@@ -382,6 +382,7 @@ pub async fn ensure_required_providers(
         loop {
             let response = client
                 .list_providers(ListProvidersRequest {
+                    label_selector: String::new(),
                     page_size: 100,
                     page_token,
                     workspace_scope: Some(openshell_core::proto::workspace_selector(workspace)),
@@ -1046,6 +1047,7 @@ pub async fn provider_create(
         server,
         name,
         provider_type,
+        labels: &[],
         credentials,
         credential_source,
         config,
@@ -1060,6 +1062,7 @@ pub struct ProviderCreateOptions<'a> {
     pub server: &'a str,
     pub name: &'a str,
     pub provider_type: &'a str,
+    pub labels: &'a [String],
     pub credentials: &'a [String],
     pub credential_source: ProviderCreateCredentialSource,
     pub config: &'a [String],
@@ -1082,6 +1085,7 @@ pub async fn provider_create_with_options(options: ProviderCreateOptions<'_>) ->
         server,
         name,
         provider_type,
+        labels,
         credentials,
         credential_source,
         config,
@@ -1090,6 +1094,8 @@ pub async fn provider_create_with_options(options: ProviderCreateOptions<'_>) ->
         tls,
     } = options;
 
+    let labels = parse_key_value_pairs(labels, "--label")?;
+
     let from_existing = credential_source == ProviderCreateCredentialSource::Existing;
     let from_gcloud_adc = credential_source == ProviderCreateCredentialSource::GcloudAdc;
     let from_oidc_token = credential_source == ProviderCreateCredentialSource::OidcToken;
@@ -1209,7 +1215,7 @@ pub async fn provider_create_with_options(options: ProviderCreateOptions<'_>) ->
                     id: String::new(),
                     name: name.to_string(),
                     created_time: None,
-                    labels: HashMap::new(),
+                    labels,
                     resource_version: 0,
                     annotations: HashMap::new(),
                     workspace: workspace.to_string(),
@@ -1346,6 +1352,21 @@ pub async fn provider_get(
     println!("  {} {}", "Id:".dimmed(), provider.object_id());
     println!("  {} {}", "Name:".dimmed(), provider.object_name());
     println!("  {} {}", "Type:".dimmed(), provider.r#type);
+    if let Some(meta) = &provider.metadata
+        && !meta.labels.is_empty()
+    {
+        let mut labels: Vec<_> = meta.labels.iter().collect();
+        labels.sort_unstable_by_key(|(key, _)| *key);
+        println!(
+            "  {} {}",
+            "Labels:".dimmed(),
+            labels
+                .into_iter()
+                .map(|(key, value)| format!("{key}={value}"))
+                .collect::<Vec<_>>()
+                .join(", ")
+        );
+    }
     println!(
         "  {} {}",
         "Resource version:".dimmed(),
@@ -1455,6 +1476,7 @@ pub async fn provider_list(
     server: &str,
     page_size: i32,
     page_token: &str,
+    label_selector: &str,
     names_only: bool,
     output: &str,
     workspace: &str,
@@ -1466,6 +1488,7 @@ pub async fn provider_list(
         .list_providers(ListProvidersRequest {
             page_size,
             page_token: page_token.to_string(),
+            label_selector: label_selector.to_string(),
             workspace_scope: Some(if all_workspaces {
                 openshell_core::proto::all_workspaces_selector()
             } else {
 
@@ -63,6 +63,7 @@ pub fn complete_provider_names(_prefix: &OsStr) -> Vec<CompletionCandidate> {
         let mut client = completion_grpc_client(&endpoint, &gateway_name).await?;
         let response = client
             .list_providers(ListProvidersRequest {
+                label_selector: String::new(),
                 page_size: 200,
                 page_token: String::new(),
                 workspace_scope: Some(openshell_core::proto::workspace_selector(
 
@@ -860,6 +860,10 @@ enum ProviderCommands {
         #[arg(long = "type")]
         provider_type: String,
 
