diff --git a/terraform/environments/production/main.tf b/terraform/environments/production/main.tf
index fc029c7..0197d78 100644
--- a/terraform/environments/production/main.tf
+++ b/terraform/environments/production/main.tf
@@ -35,7 +35,7 @@ module "vms" {
   ssh_public_keys   = var.ssh_public_keys
   cores             = each.value.cores
   memory_mb         = each.value.memory_mb
-  tags              = ["production", each.value.group]
+  tags              = ["production", each.value.group, "managed-by=terraform"]
 }
 
 # Internal DNS records are NOT managed here. Terraform owns VM existence only;
diff --git a/terraform/environments/staging/main.tf b/terraform/environments/staging/main.tf
index ffae2fe..624f92b 100644
--- a/terraform/environments/staging/main.tf
+++ b/terraform/environments/staging/main.tf
@@ -29,7 +29,7 @@ module "vms" {
   ssh_public_keys   = var.ssh_public_keys
   cores             = each.value.cores
   memory_mb         = each.value.memory_mb
-  tags              = ["staging", each.value.group]
+  tags              = ["staging", each.value.group, "managed-by=terraform"]
 }
 
 # Internal DNS records are NOT managed here. Terraform owns VM existence only;