diff --git a/deploy/Makefile b/deploy/Makefile
index 18959e9..ff0a9ba 100644
--- a/deploy/Makefile
+++ b/deploy/Makefile
@@ -83,6 +83,9 @@ fencing-assisted:
 	@$(MAKE) fencing-ipi
 	@./openshift-clusters/scripts/deploy-fencing-assisted.sh
 
+tag:
+	@../helpers/tag-instance.sh '$(DAYS)'
+
 patch-nodes:
 	@./openshift-clusters/scripts/patch-nodes.sh
 get-tnf-logs:
@@ -105,7 +108,9 @@ help:
 	@echo "Instance Utils:"
 	@echo "  ssh                  - SSH into the EC2 instance"
 	@echo "  info                 - Display instance information"
-	@echo "  inventory            - Update inventory.ini with current instance IP" 
+	@echo "  inventory            - Update inventory.ini with current instance IP"
+	@echo "  tag                  - Tag instance with keep-N retention (default: 2, max: 5)"
+	@echo "                         Usage: make tag or make tag DAYS=5"
 	@echo ""
 	@echo "OpenShift Cluster Deployment:"
 	@echo "  fencing-ipi          - Deploy fencing IPI cluster (non-interactive)"
diff --git a/helpers/tag-instance.sh b/helpers/tag-instance.sh
new file mode 100755
index 0000000..967d90f
--- /dev/null
+++ b/helpers/tag-instance.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INSTANCE_DATA="${SCRIPT_DIR}/../deploy/aws-hypervisor/instance-data/node-0"
+if [[ ! -f "${INSTANCE_DATA}/aws-instance-id" ]]; then
+    echo "Error: No instance found. Please run 'make deploy' first." >&2
+    exit 1
+fi
+INSTANCE_ID=$(cat "${INSTANCE_DATA}/aws-instance-id")
+if [[ -z "${INSTANCE_ID}" ]]; then
+    echo "Error: No instance found. Please run 'make deploy' first." >&2
+    exit 1
+fi
+
+# Source instance.env for REGION (same as deploy/aws-hypervisor/scripts/common.sh)
+INSTANCE_ENV="${SCRIPT_DIR}/../deploy/aws-hypervisor/instance.env"
+if [[ -f "${INSTANCE_ENV}" ]]; then
+    # shellcheck source=/dev/null
+    source "${INSTANCE_ENV}"
+fi
+
+REGION="${REGION:-${AWS_DEFAULT_REGION:-}}"
+if [[ -z "${REGION}" ]]; then
+    echo "ERROR: No AWS region configured. Set REGION in instance.env or export AWS_DEFAULT_REGION." >&2
+    exit 1
+fi
+
+DAYS="${1:-2}"
+
+if ! [[ "${DAYS}" =~ ^[1-9][0-9]*$ ]]; then
+    echo "ERROR: Days must be a positive integer, got '${DAYS}'." >&2
+    exit 1
+fi
+
+if (( DAYS > 5 )); then
+    echo "ERROR: Days cannot exceed 5, got '${DAYS}'." >&2
+    exit 1
+fi
+
+TAG_VALUE="keep-${DAYS}"
+
+echo "Tagging instance ${INSTANCE_ID} in ${REGION} with ${TAG_VALUE}"
+aws ec2 create-tags --region "${REGION}" --resources "${INSTANCE_ID}" \
+    --tags "Key=${TAG_VALUE},Value=true" --no-cli-pager
+echo "Done."