+        /// Labels to attach to the provider (KEY=VALUE, repeatable).
+        #[arg(long = "label", value_name = "KEY=VALUE")]
+        labels: Vec<String>,
+
         /// Load provider credentials/config from existing local state.
         #[arg(long, conflicts_with_all = ["credentials", "from_gcloud_adc", "runtime_credentials", "from_oidc_token"])]
         from_existing: bool,
@@ -919,6 +923,10 @@ enum ProviderCommands {
         #[arg(long, default_value = "")]
         page_token: String,
 
+        /// Filter providers by labels (e.g. env=dev,team=ml).
+        #[arg(long)]
+        label_selector: Option<String>,
+
         /// Print only provider names, one per line.
         #[arg(long, conflicts_with = "output")]
         names: bool,
@@ -3876,6 +3884,7 @@ async fn run_async() -> Result<()> {
                 ProviderCommands::Create {
                     name,
                     provider_type,
+                    labels,
                     from_existing,
                     credentials,
                     from_gcloud_adc,
@@ -3900,6 +3909,7 @@ async fn run_async() -> Result<()> {
                         server: endpoint,
                         name: &name,
                         provider_type: provider_type.as_str(),
+                        labels: &labels,
                         credentials: &credentials,
                         credential_source,
                         config: &config,
@@ -3995,6 +4005,7 @@ async fn run_async() -> Result<()> {
                 ProviderCommands::List {
                     page_size,
                     page_token,
+                    label_selector,
                     names,
                     output,
                     all_workspaces,
@@ -4003,6 +4014,7 @@ async fn run_async() -> Result<()> {
                         endpoint,
                         page_size,
                         &page_token,
+                        label_selector.as_deref().unwrap_or_default(),
                         names,
                         output.as_str(),
                         &cli.workspace,
@@ -5653,6 +5665,75 @@ mod tests {
         }
     }
 
+    #[test]
+    fn provider_create_accepts_labels_with_each_credential_source() {
+        for source in [
+            vec![],
+            vec!["--from-existing"],
+            vec!["--credential", "GITHUB_TOKEN=token"],
+            vec!["--from-gcloud-adc"],
+            vec!["--from-oidc-token"],
+            vec!["--runtime-credentials"],
+        ] {
+            let mut args = vec![
+                "openshell",
+                "provider",
+                "create",
+                "--name",
+                "labeled",
+                "--type",
+                "github",
+                "--label",
+                "env=dev",
+                "--label",
+                "team=ml",
+            ];
+            args.extend(source);
+            let cli = Cli::try_parse_from(args).unwrap();
+            match cli.command {
+                Some(Commands::Provider {
+                    command: Some(ProviderCommands::Create { labels, .. }),
+                }) => assert_eq!(labels, ["env=dev", "team=ml"]),
+                other => panic!("expected provider create, got {other:?}"),
+            }
+        }
+    }
+
+    #[test]
+    fn provider_list_accepts_label_selector_in_all_output_modes() {
+        for output in [
+            vec![],
+            vec!["--names"],
+            vec!["-o", "json"],
+            vec!["-o", "yaml"],
+        ] {
+            let mut args = vec![
+                "openshell",
+                "provider",
+                "list",
+                "--all-workspaces",
+                "--label-selector",
+                "env=dev,team=ml",
+            ];
+            args.extend(output);
+            let cli = Cli::try_parse_from(args).unwrap();
+            match cli.command {
+                Some(Commands::Provider {
+                    command:
+                        Some(ProviderCommands::List {
+                            label_selector,
+                            all_workspaces,
+                            ..
+                        }),
+                }) => {
+                    assert_eq!(label_selector.as_deref(), Some("env=dev,team=ml"));
+                    assert!(all_workspaces);
+                }
+                other => panic!("expected provider list, got {other:?}"),
+            }
+        }
+    }
+
     #[test]
     fn provider_create_accepts_no_credential_source() {
         let cli = Cli::try_parse_from([
 
@@ -42,6 +42,7 @@ use tonic::{Response, Status};
 #[derive(Clone, Default)]
 struct ProviderState {
     providers: Arc<Mutex<HashMap<String, Provider>>>,
+    list_requests: Arc<Mutex<Vec<ListProvidersRequest>>>,
 }
 
