diff --git a/docs/pull.md b/docs/pull.md
index 65c4c7b8..63b08f3e 100644
--- a/docs/pull.md
+++ b/docs/pull.md
@@ -94,7 +94,7 @@ See the [examples/credential_helper](/examples/credential_helper/auth.sh) direct
 
 <pre>
 oci_pull(<a href="#oci_pull-name">name</a>, <a href="#oci_pull-image">image</a>, <a href="#oci_pull-repository">repository</a>, <a href="#oci_pull-registry">registry</a>, <a href="#oci_pull-platforms">platforms</a>, <a href="#oci_pull-digest">digest</a>, <a href="#oci_pull-tag">tag</a>, <a href="#oci_pull-reproducible">reproducible</a>, <a href="#oci_pull-is_bzlmod">is_bzlmod</a>, <a href="#oci_pull-config">config</a>,
-         <a href="#oci_pull-config_path">config_path</a>)
+         <a href="#oci_pull-config_path">config_path</a>, <a href="#oci_pull-bazel_tags">bazel_tags</a>)
 </pre>
 
 Repository macro to fetch image manifest data from a remote docker registry.
@@ -123,5 +123,6 @@ in rules like `oci_image`.
 | <a id="oci_pull-is_bzlmod"></a>is_bzlmod |  whether the oci_pull is being called from a module extension   |  <code>False</code> |
 | <a id="oci_pull-config"></a>config |  Label to a <code>.docker/config.json</code> file.   |  <code>None</code> |
 | <a id="oci_pull-config_path"></a>config_path |  Deprecated. use <code>config</code> attribute or DOCKER_CONFIG environment variable.   |  <code>None</code> |
+| <a id="oci_pull-bazel_tags"></a>bazel_tags |  Bazel tags to be propagated to generated rules.   |  <code>[]</code> |
 
 
diff --git a/oci/private/pull.bzl b/oci/private/pull.bzl
index 64b21cbf..ab897c33 100644
--- a/oci/private/pull.bzl
+++ b/oci/private/pull.bzl
@@ -178,6 +178,7 @@ copy_to_directory(
         "oci-layout",
         "index.json",
     ],
+    tags = {bazel_tags},
     visibility = ["//visibility:public"]
 )
 """
@@ -274,8 +275,11 @@ def _oci_pull_impl(rctx):
     ))
     rctx.file("oci-layout", json.encode_indent({"imageLayoutVersion": "1.0.0"}, indent = "    "))
 
+    bazel_tags = "[\"{}\"]".format("\", \"".join(rctx.attr.bazel_tags))
+
     rctx.file("BUILD.bazel", content = _BUILD_FILE_TMPL.format(
         target_name = rctx.attr.target_name,
+        bazel_tags = bazel_tags,
     ))
 
 oci_pull = repository_rule(
@@ -290,6 +294,9 @@ oci_pull = repository_rule(
                 doc = "Name given for the image target, e.g. 'image'",
                 mandatory = True,
             ),
+            "bazel_tags": attr.string_list(
+                doc = "Bazel tags to apply to generated targets of this rule",
+            ),
         },
     ),
     environ = authn.ENVIRON,
diff --git a/oci/pull.bzl b/oci/pull.bzl
index c5ab6979..024f9b77 100644
--- a/oci/pull.bzl
+++ b/oci/pull.bzl
@@ -103,7 +103,7 @@ _PLATFORM_TO_BAZEL_CPU = {
     "linux/mips64le": "@platforms//cpu:mips64",
 }
 
-def oci_pull(name, image = None, repository = None, registry = None, platforms = None, digest = None, tag = None, reproducible = True, is_bzlmod = False, config = None, config_path = None):
+def oci_pull(name, image = None, repository = None, registry = None, platforms = None, digest = None, tag = None, reproducible = True, is_bzlmod = False, config = None, config_path = None, bazel_tags = []):
     """Repository macro to fetch image manifest data from a remote docker registry.
 
     To use the resulting image, you can use the `@wkspc` shorthand label, for example
@@ -138,6 +138,7 @@ def oci_pull(name, image = None, repository = None, registry = None, platforms =
         config: Label to a `.docker/config.json` file.
         config_path: Deprecated. use `config` attribute or DOCKER_CONFIG environment variable.
         is_bzlmod: whether the oci_pull is being called from a module extension
+        bazel_tags: Bazel tags to be propagated to generated rules.
     """
 
     # Check syntax sugar for registry/repository in place of image
@@ -184,6 +185,7 @@ def oci_pull(name, image = None, repository = None, registry = None, platforms =
                 config = config,
                 # TODO(2.0): remove
                 config_path = config_path,
+                bazel_tags = bazel_tags,
             )
 
             if plat in _PLATFORM_TO_BAZEL_CPU:
@@ -208,6 +210,7 @@ def oci_pull(name, image = None, repository = None, registry = None, platforms =
             config = config,
             # TODO(2.0): remove
             config_path = config_path,
+            bazel_tags = bazel_tags,
         )
 
     oci_alias(