diff --git a/apps/emqx/src/emqx_schema.erl b/apps/emqx/src/emqx_schema.erl
index 1dd0a55ed0..33d027c19a 100644
--- a/apps/emqx/src/emqx_schema.erl
+++ b/apps/emqx/src/emqx_schema.erl
@@ -167,7 +167,8 @@
     client_ssl_opts_schema/1,
     ciphers_schema/1,
     tls_versions_schema/1,
-    description_schema/0
+    description_schema/0,
+    tags_schema/0
 ]).
 -export([password_converter/2, bin_str_converter/2]).
 -export([authz_fields/0]).
@@ -3825,3 +3826,13 @@ description_schema() ->
             importance => ?IMPORTANCE_LOW
         }
     ).
+
+tags_schema() ->
+    sc(
+        hoconsc:array(binary()),
+        #{
+            desc => ?DESC(resource_tags),
+            required => false,
+            importance => ?IMPORTANCE_LOW
+        }
+    ).
diff --git a/apps/emqx/test/emqx_common_test_helpers.erl b/apps/emqx/test/emqx_common_test_helpers.erl
index d9c9470eb2..3ffcb1a6af 100644
--- a/apps/emqx/test/emqx_common_test_helpers.erl
+++ b/apps/emqx/test/emqx_common_test_helpers.erl
@@ -50,8 +50,6 @@
     client_ssl/1,
     client_mtls/0,
     client_mtls/1,
-    ssl_verify_fun_allow_any_host/0,
-    ssl_verify_fun_allow_any_host_impl/3,
     ensure_mnesia_stopped/0,
     ensure_quic_listener/2,
     ensure_quic_listener/3,
diff --git a/apps/emqx_bridge/src/schema/emqx_bridge_schema.erl b/apps/emqx_bridge/src/schema/emqx_bridge_schema.erl
index 6a1cb7fbc1..ee2dbafa7c 100644
--- a/apps/emqx_bridge/src/schema/emqx_bridge_schema.erl
+++ b/apps/emqx_bridge/src/schema/emqx_bridge_schema.erl
@@ -126,6 +126,7 @@ common_bridge_fields() ->
                     default => true
                 }
             )},
+        {tags, emqx_schema:tags_schema()},
         %% Create v2 connector then usr v1 /bridges_probe api to test connector
         %% /bridges_probe should pass through v2 connector's description.
         {description, emqx_schema:description_schema()}
diff --git a/apps/emqx_bridge/src/schema/emqx_bridge_v2_schema.erl b/apps/emqx_bridge/src/schema/emqx_bridge_v2_schema.erl
index e144f332de..514eb6988d 100644
--- a/apps/emqx_bridge/src/schema/emqx_bridge_v2_schema.erl
+++ b/apps/emqx_bridge/src/schema/emqx_bridge_v2_schema.erl
@@ -270,6 +270,7 @@ examples(Method) ->
 top_level_common_action_keys() ->
     [
         <<"connector">>,
+        <<"tags">>,
         <<"description">>,
         <<"enable">>,
         <<"local_topic">>,
@@ -301,6 +302,7 @@ make_consumer_action_schema(ActionParametersRef, Opts) ->
             mk(binary(), #{
                 desc => ?DESC(emqx_connector_schema, "connector_field"), required => true
             })},
+        {tags, emqx_schema:tags_schema()},
         {description, emqx_schema:description_schema()},
         {parameters, ActionParametersRef},
         {resource_opts,
diff --git a/apps/emqx_bridge_azure_event_hub/src/emqx_bridge_azure_event_hub.erl b/apps/emqx_bridge_azure_event_hub/src/emqx_bridge_azure_event_hub.erl
index a63249fa27..4ded55910b 100644
--- a/apps/emqx_bridge_azure_event_hub/src/emqx_bridge_azure_event_hub.erl
+++ b/apps/emqx_bridge_azure_event_hub/src/emqx_bridge_azure_event_hub.erl
@@ -134,6 +134,7 @@ fields(actions) ->
                     mk(binary(), #{
                         desc => ?DESC(emqx_connector_schema, "connector_field"), required => true
                     })},
+                {tags, emqx_schema:tags_schema()},
                 {description, emqx_schema:description_schema()}
             ],
     override_documentations(Fields);
diff --git a/apps/emqx_bridge_confluent/src/emqx_bridge_confluent_producer.erl b/apps/emqx_bridge_confluent/src/emqx_bridge_confluent_producer.erl
index dcae031eb6..9c647c62d0 100644
--- a/apps/emqx_bridge_confluent/src/emqx_bridge_confluent_producer.erl
+++ b/apps/emqx_bridge_confluent/src/emqx_bridge_confluent_producer.erl
@@ -121,6 +121,7 @@ fields(actions) ->
                     mk(binary(), #{
                         desc => ?DESC(emqx_connector_schema, "connector_field"), required => true
                     })},
+                {tags, emqx_schema:tags_schema()},
                 {description, emqx_schema:description_schema()}
             ],
     override_documentations(Fields);
diff --git a/apps/emqx_bridge_http/src/emqx_bridge_http_schema.erl b/apps/emqx_bridge_http/src/emqx_bridge_http_schema.erl
index a4d956d78b..009eb75e60 100644
--- a/apps/emqx_bridge_http/src/emqx_bridge_http_schema.erl
+++ b/apps/emqx_bridge_http/src/emqx_bridge_http_schema.erl
@@ -76,6 +76,7 @@ fields("http_action") ->
             mk(binary(), #{
                 desc => ?DESC(emqx_connector_schema, "connector_field"), required => true
             })},
+        {tags, emqx_schema:tags_schema()},
         {description, emqx_schema:description_schema()},
         %% Note: there's an implicit convention in `emqx_bridge' that,
         %% for egress bridges with this config, the published messages
@@ -175,6 +176,7 @@ basic_config() ->
                     default => true
                 }
             )},
+        {tags, emqx_schema:tags_schema()},
         {description, emqx_schema:description_schema()}
     ] ++ connector_opts().
 
