diff --git a/README.md b/README.md
index 381518590..6163d71e0 100644
--- a/README.md
+++ b/README.md
@@ -75,6 +75,7 @@ Other releases such as [UAA](https://github.com/cloudfoundry/uaa-release), [Cred
 - `misc/proxy.yml`: Configure HTTP proxy for Director and CPI
 - `misc/dns.yml`: Configure your upstream DNS (NOTE: by default bosh-deployment uses Google DNS: 8.8.8.8)
 - `misc/ntp.yml`: Configure your NTP Servers (NOTE: by default bosh-deployment uses Google NTP servers: time{1-4}.google.com
+- `misc/tags.yml`: Apply deployment tags to every instance in a deployment (var: `deployment_tags`; on GCP these are surfaced as resource labels)
 - `runtime-configs/syslog.yml`: Runtime config to enable syslog forwarding
 
 See [tests/run-checks.sh](tests/run-checks.sh) for example usage of different ops files.
diff --git a/misc/tags.yml b/misc/tags.yml
new file mode 100644
index 000000000..da4e3662f
--- /dev/null
+++ b/misc/tags.yml
@@ -0,0 +1,31 @@
+---
+
+# Apply deployment tags to every instance in the deployment.
+#
+# The BOSH Director forwards deployment tags to the CPI as instance metadata.
+# On GCP the google CPI surfaces them as resource labels, which makes them
+# visible in billing/cost reports; other CPIs map them onto their own resource
+# metadata (for example AWS EC2 tags).
+#
+# Usage:
+#
+#   bosh deploy ... -o misc/tags.yml \
+#     -v 'deployment_tags={"pipeline":"bosh-deployment","environment":"my-env"}'
+#
+# or supply a vars file:
+#
+#   # tags.yml
+#   deployment_tags:
+#     pipeline: bosh-deployment
+#     environment: my-env
+#
+#   bosh deploy ... -o misc/tags.yml --vars-file tags.yml
+#
+# The variable is named `deployment_tags` rather than `tags` because `tags` is
+# already used by the CPI ops files (for example gcp/cpi.yml) for VM network
+# tags. Any tags defined directly in the deployment manifest are replaced by
+# this ops file.
+
+- type: replace
+  path: /tags?
+  value: ((deployment_tags))