dockerd.sock --ignore-preflight-errors=All

Note that giving the socket is mandatory, otherwise kubeadm will complain about containerd:

found multiple CRI endpoints on the host. Please define which one do you wish to use by setting the 'criSocket' field in the kubeadm configuration file: unix:///var/run/containerd/containerd.sock, unix:///var/run/cri-dockerd.sock