diff --git a/apps/emqx_bridge_kafka/src/emqx_bridge_kafka.erl b/apps/emqx_bridge_kafka/src/emqx_bridge_kafka.erl
index d74ff40a13..061543b2b0 100644
--- a/apps/emqx_bridge_kafka/src/emqx_bridge_kafka.erl
+++ b/apps/emqx_bridge_kafka/src/emqx_bridge_kafka.erl
@@ -297,6 +297,7 @@ fields(kafka_producer_action) ->
             mk(binary(), #{
                 desc => ?DESC(emqx_connector_schema, "connector_field"), required => true
             })},
+        {tags, emqx_schema:tags_schema()},
         {description, emqx_schema:description_schema()}
     ] ++ producer_opts(action);
 fields(kafka_consumer) ->
diff --git a/apps/emqx_bridge_syskeeper/src/emqx_bridge_syskeeper.erl b/apps/emqx_bridge_syskeeper/src/emqx_bridge_syskeeper.erl
index 091b84196f..7d506b9c81 100644
--- a/apps/emqx_bridge_syskeeper/src/emqx_bridge_syskeeper.erl
+++ b/apps/emqx_bridge_syskeeper/src/emqx_bridge_syskeeper.erl
@@ -86,6 +86,7 @@ fields(action) ->
 fields(config) ->
     [
         {enable, mk(boolean(), #{desc => ?DESC("config_enable"), default => true})},
+        {tags, emqx_schema:tags_schema()},
         {description, emqx_schema:description_schema()},
         {connector,
             mk(binary(), #{
diff --git a/apps/emqx_connector/src/schema/emqx_connector_schema.erl b/apps/emqx_connector/src/schema/emqx_connector_schema.erl
index b043ebacd3..ad28d02516 100644
--- a/apps/emqx_connector/src/schema/emqx_connector_schema.erl
+++ b/apps/emqx_connector/src/schema/emqx_connector_schema.erl
@@ -503,6 +503,7 @@ api_fields("put_connector", _Type, Fields) ->
 common_fields() ->
     [
         {enable, mk(boolean(), #{desc => ?DESC("config_enable"), default => true})},
+        {tags, emqx_schema:tags_schema()},
         {description, emqx_schema:description_schema()}
     ].
 
diff --git a/changes/ce/feat-12333.en.md b/changes/ce/feat-12333.en.md
new file mode 100644
index 0000000000..c29edca8b9
--- /dev/null
+++ b/changes/ce/feat-12333.en.md
@@ -0,0 +1,3 @@
+Add 'tags' field for actions and connectors
+
+Similar to 'description' field (which is a free text annotation), 'tags' can be used to annotate actions and connectors for filtering/grouping.
diff --git a/rel/i18n/emqx_schema.hocon b/rel/i18n/emqx_schema.hocon
index fe315b5d76..af4251328b 100644
--- a/rel/i18n/emqx_schema.hocon
+++ b/rel/i18n/emqx_schema.hocon
@@ -1570,6 +1570,11 @@ description.label:
 description.desc:
 """Descriptive text."""
 
+resource_tags.label:
+"""Tags"""
+resource_tags.desc:
+"""Tags to annotate this config entry."""
+
 session_persistence_enable.desc:
 """Use durable storage for client sessions persistence.
 If enabled, sessions configured to outlive client connections, along with their corresponding messages, will be durably stored and survive broker downtime."""