 #[derive(Clone, Default)]
@@ -364,8 +365,13 @@ impl OpenShell for TestOpenShell {
 
     async fn list_providers(
         &self,
-        _request: tonic::Request<ListProvidersRequest>,
+        request: tonic::Request<ListProvidersRequest>,
     ) -> Result<Response<ListProvidersResponse>, Status> {
+        self.state
+            .list_requests
+            .lock()
+            .await
+            .push(request.into_inner());
         let providers = self
             .state
             .providers
@@ -867,6 +873,108 @@ async fn run_server() -> TestServer {
 
 // ── tests ────────────────────────────────────────────────────────────
 
+#[tokio::test]
+async fn provider_create_forwards_labels_for_explicit_and_discovered_credentials() {
+    let ts = run_server().await;
+    Environment::from_pairs(&[("NVIDIA_API_KEY", "nvapi-test-key")])
+        .run_async(async {
+            let labels = vec!["env=dev".to_string(), "team=ml".to_string()];
+            let credentials = vec!["NVIDIA_API_KEY=test-explicit".to_string()];
+            for (name, source, credentials) in [
+                (
+                    "explicit",
+                    run::ProviderCreateCredentialSource::ExplicitCredentials,
+                    credentials.as_slice(),
+                ),
+                (
+                    "discovered",
+                    run::ProviderCreateCredentialSource::Existing,
+                    &[],
+                ),
+            ] {
+                run::provider_create_with_options(run::ProviderCreateOptions {
+                    server: &ts.endpoint,
+                    name,
+                    provider_type: "nvidia",
+                    labels: &labels,
+                    credentials,
+                    credential_source: source,
+                    config: &[],
+                    workspace: "default",
+                    profile_workspace: "",
+                    tls: &ts.tls,
+                })
+                .await
+                .unwrap();
+                let providers = ts.openshell.state.providers.lock().await;
+                let provider = &providers[name];
+                assert_eq!(
+                    provider.metadata.as_ref().unwrap().labels,
+                    HashMap::from([("env".into(), "dev".into()), ("team".into(), "ml".into())])
+                );
+                assert!(provider.credentials.contains_key("NVIDIA_API_KEY"));
+            }
+
+            for label in ["no-equals-sign", "=no-key"] {
+                let err = run::provider_create_with_options(run::ProviderCreateOptions {
+                    server: &ts.endpoint,
+                    name: "invalid",
+                    provider_type: "nvidia",
+                    labels: &[label.into()],
+                    credentials: &credentials,
+                    credential_source: run::ProviderCreateCredentialSource::ExplicitCredentials,
+                    config: &[],
+                    workspace: "default",
+                    profile_workspace: "",
+                    tls: &ts.tls,
+                })
+                .await
+                .unwrap_err();
+                assert!(err.to_string().contains("--label"));
+            }
+            assert!(
+                !ts.openshell
+                    .state
+                    .providers
+                    .lock()
+                    .await
+                    .contains_key("invalid")
+            );
+        })
+        .await;
+}
+
+#[tokio::test]
+async fn provider_list_forwards_selector_pagination_and_workspace_scope() {
+    let ts = run_server().await;
+    for all_workspaces in [false, true] {
+        run::provider_list(
+            &ts.endpoint,
+            3,
+            "cursor",
+            "env=dev,team=ml",
+            false,
+            "json",
+            "team-ml",
+            all_workspaces,
+            &ts.tls,
+        )
+        .await
+        .unwrap();
+        let requests = ts.openshell.state.list_requests.lock().await;
+        let request = requests.last().unwrap();
+        assert_eq!(request.page_size, 3);
+        assert_eq!(request.page_token, "cursor");
+        assert_eq!(request.label_selector, "env=dev,team=ml");
+        let expected = if all_workspaces {
+            openshell_core::proto::all_workspaces_selector()
+        } else {
+            openshell_core::proto::workspace_selector("team-ml")
+        };
+        assert_eq!(request.workspace_scope.as_ref(), Some(&expected));
+    }
+}
+
 /// When `--provider nvidia` is passed and a provider named "nvidia" already
 /// exists, `ensure_required_providers` should return it directly without
 /// creating anything new.