diff --git a/Chart.yaml b/Chart.yaml
index c99131c..10316ee 100644
--- a/Chart.yaml
+++ b/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: pgdog-control
 description: PgDog Control
 type: application
-version: 0.3.4
+version: 0.3.5
 appVersion: "main-ent"
diff --git a/README.md b/README.md
index 84347f7..75095d9 100644
--- a/README.md
+++ b/README.md
@@ -737,6 +737,9 @@ control:
       refresh_interval_secs: 60
       # Experimental: do not enable in production yet.
       autodiscovery: false
+      tags:
+        environment: production
+        "company:team": payments
     kube:
       refresh_interval_secs: 15
     dns:
@@ -747,15 +750,18 @@ control:
       period_secs: 60
 ```
 
-| Option                             | Description                                                                                                                                                          |
-| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `rds.refresh_interval_secs`        | How often to poll AWS RDS for cluster and instance topology (int, default `60`).                                                                                     |
-| `rds.autodiscovery`                | **Experimental. Do not enable in production yet.** Automatically reconcile Helm-managed PgDog database entries from discovered RDS topology (bool, default `false`). |
-| `kube.refresh_interval_secs`       | How often to poll Kubernetes for PgDog workloads. Independent of the `watch` streams, which fire on events (int, default `15`).                                      |
-| `dns.refresh_interval_secs`        | How often to re-resolve every known RDS hostname (int, default `30`).                                                                                                |
-| `cloudwatch.refresh_interval_secs` | How often to poll CloudWatch for per-instance metrics (int, default `60`).                                                                                           |
-| `cloudwatch.lookback_secs`         | How far back each fetch reaches. A fresh deploy pulls the full window on its first tick (int, default `3600`).                                                       |
-| `cloudwatch.period_secs`           | CloudWatch aggregation period. The smallest bucket the metric API returns (int, default `60`).                                                                       |
+| Option                             | Description                                                                                                                                                                                                                        |
+| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `rds.tags`                         | Tag key/value map used to select resources before RDS detail and parameter-group requests. All entries must match exactly, including case. Omit or use `{}` to discover all databases. Requires `tag:GetResources` (default `{}`). |
+| `rds.refresh_interval_secs`        | How often to poll AWS RDS for cluster and instance topology (int, default `60`).                                                                                                                                                   |
+| `rds.autodiscovery`                | **Experimental. Do not enable in production yet.** Automatically reconcile Helm-managed PgDog database entries from discovered RDS topology (bool, default `false`).                                                               |
+| `kube.refresh_interval_secs`       | How often to poll Kubernetes for PgDog workloads. Independent of the `watch` streams, which fire on events (int, default `15`).                                                                                                    |
+| `dns.refresh_interval_secs`        | How often to re-resolve every known RDS hostname (int, default `30`).                                                                                                                                                              |
+| `cloudwatch.refresh_interval_secs` | How often to poll CloudWatch for per-instance metrics (int, default `60`).                                                                                                                                                         |
+| `cloudwatch.lookback_secs`         | How far back each fetch reaches. A fresh deploy pulls the full window on its first tick (int, default `3600`).                                                                                                                     |
+| `cloudwatch.period_secs`           | CloudWatch aggregation period. The smallest bucket the metric API returns (int, default `60`).                                                                                                                                     |
+
+Matching clusters include all their member instances; standalone instances match their own tags. When filters are configured, the AWS role also needs `tag:GetResources` with `Resource: "*"`. The control plane uses this API to find matching resources before making scoped RDS requests.
 
 ### Alerting
 
diff --git a/templates/configmap.yaml b/templates/configmap.yaml
index 7a9c17d..96b80f5 100644
--- a/templates/configmap.yaml
+++ b/templates/configmap.yaml
@@ -44,6 +44,13 @@ data:
     {{- if hasKey . "autodiscovery" }}
     autodiscovery = {{ .autodiscovery }}
     {{- end }}
+    {{- with .tags }}
+
+    [rds.tags]
+    {{- range $name, $value := . }}
+    {{ $name | quote }} = {{ $value | quote }}
+    {{- end }}
+    {{- end }}
     {{- end }}
 
     {{- with $config.kube }}
diff --git a/test/values-full.yaml b/test/values-full.yaml
index 0263047..a1135fc 100644
--- a/test/values-full.yaml
+++ b/test/values-full.yaml
@@ -18,6 +18,10 @@ control:
     rds:
       refresh_interval_secs: 45
       autodiscovery: true
+      tags:
+        environment: production
+        "company:team": payments
+        "app.kubernetes.io/name": postgres
     kube:
       refresh_interval_secs: 10
     dns:
diff --git a/values.yaml b/values.yaml
index e514402..498dee4 100644
--- a/values.yaml
+++ b/values.yaml
@@ -115,6 +115,12 @@ control:
       # refresh_interval_secs: 60
       # Experimental: do not enable in production yet.
       # autodiscovery: false
+      # Select RDS resources by tag before fetching their details.
+      # All keys and values must match exactly (case-sensitive).
+      # Omit or use tags: {} to discover all databases. Requires tag:GetResources.
+      # tags:
+      #   environment: production
+      #   "company:team": payments
     kube: {}
       # refresh_interval_secs: 15
     dns: {}