diff --git a/machines/dns01/_configuration.nix b/machines/dns01/_configuration.nix
index 2c5066d..bed7c7d 100644
--- a/machines/dns01/_configuration.nix
+++ b/machines/dns01/_configuration.nix
@@ -13,6 +13,7 @@ lib.extra.mkConfig {
   extraConfig = {
     # TODO : retrieve this address from meta/network.nix
     deployment.targetHost = "45.13.104.26";
+    deployment.tags = [ "cst1" ];
     networking.firewall = {
       enable = true;
       logRefusedConnections = lib.mkForce true;
diff --git a/machines/homebox01/_configuration.nix b/machines/homebox01/_configuration.nix
index f9617e1..ca2d2c6 100644
--- a/machines/homebox01/_configuration.nix
+++ b/machines/homebox01/_configuration.nix
@@ -12,6 +12,7 @@ lib.extra.mkConfig {
   ];
 
   extraConfig = {
+    deployment.tags = [ "cst1" ];
     networking = {
       firewall.allowedTCPPorts = [
         80
diff --git a/machines/photo01/_configuration.nix b/machines/photo01/_configuration.nix
index 5619a02..ed16d5a 100644
--- a/machines/photo01/_configuration.nix
+++ b/machines/photo01/_configuration.nix
@@ -13,6 +13,7 @@ in
     ./photoprism.nix
   ];
   deployment.targetHost = address;
+  deployment.tags = [ "cst1" ];
 
   networking = {
     firewall.allowedTCPPorts = [
diff --git a/machines/status01/_configuration.nix b/machines/status01/_configuration.nix
index ebce6a4..f30d639 100644
--- a/machines/status01/_configuration.nix
+++ b/machines/status01/_configuration.nix
@@ -12,6 +12,7 @@ lib.extra.mkConfig {
   ];
 
   extraConfig = {
+    deployment.tags = [ "cst1" ];
     networking = {
       firewall.allowedTCPPorts = [
         80